Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
New Lucid Stealer Targets Browsers, Crypto Wallets, and Discord Tokens
Malware Families
Excerpt
A new build of Lucid Stealer, a Malware-as-a-Service (MaaS) promoted through underground Telegram channels. Instead of using a generic packed executable, attackers packaged this credential stealer and remote-access trojan (RAT) inside a legitimate Node.js Single Executable Application (SEA) wrapper. The malware targets numerous browsers, cryptocurrency wallets, and Discord tokens while providing operators with full post-infection control. Lucid Stealer Targets Wallets The…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | e8f08d9874cae78b971e3a421a7050f6 | Medium | Score 53/100 | First seen |
| Domain | lucidstealer.one | High | Score 58/100 | First seen |
| MD5 | 1f43517c8e5f6affcaca71fad3340d5f | Medium | Score 53/100 | First seen |
| MD5 | a380e66f381c9f88f4f221906f12b73e | Medium | Score 53/100 | First seen |
| MD5 | 101351cff5f971cd39bd6280be02a5e0 | Medium | Score 53/100 | First seen |
| IP | 45.138.16.107 | High | Score 72/100 | First seen |
IOC Relationship Graph
Building graph…