Technical Analysis of Lucid Stealer : Execution, Capabilities, and C2 Infrastructure

Lucid Stealer is a Node.js SEA-based information-stealing malware that hides its payload with encryption, obfuscation, false certificate-like data, and UAC bypass behavior while collecting browser credentials, wallet data, Discord tokens, screenshots, and keystrokes. It uses PowerShell, a malicious Node.js native module, and WebSocket/HTTP POST communication to contact lucidstealer[.]one, with the analysis also noting shared infrastructure containing AsyncRAT and promotion through a Telegram channel. #LucidStealer #Nodejs #AsyncRAT #Telegram

Keypoints

Lucid Stealer is an information-stealing malware that targets browser data, cryptocurrency wallets, Discord artifacts, screenshots, and keystrokes.
The malware disguises itself as the Node.js JavaScript Runtime and uses the Node.js SEA framework to conceal its malicious payload.
It employs anti-analysis measures including encrypted payloads, obfuscated resources, false ASN.1/DER certificate-like structures, and hidden artifacts.
Execution involves PowerShell, Add-Type, csc.exe, and a malicious native module renamed to bridge_cfg.node to support data theft and other functions.
The sample attempts privilege escalation via UAC bypass behavior and hides its working directory using Hidden and System attributes.
It communicates with lucidstealer[.]one over WebSocket and HTTP POST endpoints to upload harvested data and send metadata, though the observed requests received HTTP 403 responses.
Directory listings on the C2 server showed AsyncRAT, suggesting shared infrastructure or multiple malware families used by the same operator.

MITRE Techniques

[T1204.002 ] User Execution: Malicious File – The malware is delivered as a disguised executable and relies on the victim running it (‘distributed under the guise of legitimate software’).
[T1059.001 ] Command and Scripting Interpreter: PowerShell – Used to hide the window, compile C# code, keylog, and decrypt DPAPI-protected data (‘executed a PowerShell command’, ‘Add-Type cmdlet’).
[T1027 ] Obfuscated Files or Information – Payloads are encrypted/obfuscated and reconstructed at runtime to hinder analysis (‘encrypted and obfuscated payload components’).
[T1036 ] Masquerading – The sample pretends to be the legitimate Node.js JavaScript Runtime (‘masquerading as the Node.js JavaScript Runtime’).
[T1564.001 ] Hide Artifacts: Hidden Files and Directories – The malware marks its working directory hidden/system to avoid visibility (‘attrib +h +s’).
[T1555.003 ] Credentials from Password Stores: Credentials from Web Browsers – Steals saved browser passwords, cookies, autofill, and other browser-stored data (‘collect browser credentials’).
[T1056.001 ] Input Capture: Keylogging – A PowerShell routine polls keyboard state to record keystrokes (‘continuously monitored keyboard input’).
[T1057 ] Process Discovery – Enumerates running processes to identify browsers and Discord (‘enumerates running processes’).
[T1005 ] Data from Local System – Collects local browser, wallet, Discord, and screenshot data prior to exfiltration (‘data collection phase’).
[T1113 ] Screen Capture – Captures a desktop screenshot using a native routine (‘captured a screenshot of the victim’s desktop’).
[T1548.002 ] Bypass User Account Control – Launches itself with -Verb RunAs to trigger a UAC prompt and gain elevation (‘Start-Process … -Verb RunAs’).
[T1041 ] Exfiltration Over C2 Channel – Attempts to send harvested ZIP data and metadata to the C2 using HTTP POST/WebSocket (‘upload the collected ZIP archive’).
[T1071.001 ] Application Layer Protocol: Web Protocols – Uses HTTP POST and WebSocket communications for C2 activity (‘WebSocket handshake’, ‘HTTP POST request’).
[T1657 ] Financial Theft – Targets cryptocurrency wallets and payment card information (‘cryptocurrency wallet information’, ‘payment card information’).

Indicators of Compromise

[SHA-256 ] Lucid Stealer executable and related artifacts – 054ed7761c96210e31e3cae2a476cad18ba645ebc70b6c2e3cffdfe18cf6011a, cdba69887866a484276b35a818f5604047fb7369eec687af803752a6dcd0e885, and 2 more hashes
[Domain ] C2 and upload infrastructure – lucidstealer[.]one
[IP address ] C2 resolution and OSINT-related infrastructure – 172[.]67[.]157[.]161, 104[.]21[.]8[.]179, and 2 more IPs
[Directory ] Persistent and temporary working directories – C:Users[user-name]AppDataLocalTempMicrosoft82c88d32, C:Users[user-name]AppDataLocalTempMicrosoft82c88d32data-
[File ] Dropped and logged artifacts – C:Users[user-name]AppDataLocalTempMicrosoft82c88d32deps.zip, C:Users[user-name]AppDataLocalTempLUCID_native_loader.log
[URL ] C2 endpoints used for upload, logging, and WebSocket communication – http[:]//lucidstealer[.]one/api/upload, http[:]//lucidstealer[.]one/api/internal/log, and http[:]//lucidstealer[.]one/ws
[File name ] Executables and native module names observed during analysis – node.exe, bridge_cfg.node, and Nioxbaba.exe

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print