How to remove Luca Stealer malware

Luca Stealer malware: a dangerous threat that can steal your valuable data

Luca Stealer is a menacing malware that has been recently discovered by security researchers at Cyble.^[1] According to the report, the virus stems from an already existing malware written in Rust, which operates as a data stealer. Since the source code of this malware was published on GitHub for everybody to see on July 3, 2022, it seems like other parties decided to make it their own and now are actively spreading Luca Stealer around.

The main purpose of the virus is to steal various data using exfoliation techniques. The main targets of malware are those who enjoy gaming and are into crypto, as it collects account details of various gaming platforms, crypto-wallets, chat applications, Chrome-related data, and similar. Even though its detection levels are currently relatively low,^[2] it is recommended to remove the Luca Stealer virus as soon as possible, as serious privacy issues could be experienced by those affected.

Luca Stealer analysis

Rust is a cross-platform programming language, which allows the info-stealer to expand its operations to a much larger scale potentially. However, since malware is relatively new, it is currently only operating on Windows operating systems, so users who run use this platform should be wary.

According to researchers at Cyble, the developer of the stealer malware is relatively new to the hacker forums, although they already provided instructions on how to modify it:^[1]

The developer of the stealer appears to be new on the cybercrime forum and likely leaked the source code of the stealer to build a reputation for themselves. The developer has also provided the steps to modify the stealer and compile the source code for ease of use. The stealer has been updated thrice, and the malware developer is continuously adding multiple functionalities at the time of our analysis.

While the malware strain is relatively new, its data-stealing capabilities are quite broad. First of all, it targets 30 Chromium-based browsers, including Chrome, Opera, MS Edge, Vivaldi, Dragon, Brave, and more. Most users rely on Chromium-based browsers nowadays, so choosing it was not accidental. Malware can pick up and deliver passwords, credit card details, and other crucial information harvested from browsers.

Luca Stealer also affects other applications installed on the system, such as communication apps (Skype, ICQ, Telegram, Element, Steam, Discord), gaming apps (Uplay), crypto add-ons installed on the browser (Coin98, Coinbase Wallet, BitApp Wallet, OneKey, Nabox Wallet, etc.), and even password managers (1Password, Norton Password Manager, Dashlane, KeePassXC, Bitwarden, etc.), which is relatively uncommon for this type of malware.

Besides sensitive details, the malware also collects a variety of technical details about the device used. For example, it uses “distro_os” function to get the name of the operating system distribution or version, while “devicename” is used to get the device name used to identify the device for Bluetooth pairing. In addition, it collects information about network transmission rates, total memory, a list of running processes, and more.

The data stealing process is done via Discord or Telegram bots^[3] – the former will be used if the collected data exceeds 50MB. It is worth noting that the large size of data may come from the fact that the malware makes screenshots and saves them as PNG files. All the collected files are packed into a ZIP archive, which is then named based on the contents inside, making it easier for the attackers to access the information they need.

How do trojans spread, and how to avoid them?

A trojan is an umbrella term for a type of malware that's defined by its distribution rather than functionality. In this case, we are, of course, talking about an info-stealer, although ransomware, for example, may also be identified as such. To make it clear, a trojan is defined by the fact that users believe they are installing something harmless, while in reality, they are letting malware infiltrate their device.

As such, there could be plenty of methods that can put users in such a situation, for example, malicious spam email might include a misleading message and an attachment, which would look like it was delivered from a reputable company or from a person a victim already knows. While the victim believes that the attachment is safe, opening it would immediately download and install a malicious payload on their machine.

Trojans can also be spread in the following ways:

• Repacked software
• Pirated programs and software cracks
• Fake updates
• Malicious ads, etc.

To avoid being a victim of a trojan attack such as Luca Stealer, you should always be vigilant and follow the best security practices. For example, you should never download pirated software or cracks, as the infection rate of various malware – not only Luca Stealer – is likely.

Employing effective ad-blockers might prevent the execution of malicious ads and fake updates, although it is not a secret that you should never download software from random websites which claim that something is missing or needs to be updated.

Luca Stealer malware removal

We strongly recommend performing automatic Luca Stealer removal, as complex malware samples are difficult to detect and remove manually, at least for regular computer users. Instead, go ahead and download SpyHunterCombo Cleaner or MalwarebytesMalwarebytes security software and initiate a full system scan (don't forget to update the definition database, as malware is relatively new). If you still want to attempt manual elimination, follow the steps at the bottom of this post.

Once the infection is terminated, you have to remember that your personal data may be compromised. First of all, we recommend you change passwords on all your accounts immediately – it should secure your accounts from further compromise. You should also monitor your online banking and expect to receive more malspam, as well as targeted phishing attacks.

Finally, we recommend you run a scan with FortectIntego – it can find damaged system files and repair them for you quickly, so you don't have to worry about crashes, errors, and other common issues caused by malware infections.