Overview

overview

10

Static

static

5

NEAS.13d37...90.exe

windows7-x64

10

NEAS.13d37...90.exe

windows10-2004-x64

10

Resubmissions

22-10-2023 04:26

231022-e2zfpsfa72 10

21-10-2023 21:13

231021-z27gjacf54 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.13d37451cb332802b88bd5684f8a9f90.exe

  • Size

    4.6MB

  • Sample

    231021-z27gjacf54

  • MD5

    13d37451cb332802b88bd5684f8a9f90

  • SHA1

    19c367dca209aff91e39aaedaa021e0c957502d0

  • SHA256

    d881663244daab00c57fb1715aef3ce183da334236670ea520bbf0fd198a4b3d

  • SHA512

    e38eadd8628cc6d6d8e0ef8538635328ec8d62292b1672fbc8a18c974fc1393879102746006ef5a13f1e52bbe4bf692e3111f54110427e4805e7a231b94c741a

  • SSDEEP

    49152:CYhJZoQrbTFZY1ia/N8kHLlkMROX1lW68ZM5mmhD+SbilzCUWCLcMldpxruKihtB:zhtrbTA1OiWXLW6jRhdGVQguhhW31Z4

Score
10/10
lucastealerevasionpersistencestealer

Malware Config

Extracted

Family

lucastealer

C2

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Targets

    • Target

      NEAS.13d37451cb332802b88bd5684f8a9f90.exe

    • Size

      4.6MB

    • MD5

      13d37451cb332802b88bd5684f8a9f90

    • SHA1

      19c367dca209aff91e39aaedaa021e0c957502d0

    • SHA256

      d881663244daab00c57fb1715aef3ce183da334236670ea520bbf0fd198a4b3d

    • SHA512

      e38eadd8628cc6d6d8e0ef8538635328ec8d62292b1672fbc8a18c974fc1393879102746006ef5a13f1e52bbe4bf692e3111f54110427e4805e7a231b94c741a

    • SSDEEP

      49152:CYhJZoQrbTFZY1ia/N8kHLlkMROX1lW68ZM5mmhD+SbilzCUWCLcMldpxruKihtB:zhtrbTA1OiWXLW6jRhdGVQguhhW31Z4

    Score
    10/10
    lucastealerevasionpersistencestealer

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

      stealerlucastealer

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

4
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks