lucastealer | setup[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

setup.exe
Size

5.3MB
MD5

72dd972a45e45b42b396c8aa0fc488de
SHA1

ecdb3e4dd0cb73d7408fdeb8a78accccd63bba35
SHA256

c906ed7f2f9b440cf7b3770ccf03a22d5567b4f91de0df8571d0cd4d52d30494
SHA512

ccc7876ea7b3ec702e987b94a756c0d5abb43635ec08381a00ecbf62834e7e001861b247b47900c10415cf82fa88947246dd374f1ab61481c466e06ad8b77f38
SSDEEP

49152:pNbnFOfnNh+2RUTGVa+awj6yDbjiJ7mCJyg8t+OiOcLR7bP4JoCrZ+XMvzNsCGnl:fDPEB/zHRo78Ka3Qe7+7W

Score

10^/10

lucastealer

Malware Config

Extracted

Family

lucastealer

https://discord.com/api/webhooks/1022919568290754660/jH7KNOrnIEfYi_0xlS4_74KL_p0eGMAWlgT74ElYfG-7HvDrMWbyL9U2rTDXl_alMl3R

Signatures

Lucastealer family
lucastealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup.exe

Files

setup.exe
.exe windows:6 windows x64 arch:x64

f502eb66602232a688b48800c33c2f07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetSystemInfo
WakeConditionVariable
ReleaseSRWLockShared
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetHandleInformation
GetModuleHandleA
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
FormatMessageW
GetTempPathW
CreateFileW
DeviceIoControl
GetFullPathNameW
SetFilePointerEx
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
CreateThread
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
FindClose
FindFirstFileW
CopyFileExW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
ReadProcessMemory
VirtualQueryEx
OpenProcess
GetTickCount64
GetLogicalDrives
GlobalMemoryStatusEx
PostQueuedCompletionStatus
EnterCriticalSection
SleepConditionVariableSRW
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetSystemDirectoryA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
ReadFile
RtlVirtualUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
TerminateProcess
SwitchToThread
GetModuleHandleW
WakeAllConditionVariable
GlobalUnlock
GlobalLock
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
SetFileInformationByHandle
GlobalFree
GlobalAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TryAcquireSRWLockExclusive
MultiByteToWideChar
WideCharToMultiByte
GlobalSize
Sleep
GetFileInformationByHandleEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetComputerNameExW
GetUserPreferredUILanguages
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
LeaveCriticalSection

advapi32

RegOpenKeyExW
SystemFunction036
OpenProcessToken
GetTokenInformation
LookupAccountSidW
GetUserNameW
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW

ws2_32

freeaddrinfo
getaddrinfo
setsockopt
bind
WSASocketW
getsockopt
WSAIoctl
connect
ioctlsocket
send
recvfrom
WSAGetLastError
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
getpeername
WSAEnumNetworkEvents
WSAStartup
htons
ntohs
socket
WSASetLastError
__WSAFDIsSet
select
accept
htonl
listen
WSACreateEvent
WSACloseEvent
shutdown
WSASend
recv
getsockname
WSACleanup

crypt32

CertFreeCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateChain
CertDuplicateCertificateContext
CryptUnprotectData

ntdll

RtlNtStatusToDosError
NtQuerySystemInformation
NtCreateFile
NtCancelIoFileEx
NtQueryInformationProcess
NtDeviceIoControlFile
RtlGetVersion

oleaut32

VariantClear
SysFreeString
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocString

pdh

PdhRemoveCounter
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhCloseQuery

user32

EmptyClipboard
EnumDisplayMonitors
SetClipboardData
CloseClipboard
GetMonitorInfoW
OpenClipboard
EnumDisplaySettingsExW
GetClipboardData

gdi32

DeleteDC
GetDeviceCaps
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
CreateDCW
GetDIBits
GetObjectW

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2

netapi32

NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW
EnumProcessModulesEx

vcruntime140

memchr
strstr
strchr
memcmp
memmove
__CxxFrameHandler3
memset
memcpy
__current_exception
__current_exception_context
__C_specific_handler
strrchr

api-ms-win-crt-string-l1-1-0

strcmp
strncpy
strspn
strcspn
strpbrk
isupper
wcslen
strlen
strcpy
_strdup
tolower
strncmp

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
malloc
_msize
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_cexit
_c_exit
_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
_set_app_type
_seh_filter_exe
_endthreadex
exit
__sys_nerr
_crt_atexit
abort
__sys_errlist
_errno
_initialize_onexit_table
_wassert
terminate
_beginthreadex

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
wcstombs
strtoll
strtol

api-ms-win-crt-stdio-l1-1-0

ftell
_read
_open
_write
fopen
fflush
__stdio_common_vsprintf
fputc
feof
__p__commode
_set_fmode
_close
__stdio_common_vsscanf
_lseeki64
fputs
fclose
fseek
fwrite
__acrt_iob_func
fread
fgets

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64
_localtime64_s
strftime

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlink
_access
_stat64

api-ms-win-crt-math-l1-1-0

__setusermatherr
log
_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f502eb66602232a688b48800c33c2f07

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ws2_32

crypt32

ntdll

oleaut32

pdh

user32

gdi32

bcrypt

shell32

ole32

iphlpapi

netapi32

powrprof

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 26KB - Virtual size: 30KB

.pdata Size: 109KB - Virtual size: 109KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 26KB - Virtual size: 30KB

.pdata
Size: 109KB - Virtual size: 109KB

.reloc
Size: 41KB - Virtual size: 41KB