lucastealer | 29e841b19b52bd24701d86e7d5bbdc74391a0d00ed645b0fefec9c78d56c2b72[.]bin

Resubmissions

24-07-2023 06:15

230724-gz1l4abb4s 10

03-08-2022 13:09

220803-qdvy6abdc5 7

Sharing

Copy URL

Twitter E-mail

General

Target

29e841b19b52bd24701d86e7d5bbdc74391a0d00ed645b0fefec9c78d56c2b72.bin
Size

4.2MB
MD5

b977d6d227d7ffd28168fb328764d163
SHA1

51cf8ecff9ed421c2f340e4dca93722f0f274912
SHA256

29e841b19b52bd24701d86e7d5bbdc74391a0d00ed645b0fefec9c78d56c2b72
SHA512

0b711955e3265a82fde671273421fa1b495e31f84e1609cf4254762e1b1b848ae8ad3d85a08a79a61c0bff43851440f6ff3f8993cee05dbd85a99be3e7cc106c
SSDEEP

49152:FzrP0og+7HgS3qkxIgyRiYYCuxG3qiz3/TmQF+4KoL+v3iGcdpLrNbTn:JzYkeRIondrNP

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_lucastealer
Lucastealer family
lucastealer

resource	yara_rule
sample	family_lucastealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
29e841b19b52bd24701d86e7d5bbdc74391a0d00ed645b0fefec9c78d56c2b72.bin

Files

29e841b19b52bd24701d86e7d5bbdc74391a0d00ed645b0fefec9c78d56c2b72.bin
.exe windows x64

ffcfdb7f185750b37555c68f734d9882

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
DecryptMessage
AcceptSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
EncryptMessage

kernel32

SwitchToThread
SleepConditionVariableSRW
PostQueuedCompletionStatus
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
GetModuleHandleA
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
SetLastError
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
FindNextFileW
CreateDirectoryW
CreateThread
GetCurrentThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
FindClose
FindFirstFileW
CopyFileExW
WaitForSingleObject
SetHandleInformation
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
OpenProcess
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
HeapReAlloc
VirtualQueryEx
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
SetFilePointerEx
GetLogicalDrives
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandleEx
GetTickCount64
GetUserPreferredUILanguages
ReleaseSRWLockExclusive
GetLastError
AcquireSRWLockExclusive
WakeAllConditionVariable
CloseHandle
GetModuleHandleW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
LocalFree

advapi32

OpenProcessToken
LookupAccountSidW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
GetTokenInformation

ws2_32

connect
getsockname
send
closesocket
WSAGetLastError
recvfrom
WSAGetOverlappedResult
setsockopt
WSASend
WSAIoctl
bind
WSASocketW
getaddrinfo
ioctlsocket
getsockopt
shutdown
getpeername
recv
WSACloseEvent
WSACreateEvent
WSACleanup
WSARecv
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSAStartup
freeaddrinfo

crypt32

CertGetCertificateChain
CertGetNameStringA
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CertEnumCertificatesInStore
CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CryptUnprotectData
CryptDecodeObjectEx
CertOpenStore

oleaut32

SysAllocStringLen
VariantClear
SysAllocString
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SysFreeString
SafeArrayGetUBound

pdh

PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA
PdhCloseQuery
PdhAddEnglishCounterW

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

user32

EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoW

gdi32

DeleteObject
SelectObject
SetStretchBltMode
DeleteDC
StretchBlt
GetDIBits
GetObjectW
CreateDCW
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap

ole32

CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoTaskMemFree
CoUninitialize

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ntdll

RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
EnumProcessModulesEx
GetPerformanceInfo

vcruntime140

memcpy
memset
memcmp
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
memmove
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strncpy
strcpy
strncmp
strpbrk
strcmp
wcslen
strlen
strcspn
strspn
tolower
_strdup
isupper

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
realloc
_msize
calloc
malloc

api-ms-win-crt-runtime-l1-1-0

_cexit
__p___argv
__p___argc
__sys_errlist
_c_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
__sys_nerr
_set_app_type
_seh_filter_exe
_endthreadex
_initialize_onexit_table
_register_onexit_function
_errno
_wassert
abort
_crt_atexit
terminate
_beginthreadex
_exit

api-ms-win-crt-convert-l1-1-0

strtoul
wcstombs
strtoll
atoi
strtol

api-ms-win-crt-stdio-l1-1-0

fflush
fopen
_open
_lseeki64
_set_fmode
__p__commode
_read
__acrt_iob_func
fread
fseek
fputc
fwrite
fclose
fputs
__stdio_common_vsscanf
_write
_close
fgets
feof
__stdio_common_vsprintf
ftell

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64
_localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_stat64
_unlink

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

ffcfdb7f185750b37555c68f734d9882

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

ole32

bcrypt

shell32

ntdll

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 90KB - Virtual size: 90KB

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 90KB - Virtual size: 90KB

.reloc
Size: 28KB - Virtual size: 28KB