Overview

overview

10

Static

static

3

rust-stealer-xss.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rust-stealer-xss.exe

  • Size

    5.4MB

  • Sample

    250414-tx4bestvct

  • MD5

    93bc030335eafdd605be09d604e99d14

  • SHA1

    2091d33f3d21681f292ba966fc2f052d8659769c

  • SHA256

    431daed46a99f7f60d0c8d9c312ff5ba58f870951f574e09c77f904ce503aa77

  • SHA512

    af6a8449623c216c52586e277a0f5fbb763967014691abed31ece343ab84de322e6c5f6fdc32f9d694b9885b8d0bee78525e51b62628f289282819dd824b111e

  • SSDEEP

    49152:dVLnDkDGAAJW8z+AicuD1UN2et2LIwkXqt6sLj20Fd4Mxg5sAr38N3TNBbdA52aZ:TDwxsGmh06siqgCAQFclh+WCqj1pn++

Score
10/10
lucastealercredential_accessspywarestealer

Malware Config

Targets

    • Target

      rust-stealer-xss.exe

    • Size

      5.4MB

    • MD5

      93bc030335eafdd605be09d604e99d14

    • SHA1

      2091d33f3d21681f292ba966fc2f052d8659769c

    • SHA256

      431daed46a99f7f60d0c8d9c312ff5ba58f870951f574e09c77f904ce503aa77

    • SHA512

      af6a8449623c216c52586e277a0f5fbb763967014691abed31ece343ab84de322e6c5f6fdc32f9d694b9885b8d0bee78525e51b62628f289282819dd824b111e

    • SSDEEP

      49152:dVLnDkDGAAJW8z+AicuD1UN2et2LIwkXqt6sLj20Fd4Mxg5sAr38N3TNBbdA52aZ:TDwxsGmh06siqgCAQFclh+WCqj1pn++

    Score
    10/10
    lucastealercredential_accessspywarestealer

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

      stealerlucastealer

    • Lucastealer family

      lucastealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks