lucastealer | hxxp://4[.]233[.]216[.]133

General

Target

http://4.233.216.133
Sample

230801-z3t8lacc8y

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://31.41.244.231/AVAVA/WAW/F0.oo

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://banqueislamik.ddrive.online:4448/x79t

Attributes

headers User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)

Targets

- Target
  
  http://4.233.216.133
Score

10^/10

lucastealer metasploit backdoor stealer trojan
- Luca Stealer
  Info stealer written in Rust first seen in July 2022.
  stealer lucastealer
- Luca Stealer payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Luca Stealer

Luca Stealer payload

MetaSploit

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Enumerates connected drives

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1