Analysis
-
max time kernel
2s -
max time network
15s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
14/04/2025, 16:27
General
-
Target
rust-stealer-xss.exe
-
Size
5.4MB
-
MD5
93bc030335eafdd605be09d604e99d14
-
SHA1
2091d33f3d21681f292ba966fc2f052d8659769c
-
SHA256
431daed46a99f7f60d0c8d9c312ff5ba58f870951f574e09c77f904ce503aa77
-
SHA512
af6a8449623c216c52586e277a0f5fbb763967014691abed31ece343ab84de322e6c5f6fdc32f9d694b9885b8d0bee78525e51b62628f289282819dd824b111e
-
SSDEEP
49152:dVLnDkDGAAJW8z+AicuD1UN2et2LIwkXqt6sLj20Fd4Mxg5sAr38N3TNBbdA52aZ:TDwxsGmh06siqgCAQFclh+WCqj1pn++
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Lucastealer family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rust-stealer-xss.exe"C:\Users\Admin\AppData\Local\Temp\rust-stealer-xss.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD565113792e0e4fbbd5e128521eb36a608
SHA1a082448d00a8eb3c2c4d97c1336eed2f9c01600c
SHA256169e1489da72b49cc5d8c66badf085b6e61c438780d87f6218b417386b966bc1
SHA512302bfefaf549dd172d0e177de64d0659ac4933e4e6e164ac4c9a6a73a06c0970dc63d95ef4b9f5bf743a4bf5c4e5dfb8367ea6217f3bdebad0a77ea7d9726bad