Overview

overview

10

Static

static

3

rust-stealer-xss.exe

windows7-x64

10

rust-stealer-xss.exe

windows10-2004-x64

10

Resubmissions

18-10-2023 09:56

231018-lykxgaed98 10

18-10-2023 09:43

231018-lqbntsed66 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rust-stealer-xss.bin

  • Size

    4.5MB

  • Sample

    231018-lqbntsed66

  • MD5

    3ddf7d19049c63bdfd526de82ca592c1

  • SHA1

    852dddd3a28ee5c6949bba4c76a4bfe116c903ba

  • SHA256

    b1c36bffcefa1ade3384c246959d37b651dffbd10cb7172b7c93a9bfecd29f89

  • SHA512

    7be04fed529a3bcbd490cf10549e1439089ba38cd70f7def6b097656c3f3a9c5bf4809f8ddc4b58430ad72e55a9bd367dc4695affa0017c4e6f391ff3318fadb

  • SSDEEP

    98304:hQDi99hkY8zFbsEqy9wvDC1C/eFFYKkjsDTtqK3+5A:ODi99hgqLCSmkjWd0A

Score
10/10
lucastealerspywarestealer

Malware Config

Targets

    • Target

      rust-stealer-xss.bin

    • Size

      4.5MB

    • MD5

      3ddf7d19049c63bdfd526de82ca592c1

    • SHA1

      852dddd3a28ee5c6949bba4c76a4bfe116c903ba

    • SHA256

      b1c36bffcefa1ade3384c246959d37b651dffbd10cb7172b7c93a9bfecd29f89

    • SHA512

      7be04fed529a3bcbd490cf10549e1439089ba38cd70f7def6b097656c3f3a9c5bf4809f8ddc4b58430ad72e55a9bd367dc4695affa0017c4e6f391ff3318fadb

    • SSDEEP

      98304:hQDi99hkY8zFbsEqy9wvDC1C/eFFYKkjsDTtqK3+5A:ODi99hgqLCSmkjWd0A

    Score
    10/10
    lucastealerspywarestealer

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

      stealerlucastealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks