lucastealer | 70c874c7911d00fe6f5b50e95f45c81fa78494fc7115058daf5b8fc16b3144e6exe_JC[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

70c874c7911d00fe6f5b50e95f45c81fa78494fc7115058daf5b8fc16b3144e6exe_JC.exe
Size

9.8MB
MD5

f453215c2377d18d1211bcfd3f59cc6b
SHA1

d765fee81397ee7fcc1a21c4c5eedcc9ad47c978
SHA256

70c874c7911d00fe6f5b50e95f45c81fa78494fc7115058daf5b8fc16b3144e6
SHA512

36c9e41f2e74d002a6639c3d0b84fbeb440c6b45e2fdb97f8509a20ba7aa637f33cfd531048bb9e8b87c360bac4430ef5a535bb21821b37f3f083ae61d5f6fa7
SSDEEP

98304:woFPpBgmSeh9ag3buoRz2TcQ2Atse+a2krAwnvuitcNgSju2AuEkg+sdrkQ:wQP7tSKhQckUhuXYQ

Score

10^/10

lucastealer

Malware Config

Signatures

Luca Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_lucastealer
Lucastealer family
lucastealer

resource	yara_rule
sample	family_lucastealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
70c874c7911d00fe6f5b50e95f45c81fa78494fc7115058daf5b8fc16b3144e6exe_JC.exe

Files

70c874c7911d00fe6f5b50e95f45c81fa78494fc7115058daf5b8fc16b3144e6exe_JC.exe
.exe windows x64

9b7727ad52451b814a6345d82d97e6b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaFreeReturnBuffer
LsaEnumerateLogonSessions
AcquireCredentialsHandleA
DecryptMessage
QueryContextAttributesW
LsaGetLogonSessionData
AcceptSecurityContext
ApplyControlToken
EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextW
FreeContextBuffer

kernel32

CreateIoCompletionPort
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
WakeConditionVariable
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
GetCurrentDirectoryW
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
FormatMessageW
GetTempPathW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
SetHandleInformation
CreateThread
ExitProcess
QueryPerformanceFrequency
GetSystemTimeAsFileTime
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileInformationByHandle
CopyFileExW
GetTickCount64
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetProcessTimes
OpenProcess
ReadProcessMemory
VirtualQueryEx
GetSystemTimes
GetQueuedCompletionStatusEx
LocalFree
PostQueuedCompletionStatus
LoadLibraryExW
FreeLibrary
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetProcAddress
GetModuleHandleW
WakeAllConditionVariable
SleepConditionVariableSRW
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetComputerNameExW
GetUserPreferredUILanguages
GetSystemInfo
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
DuplicateHandle
GetCurrentProcess
QueryPerformanceCounter
FindClose
GetLastError
SetFilePointerEx
CloseHandle
SwitchToThread
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TryAcquireSRWLockExclusive
HeapReAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapFree
HeapAlloc
GetProcessHeap
IsDebuggerPresent
GetProcessIoCounters

advapi32

SystemFunction036
RegCloseKey
RegQueryValueExW
IsValidSid
GetLengthSid
CopySid
LookupAccountSidW
OpenProcessToken
GetTokenInformation
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyExW

ws2_32

select
getsockname
WSASend
WSARecv
recv
getpeername
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
WSACloseEvent
send
bind
WSAIoctl
ioctlsocket
WSASocketW
getsockopt
setsockopt
WSAGetLastError
shutdown
closesocket
connect
ntohs
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
listen
WSAWaitForMultipleEvents
accept
__WSAFDIsSet
socket
htons
WSASetLastError
recvfrom
htonl

crypt32

CertFreeCertificateChainEngine
CertGetNameStringA
CryptQueryObject
CertFindExtension
CryptDecodeObjectEx
PFXImportCertStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateStore
CertAddCertificateContextToStore
CertOpenStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CryptUnprotectData
CertCloseStore
CertCreateCertificateChainEngine
CertFreeCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

ntdll

RtlGetVersion
NtWriteFile
NtReadFile
NtQuerySystemInformation
NtCancelIoFileEx
NtCreateFile
RtlNtStatusToDosError
NtQueryInformationProcess
NtDeviceIoControlFile

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SysStringLen
SafeArrayGetLBound
SysAllocStringLen
SysFreeString
SafeArrayDestroy
GetErrorInfo
VariantClear
SysAllocString
SafeArrayGetUBound

ole32

CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize

pdh

PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhOpenQueryA

psapi

GetPerformanceInfo
GetModuleFileNameExW

shell32

SHGetKnownFolderPath
CommandLineToArgvW

bcrypt

BCryptGenRandom

iphlpapi

GetIfEntry2
GetAdaptersAddresses
GetIfTable2
FreeMibTable

netapi32

NetUserGetInfo
NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups

powrprof

CallNtPowerInformation

vcruntime140

memcmp
__CxxFrameHandler3
memset
memmove
strchr
strrchr
memchr
memcpy
strstr
__C_specific_handler
__current_exception
__current_exception_context

api-ms-win-crt-string-l1-1-0

_strdup
strpbrk
strncmp
strcmp
strcspn
strncpy
strspn
strlen
wcslen

api-ms-win-crt-math-l1-1-0

_fdopen
log
roundf
pow
__setusermatherr
round

api-ms-win-crt-heap-l1-1-0

_msize
free
calloc
_set_new_mode
realloc
malloc

api-ms-win-crt-runtime-l1-1-0

__p___argc
_exit
exit
__p___argv
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_set_app_type
_c_exit
_register_thread_local_exe_atexit_callback
_endthreadex
_errno
_seh_filter_exe
_wassert
abort
_beginthreadex
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
__sys_errlist
__sys_nerr
_initterm_e

api-ms-win-crt-convert-l1-1-0

strtoul
wcstombs
atoi
strtoll
strtol

api-ms-win-crt-stdio-l1-1-0

_open
fopen
fflush
fgets
_lseeki64
_set_fmode
__p__commode
__stdio_common_vsprintf
_read
_write
_fileno
__acrt_iob_func
fread
fseek
fwrite
fputc
__stdio_common_vsscanf
fclose
fputs
_close
feof
ftell

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_time64
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_unlink
_fstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b7727ad52451b814a6345d82d97e6b7

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

dxgi

d3d11

ntdll

oleaut32

ole32

pdh

psapi

shell32

bcrypt

iphlpapi

netapi32

powrprof

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7.5MB - Virtual size: 7.5MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 28KB - Virtual size: 31KB

.pdata Size: 146KB - Virtual size: 145KB

.reloc Size: 57KB - Virtual size: 56KB

.text
Size: 7.5MB - Virtual size: 7.5MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 28KB - Virtual size: 31KB

.pdata
Size: 146KB - Virtual size: 145KB

.reloc
Size: 57KB - Virtual size: 56KB