Cyble – Luca Stealer Source Code Leaked On A Cybercrime Forum

Rust-based Malware Targeting Crypto Users

During a routine threat-hunting exercise, Cyble Research Labs discovered an unknown Rust-based stealer, which we have dubbed “Luca Stealer.” The source code of this stealer was leaked on a popular cybercrime forum for free on July 3, 2022. We have already witnessed over 25 samples based on this source code present in the wild. Rust is rapidly becoming one of malware developers’ most preferred programming languages because of its versatility and evasion capabilities.

The developer of the stealer appears to be new on the cybercrime forum and likely leaked the source code of the stealer to build a reputation for themselves. The developer has also provided the steps to modify the stealer and compile the source code for ease of use. The stealer has been updated thrice, and the malware developer is continuously adding multiple functionalities at the time of our analysis.

The stealer can target multiple Chromium-based browsers, chat applications, crypto wallets, and gaming applications and has the added functionality of stealing victims’ files. After making multiple updates to the source code of the stealer on the cybercrime forum, the developer recently released the source code on GitHub, which can lead to wider usage and adoption of the stealer. Figure 1 shows the post made by the developer on a cybercrime forum.

Initially, the stealer was designed to exfiltrate stolen data using a Telegram bot. However, due to the limitation of only being able to upload data in sizes up to 50 MB, compatibility with Discord webhooks was added to the stealer.

We witnessed that multiple Threat Actors (TAs) might have contributed to this stealer’s development, as shown below.

The figure below shows Luca Stealer’s Features.

The figure below shows a Log file shared by a TA on a cybercrime forum indicating that multiple TAs have already started using this stealer.

Source Code Analysis

Functionality

Using the environment variable %localappdata%, the stealer identifies the path of the LocalAppData folder. Before initiating stealing activities, it checks if the “logsxc” folder is present in the AppData directory to prevent multiple executions. If this folder is not present, the stealer creates one with hidden attributes for saving stolen data.

The Luca stealer uses my_internet_ip, a Rust crate, to identify the victim’s public IP address and the ipgeolocate library to identify the victim’s geolocation.

The stealer then uses the screenshots library to grab a screenshot of the victim’s system and saves that as a .png file for exfiltration. The figure below shows the screenshot library used by the malware.

For stealing the system details, the stealer uses the whoami library. The figure below shows the implementation of the whoami library in the stealer.

The table below shows a few function names available in the whoami library used by the stealer to fetch the victim systems’ details. The stealer fetches the below system information along with IP and geolocation and saves it to a file named “info.txt.”

The stealer then creates a file named “system_info.txt” for storing the victim’s data, such as:

• Network interface name and their data transmission rate.
• The number of CPUs and memory segregated into the following components:
  • total memory
  • used memory
  • total swap 
• List of running processes 

The Luca Stealer targets over 30 Chromium-based browsers. The figure below displays the list of browsers targeted by the stealer. It steals Login Credentials, Credit Cards, and Cookies from browsers and saves them to a text file for exfiltration. To decrypt browser data, the stealer leverages the Dpapi.CryptUnprotectData() function.

The stealer targets 10 cold crypto wallets, as shown in Figure 10. The TA has mentioned the hardcoded path of the wallets in the source code, from where the stealer is grabbing the wallets for exfiltration.

The stealer also targets browser extensions of password managers and crypto wallets for over 20 browsers. Every browser extension has a unique ID, which can be used to search for the required extensions in the browser’s folder in the “AppData” directory. The stealer grabs extensions mentioned in the figure below if they are present in the victim’s system.

Luca stealer also targets the Steam, Uplay, and Telegram applications. It initially checks if these applications are present on the victim’s system and then grabs data from the following folders:

• AppDataRoaming Ubisoft Game Launcher
• AppDataRoamingTelegram Desktoptdata
• Program Files (x86) team

The stealer also targets four messenger applications: Discord, ICQ, Element, and Skype.

To steal Discord tokens, the malware targets the following directories:

• DiscordLocal Storageleveldb
• Discord PTBLocal Storageleveldb
• Discord Canaryleveldb

It uses regex to find the Discord tokens in the log files and saves them to a file named “discord_tokens.txt.” The malware grabs the file present in “ElementLocal Storageleveldb” for stealing Element’s session and saves them under a folder named Element.

The stealer then grabs the ICQ–Chat files from “AppDataRoaming ICQ001 “and saves them under a folder named “ICQ.”

For stealing sessions from Skype, the malware grabs files from AppDataRoamingMicrosoftSkypeDesktopLocal Storage and saves them under a Skype folder.

The stealer creates a compressed file named “out.zip” in the AppDataLocalTemp directory. This compressed file is created out of the folder used to save the stolen data. Then, it exfiltrates this data using Discord Webhooks or a Telegram Bot as specified by the TA. The stealer also sends the summary of stolen data as a chat message, such as the Count of passwords, IP address, OS details, etc. The figure below shows the format of the chat message.

Conclusion

At the time of publishing this analysis, Luca stealer can only currently target Windows-based Operating Systems (OS). Though the stealer is coded in Rust, a cross-platform programming language, the TA has used environment variables restricted to Windows OS to identify the path to certain directories.

In the future, we might witness more capabilities added to this stealer; for example, the TA might also be working on adding a clipping functionality to the stealer. As the stealer is written in Rust and is released for free, we can expect it to be adopted by multiple Threat Actors across the world.

Our Recommendations

• Avoid downloading files from untrusted sources. 
• Clear browsing history and reset passwords at regular intervals.   
• Turn on the automatic software update feature on your computer, mobile, and other connected devices.  
• Use a reputed anti-virus and internet security software package on your connected devices, including PC, laptop, and mobile.  
• Refrain from opening untrusted links and email attachments without first verifying their authenticity.   
• Educate employees in terms of protecting themselves from threats like phishing’s/untrusted URLs.  
• Block URLs that could be used to spread the malware, e.g., Torrent/Warez.  
• Monitor the beacon on the network level to block data exfiltration by malware or TAs.  
• Enable Data Loss Prevention (DLP) Solution on the employees’ systems.  

  MITRE ATT&CK® Techniques   

  Indicators of Compromise (IoCs):    

Related

Source: https://blog.cyble.com/2022/07/25/luca-stealer-source-code-leaked-on-a-cybercrime-forum/