Date: 08/17/2026
Severity: High
Summary
Lucid Stealer is an information-stealing malware designed to harvest sensitive personal and financial data from compromised systems. It uses a legitimate Node.js-based execution framework to hide malicious components and evade traditional static analysis. The malware employs anti-analysis techniques, including misleading certificate-like structures and modified executable characteristics. Its encrypted and obfuscated payloads are reconstructed at runtime, making its internal functionality harder to detect and analyze. Lucid Stealer communicates with its C2 infrastructure through WebSockets and uses Axios to exfiltrate stolen data via HTTP POST requests. The associated C2 infrastructure supports multiple malware families, while a Telegram channel is used to support the malware.
Indicators of Compromise (IOC) List
Domains/URLs | http://lucidstealer.one/api/upload http://lucidstealer.one/ws http://lucidstealer.one/api/internal/log lucidstealer.one |
IP Address | 172.67.157.161 104.21.8.179 85.239.155.68 91.195.240.123 |
Hash | cdba69887866a484276b35a818f5604047fb7369eec687af803752a6dcd0e885
208a1acee4384809adc62dd358dfc5a547c55b3a0fdd8a5064cc779f929afece
06edb1c24b98cd2c92f0e652ed4e4700d6a76f2299debed06f54c3ffa18ee5d9
054ed7761c96210e31e3cae2a476cad18ba645ebc70b6c2e3cffdfe18cf6011a
|
Filenames | C:\Users\[%]\AppData\Local\ Temp\Microsoft\82c88d32 C:\Users\[%]\AppData\Local\Temp\Microsoft\82c88d32\deps.zip C:\Users\[%]\AppData\Local\Temp\LUCID_native_loader.log C:\Users\[%]\AppData\Local\Temp\ debug.log |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "lucidstealer.one" or url like "lucidstealer.one" or siteurl like "lucidstealer.one" or domainname like "http://lucidstealer.one/api/upload" or url like "http://lucidstealer.one/api/upload" or siteurl like "http://lucidstealer.one/api/upload" or domainname like "http://lucidstealer.one/api/internal/log" or url like "http://lucidstealer.one/api/internal/log" or siteurl like "http://lucidstealer.one/api/internal/log" or domainname like "http://lucidstealer.one/ws" or url like "http://lucidstealer.one/ws" or siteurl like "http://lucidstealer.one/ws" |
Detection Query 2 : | dstipaddress IN ("172.67.157.161","104.21.8.179","85.239.155.68","91.195.240.123") or srcipaddress IN ("172.67.157.161","104.21.8.179","85.239.155.68","91.195.240.123") |
Detection Query 3 : | sha256hash IN ("054ed7761c96210e31e3cae2a476cad18ba645ebc70b6c2e3cffdfe18cf6011a","208a1acee4384809adc62dd358dfc5a547c55b3a0fdd8a5064cc779f929afece","06edb1c24b98cd2c92f0e652ed4e4700d6a76f2299debed06f54c3ffa18ee5d9","cdba69887866a484276b35a818f5604047fb7369eec687af803752a6dcd0e885")
|
Detection Query 4 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "C:\Users\%\AppData\Local\Temp\Microsoft\82c88d32" or objectname like "C:\Users\%\AppData\Local\Temp\Microsoft\82c88d32" or objectname like C:\Users\%\AppData\Local\Temp\Microsoft\82c88d32\deps.zip" or objectname like "C:\Users\%\AppData\Local\Temp\LUCID_native_loader.log" or objectname like "C:\Users\%\AppData\Local\Temp\debug.log") |
Detection Query 5 : | technologygroup = "EDR" and (objectname like "C:\Users\%\AppData\Local\Temp\Microsoft\82c88d32" or objectname like "C:\Users\%\AppData\Local\Temp\Microsoft\82c88d32" or objectname like C:\Users\%\AppData\Local\Temp\Microsoft\82c88d32\deps.zip" or objectname like "C:\Users\%\AppData\Local\Temp\LUCID_native_loader.log" or objectname like "C:\Users\%\AppData\Local\Temp\debug.log") |
Reference:
https://www.cyfirma.com/research/technical-analysis-of-lucid-stealer-execution-capabilities-and-c2-infrastructure/