Inside Luca Stealer: A Technical Decomposition of the Rust-Based Malware
Beyond the Binary: How Luca Stealer Uses the Rust Runtime to Slip Past Detection A 4.6 MB Rust PE scored 100/100 with heavy anti-analysis and a Telegram exfiltration channel, behaviour that lines up with Luca Stealer, the leaked Rust infostealer.
- Malware
Bottom line. This sample is an information stealer, not ransomware and not a cryptominer despite the heuristic labels. It is a large, statically-linked Rust PE with aggressive VM, sandbox, debugger and timing evasion, and it exfiltrates over a Telegram bot, all consistent with Luca Stealer, whose Rust source code leaked publicly in 2022 and spawned dozens of variants. Just as important: of the 419 auto-extracted indicators, most are junk, certificate authorities (Entrust, GoDaddy), library boilerplate (openssl.org, example.com), a placeholder hash and malformed IPs baked into the Rust build. The real IOCs are a handful of file hashes plus the Telegram and IP-geolocation endpoints. Reset credentials and wallets on any hit; do not blanket-block the legitimate services.
Background
Luca Stealer is a Rust-based infostealer whose source code was leaked for free on a cybercrime forum on 3 July 2022, apparently so a newcomer could build reputation. Within weeks, 25-plus samples appeared in the wild. It targets Chromium browsers, chat apps, gaming clients and, notably, 17 password-manager browser add-ons and 10 cold crypto wallets, and it exfiltrates the loot over a Telegram bot (default, with a 50 MB cap) or a Discord webhook. It is a smash-and-grab credential and wallet stealer, not ransomware.
The analysed file is a ~4.6 MB Windows PE, entropy 6.73, that triage scored 100/100 MALICIOUS with 258 signature hits, most of them anti-analysis. It reaches out to a Telegram bot endpoint and to IP-geolocation services, and it fingerprints its environment aggressively. Those traits match the Luca lineage, though the engine returned no confident family match, unsurprising given the leaked code has forked into many near-identical variants.
Two corrections before the technical section. First, the automated pass tagged this ransomware, RAT and cryptominer at once; the behaviour, browser/wallet/password-manager theft plus Telegram exfil, is infostealer, and those extra labels are generic heuristics. Second, the 419 indicator count is badly inflated. Rust binaries statically link their dependencies, so the extractor scraped certificate-authority hostnames (Entrust.net, GoDaddy.com), OpenSSL and example boilerplate emails, a placeholder MD5 (all zeros/hex) and malformed IPs (for example 045.3.0.1) straight out of the embedded libraries. Publishing those as blockable IOCs would sinkhole legitimate infrastructure. We keep only what actually ties to the malware.
What we observed
What is real in this sample, and what is noise:
- Rust runtime as camouflage: the payload is a big, statically-linked Rust executable. That same static linking bloats the binary with third-party library strings, which is why the automated IOC pass surfaced certificate authorities and OpenSSL addresses, and it gives signature and ML engines unfamiliar compiler idioms to chew on (ML landed at 65 percent).
- Telegram exfiltration: the strongest real network indicator is an api.telegram.org bot endpoint, the classic Luca Stealer data-exfil channel. This is a legitimate service abused for C2, so monitor and alert on it rather than blanket-blocking Telegram.
- Victim geolocation: the sample calls IP-geolocation lookups (ip-api.com, ipwhois.app, myip.ch), a common stealer step to tag victims by country before or during exfiltration.
- Heavy anti-analysis: VM detection (including VM-detecting CPU instructions and WMI model/manufacturer checks), sandbox fingerprinting, debugger detection (IsDebuggerPresent, SEH tricks, OutputDebugString) and timing/sleep-based sandbox evasion, this is the detection-evasion story, and it is the bulk of the 258 signature hits.
- Stealer behaviour, not ransomware: system and file/directory discovery consistent with hunting browser data, wallets and password-manager vaults. No credible encryption or miner behaviour was evidenced; treat the ransomware/miner tags as false positives.
- IOC hygiene matters: 419 extracted indicators collapse to a handful once certificate authorities, static-library boilerplate, a placeholder hash and malformed IPs are removed. The real set is the file hashes plus the Telegram and geo endpoints.
Luca Stealer smash-and-grab flow
A stealer’s whole life is seconds long: run, check it is not being watched, grab credentials and wallets, ship them to Telegram. Detection has to catch the evasion and the exfil, because there is no long dwell time.
Attribution
Luca Stealer is commodity crimeware: its Rust source leaked publicly in 2022, so anyone can compile a variant, and there is no single operator to attribute. Confidence that this sample is a malicious Rust infostealer is high (100/100, 258 signatures, Telegram exfil, wallet/credential discovery). Confidence that it is specifically Luca is medium: the Telegram-bot exfil, Rust build and behaviour are consistent, but the engine found no exact family match and the leaked code has many look-alike forks. The ATT&CK entries below are drawn from evidenced behaviour on the sample.
Confidence: 78%.
419 extracted indicators, but most are certificate authorities and library boilerplate. The real signal is a handful of hashes and a Telegram bot.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Defense Evasion | Virtualization/Sandbox Evasion: System Checks | T1497.001 | VM-detecting CPU instructions, WMI model/manufacturer checks and VirtualBox artifact detection. |
| Defense Evasion | Virtualization/Sandbox Evasion: Time Based Evasion | T1497.003 | Extended sleep and system-uptime checks to evade sandbox time limits (high severity). |
| Defense Evasion | Debugger Evasion | T1622 | IsDebuggerPresent, SEH-chain manipulation and OutputDebugString anti-debug checks. |
| Defense Evasion | Obfuscated Files or Information | T1027 | High-confidence obfuscation finding; large statically-linked Rust binary, entropy 6.73. |
| Discovery | System Information Discovery | T1082 | High-confidence system information discovery on the sample. |
| Discovery | System Location Discovery | T1614 | Calls IP-geolocation services (ip-api.com, ipwhois.app, myip.ch) to tag the victim by country. |
| Credential Access | Credentials from Password Stores | T1555 | Luca-class behaviour: targets browser password stores and password-manager add-ons; file/directory discovery consistent with vault hunting. |
| Exfiltration | Exfiltration Over Web Service | T1567 | Exfiltrates over a Telegram bot API endpoint (Luca Stealer’s default channel). |
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
| 72687cd9277d3e851fda2cd2788fba6c8df65caff553599b3ed50e01be005067 | sha256 | Analysed Luca-class Rust stealer PE |
| 918075cfb0ee239a1e76f304e7c79f76 | md5 | Same sample (MD5) |
hxxps://api[.]telegram[.]org/bot | url | Exfil channel (legitimate service abused, monitor, do not blanket-block) |
hxxp://ip-api[.]com/json/ | url | Victim IP-geolocation lookup (legitimate service abused) |
Detection
Copy-ready hunting query:
# Luca-class Rust stealer hunt (behaviour + exfil, not the junk IOCs)
# 1) Unexpected process talking to the Telegram bot API (strong exfil signal)
index=proxy OR index=dns (url="*api.telegram.org/bot*" OR domain="api.telegram.org") NOT process_name IN ("Telegram.exe","chrome.exe","msedge.exe","firefox.exe")
# 2) IP-geolocation lookups from a non-browser process (victim tagging)
index=proxy (url="*ip-api.com/json*" OR url="*ipwhois.app/json*" OR url="*myip.ch*") NOT process_name IN ("chrome.exe","msedge.exe","firefox.exe")
# 3) Access to browser credential stores + password-manager / wallet paths
index=edr file_read (file_path="*\\User Data\\*\\Login Data" OR file_path="*\\Local Extension Settings\\*" OR file_path="*wallet*" OR file_path="*\\Local\\*\\Local State")
# 4) Anti-analysis behaviour cluster (VM/sandbox/debugger/timing)
index=edr (api_call IN ("IsDebuggerPresent","OutputDebugString") OR wmi_query="*Win32_ComputerSystem*Model*" OR behavior="long_sleep_before_activity")
# 5) Known hashes for THIS sample
index=edr (sha256="72687cd9277d3e851fda2cd2788fba6c8df65caff553599b3ed50e01be005067" OR md5="918075cfb0ee239a1e76f304e7c79f76")
#
# Do NOT block Entrust.net, GoDaddy.com, openssl.org, example.com or IPs like 045.3.0.1 --
# those were scraped from the statically-linked Rust libraries, not the C2.Recommendations
- Triage as a stealer, act fast: if this ran, assume browser passwords, session cookies, password-manager vaults and crypto wallets were taken. Reset those credentials, invalidate sessions and move wallet funds; a stealer’s damage is done in seconds.
- Watch the real exfil path: alert on non-browser processes reaching api.telegram.org/bot and on IP-geolocation lookups, and monitor (do not blanket-block) Telegram in enterprise egress.
- Clean up the IOCs before you deploy them: drop the certificate authorities (Entrust, GoDaddy), library boilerplate (openssl.org, example.com), the placeholder hash and malformed IPs, they are Rust static-linking artifacts, not infrastructure. Ship the file hashes and the abused endpoints only.
- Detect behaviour over signatures: this Rust binary fired 258 evasion signatures but scored 65 percent on ML and matched no family, so lean on the credential-store-access, geo-lookup and Telegram-exfil behaviours, which survive recompilation.
- Harden the targets: enforce hardware-backed MFA so stolen browser passwords are not enough, restrict script and untrusted-binary execution, and protect crypto-wallet and password-manager data with device encryption and vault timeouts.
