Extracted

• • Target

    CorelDRAW.Patch.2023.v24.exe

  • Size

    4.4MB

  • MD5

    bbb5d77f47e25b458cc257a7599cbde9

  • SHA1

    8086af2d89ab76180f1122f367eed7889357c6ec

  • SHA256

    bae657952c18da180d9c8191dcd6155c5302c88d9ec9b1c4b9598e3b8bd1c521

  • SHA512

    a4f67cad42216cd0fdc52e2147bf2e18e0f64010ffc174ff31cc736b0e44ac9219aecc00b33b036e2ea8e8a666230ea6c96704ee549253133dd73d81efbed0ba

  • SSDEEP

    98304:ltrbTA1zvAC4rXLW6jRhdGVQguhhW31Z7:3c1zO7L5LdGVzu+lV

  Score

  10^/10

  lucastealerevasionpersistencestealer

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

    stealerlucastealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1