lucastealer | cryptowalletinstaller[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

cryptowalletinstaller.exe
Size

14.3MB
MD5

2753fea9125455e452e1951295158bc5
SHA1

4238700742f6540119fc40f8f001fa1b5da99425
SHA256

480cea45f9c10159ef76555a0b86c25b232952b5cbc6da2862ff4b8cbb2943c1
SHA512

fa829113e7b59223668ea78bcf7b40fd824e509055dfb5bb54b0a282de23888d55dc6da666f906640a2e9a2519f68490812fdccf1aecedbe2abbfcf1d2acb116
SSDEEP

98304:ox5Booyp/ylqh+esPbmbNv1m9VVEX6qwkPmCj:EDodtymbNdGELPFj

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_lucastealer
Lucastealer family
lucastealer
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

cryptowalletinstaller.exe

resource	yara_rule
sample	family_lucastealer

resource
cryptowalletinstaller.exe

Files

cryptowalletinstaller.exe
.exe windows x64

5cf6da513f1a848a4f2cc40a48575f2a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

setsockopt
getsockopt
WSAIoctl
__WSAFDIsSet
WSASend
send
WSARecv
WSACloseEvent
shutdown
getpeername
getsockname
select
bind
connect
listen
accept
ioctlsocket
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
WSAGetLastError
htons
ntohs
socket
WSASetLastError
WSAStartup
recv
WSACleanup
getaddrinfo
freeaddrinfo
htonl
WSAGetOverlappedResult
WSASocketW
closesocket

crypt32

CertDuplicateCertificateChain
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertDuplicateStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CryptUnprotectData

secur32

DeleteSecurityContext
ApplyControlToken
EncryptMessage
AcquireCredentialsHandleA
FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
FreeCredentialsHandle
LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer
QueryContextAttributesW
DecryptMessage

kernel32

TerminateProcess
CreateDirectoryW
SetFilePointerEx
WakeAllConditionVariable
WakeConditionVariable
CreateMutexA
FindNextFileW
GetFileInformationByHandleEx
FindFirstFileW
CopyFileExW
GetConsoleMode
ExitProcess
WriteConsoleW
CreateThread
TlsGetValue
TlsSetValue
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStdHandle
DuplicateHandle
SetFileInformationByHandle
GetEnvironmentVariableW
GetCurrentDirectoryW
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThread
GetCurrentProcess
SwitchToThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetUserPreferredUILanguages
GetComputerNameExW
GetLastError
ReleaseSRWLockExclusive
GetModuleHandleW
GetProcAddress
SetHandleInformation
GetCurrentProcessId
SetLastError
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
CloseHandle
WaitForSingleObjectEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
LoadLibraryExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
SystemTimeToFileTime
GetSystemTimeAsFileTime
AcquireSRWLockShared
LocalFree
SleepConditionVariableSRW
CancelIoEx
SetFileCompletionNotificationModes
WriteFile
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
FlushFileBuffers
GetTickCount64
GlobalMemoryStatusEx
OpenProcess
GetProcessHeap
HeapAlloc
HeapFree
GetProcessTimes
VirtualQueryEx
ReadProcessMemory
GetSystemTimes
GetProcessIoCounters
GetSystemInfo
GetDiskFreeSpaceExW
CreateFileW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
WaitForSingleObject
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
HeapReAlloc
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
ReleaseMutex
FindClose

advapi32

CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
SystemFunction036
CryptDestroyHash
GetUserNameW
LookupAccountSidW
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
OpenProcessToken

ntdll

NtQueryInformationProcess
NtQuerySystemInformation
RtlGetVersion

shell32

SHGetKnownFolderPath
CommandLineToArgvW

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetLocalGroups

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

oleaut32

SysFreeString
VariantClear
SysAllocString

pdh

PdhOpenQueryA
PdhGetFormattedCounterValue
PdhCloseQuery
PdhCollectQueryData
PdhRemoveCounter
PdhAddEnglishCounterW

powrprof

CallNtPowerInformation

gdi32

StretchBlt
DeleteDC
GetDeviceCaps
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC
SetStretchBltMode
SelectObject
DeleteObject
CreateDCW
GetObjectW

user32

EnumDisplayMonitors
GetMonitorInfoW
EnumDisplaySettingsExW

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW
EnumProcessModulesEx
GetPerformanceInfo

vcruntime140

__CxxFrameHandler3
memset
memmove
strchr
strrchr
memcmp
strstr
memchr
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
memcpy

api-ms-win-crt-math-l1-1-0

_dclass
log
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

fflush
_open
__acrt_iob_func
fread
fwrite
__p__commode
_read
_write
_close
fseek
fgets
_set_fmode
fputc
fopen
_lseeki64
ftell
__stdio_common_vsprintf
fclose
fputs
__stdio_common_vsscanf
feof

api-ms-win-crt-string-l1-1-0

strcspn
strncmp
strcpy
tolower
strcmp
_strdup
wcslen
strncpy
strpbrk
strlen
isupper
strspn

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free
realloc
calloc
_msize

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoul
atoi
strtoll
strtol

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_endthreadex
_initterm
_initterm_e
exit
_exit
__sys_nerr
__sys_errlist
_errno
__p___argc
_initialize_narrow_environment
terminate
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_initialize_onexit_table
_beginthreadex
_register_onexit_function
_configure_narrow_argv

api-ms-win-crt-time-l1-1-0

_localtime64_s
_gmtime64
_time64
strftime

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlink
_stat64
_access

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 679KB - Virtual size: 678KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5cf6da513f1a848a4f2cc40a48575f2a

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

secur32

kernel32

advapi32

ntdll

shell32

iphlpapi

netapi32

ole32

oleaut32

pdh

powrprof

gdi32

user32

bcrypt

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 11.1MB - Virtual size: 11.1MB

.rdata Size: 2.3MB - Virtual size: 2.3MB

.data Size: 124KB - Virtual size: 128KB

.pdata Size: 679KB - Virtual size: 678KB

.reloc Size: 50KB - Virtual size: 50KB

.text
Size: 11.1MB - Virtual size: 11.1MB

.rdata
Size: 2.3MB - Virtual size: 2.3MB

.data
Size: 124KB - Virtual size: 128KB

.pdata
Size: 679KB - Virtual size: 678KB

.reloc
Size: 50KB - Virtual size: 50KB