Extracted

• • Target

    8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2N

  • Size

    7.6MB

  • MD5

    4468b7d8b19786f8d0dec5066bfd1ea0

  • SHA1

    57a072f94c5cc277702c985cccf2e9deff355bb0

  • SHA256

    8ef1aee012f515e5434932fb73ae7d238c2c547d9306dd42cf4f3c4af87cead2

  • SHA512

    98900d5974b19e83455ea6c5abf1847aabd484b7a5ac0fb131c5cd369cf161fe1c053dcd00c7c26a851b3f0f1c88649a96fe9fbac531e3dbbf8967e0e3dc3bc3

  • SSDEEP

    196608:Tc1M+L5LdGVzu+l6qbGEanloOTe8dUFazO:Tw5LdGVzBEHPPe5FOO

  Score

  10^/10

  lucastealerdiscoverypersistencestealerevasion

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

    stealerlucastealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2