lucastealer | Akrien premium 4[.]0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Akrien premium 4.0.exe
Size

4.3MB
MD5

58d82461f610bf5234c28a1a67cbd123
SHA1

6aac74dd950ee1a9b14adaabb1fea942fc921ac9
SHA256

63b24a2fbe28c375ca03f45592b7dcbfdfed9262f1ad51efb6bd544429a885d0
SHA512

52d9f2daa360f7e84bc764092076d50216687f6c4c22afd3e3017188f1cb3ab2eafce76b968cd1f6feb412639277cf3439fe613647cdffa216dfa30bf0580ef2
SSDEEP

49152:g/5tJDBRnrQkbB1CjaorTkjf5O5rihkRbxdkkYgpX6tkWuiZMh5WEWkwwTMj:ab6SROk7AOkwZ

Score

10^/10

lucastealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6087457936:AAHy4hAAAw4TgaA5qmU8dL7mR7D5TTkyy_o

Signatures

Lucastealer family
lucastealer
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Akrien premium 4.0.exe

resource
Akrien premium 4.0.exe

Files

Akrien premium 4.0.exe
.exe windows:6 windows x64 arch:x64

Password: 16062010

ca905029c7a7278305d48dd5ba804ce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
ApplyControlToken
InitializeSecurityContextW
DecryptMessage
AcceptSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
EncryptMessage

kernel32

SleepConditionVariableSRW
PostQueuedCompletionStatus
CancelIoEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
WakeConditionVariable
GetSystemInfo
GetFileInformationByHandle
GetModuleHandleA
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
SetFilePointerEx
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileInformationByHandle
DuplicateHandle
CopyFileExW
SetHandleInformation
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
OpenProcess
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetModuleHandleW
VirtualQueryEx
GlobalMemoryStatusEx
GetQueuedCompletionStatusEx
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
Sleep
GetSystemDirectoryA
MultiByteToWideChar
GetEnvironmentVariableA
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
MoveFileExA
CreateFileA
GetFileSizeEx
ReadFile
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
CreateDirectoryW
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
DeleteFileW
GetFileInformationByHandleEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
GetLogicalDrives
GetTickCount64
GetUserPreferredUILanguages
ReleaseSRWLockExclusive
GetLastError
AcquireSRWLockExclusive
WakeAllConditionVariable
CloseHandle
SwitchToThread
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
LocalFree

advapi32

OpenProcessToken
LookupAccountSidW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
GetTokenInformation

ws2_32

connect
getsockname
send
closesocket
WSAGetLastError
recvfrom
WSAGetOverlappedResult
setsockopt
WSASend
WSAIoctl
WSASocketW
bind
getaddrinfo
ioctlsocket
getsockopt
shutdown
getpeername
recv
WSACloseEvent
WSACreateEvent
WSACleanup
WSARecv
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
htons
socket
ntohs
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSAStartup
freeaddrinfo

crypt32

CertGetCertificateChain
CertGetNameStringA
CertFindCertificateInStore
CryptStringToBinaryA
PFXImportCertStore
CertEnumCertificatesInStore
CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertOpenStore
CryptDecodeObjectEx
CryptUnprotectData

oleaut32

VariantClear
SysAllocString
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SafeArrayAccessData
SysAllocStringLen

pdh

PdhOpenQueryA
PdhCloseQuery
PdhAddEnglishCounterW
PdhCollectQueryData
PdhRemoveCounter
PdhGetFormattedCounterValue

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

user32

GetMonitorInfoW
EnumDisplayMonitors
EnumDisplaySettingsExW

gdi32

CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
GetDeviceCaps
CreateCompatibleDC
DeleteObject
CreateDCW
DeleteDC

ole32

CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

bcrypt

BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider

shell32

CommandLineToArgvW
SHGetKnownFolderPath

ntdll

RtlGetVersion
NtQuerySystemInformation
NtQueryInformationProcess

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
EnumProcessModulesEx
GetPerformanceInfo

vcruntime140

memcpy
memset
memmove
strchr
strrchr
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
memcmp

api-ms-win-crt-string-l1-1-0

_strdup
strcpy
tolower
strspn
strcmp
strcspn
isupper
strncmp
strpbrk
strncpy
strlen
wcslen

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
_crt_atexit
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_set_app_type
_seh_filter_exe
_endthreadex
exit
_initialize_onexit_table
terminate
__p___argc
__sys_nerr
_wassert
abort
__sys_errlist
_errno
_cexit
_beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
strtol
atoi
strtoul

api-ms-win-crt-stdio-l1-1-0

_open
fgets
fopen
fputs
feof
__acrt_iob_func
fread
fseek
fflush
_close
_set_fmode
__p__commode
_write
fwrite
fclose
ftell
__stdio_common_vsscanf
_read
fputc
__stdio_common_vsprintf
_lseeki64

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
realloc
_set_new_mode
_msize

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
strftime
_gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access
_stat64
_fstat64
_unlink

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: 16062010

ca905029c7a7278305d48dd5ba804ce5

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

oleaut32

pdh

iphlpapi

netapi32

user32

gdi32

ole32

bcrypt

shell32

ntdll

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 90KB - Virtual size: 90KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 90KB - Virtual size: 90KB

.reloc
Size: 29KB - Virtual size: 29KB