Executive Summary
Foresiet Threat Intel Team has analyzed a new build of Lucid Stealer, a commercial Malware-as-a-Service (MaaS) promoted via Telegram and a dedicated web panel. This malware is uniquely packaged as a 100MB Node.js Single Executable Application (SEA), concealing an 8.5MB JavaScript loader and multiple native modules. While primarily an information stealer targeting 18 browsers and various crypto wallets, it also functions as a Remote Access Trojan (RAT) with capabilities for DDoS, keylogging, and Hidden VNC (HVNC) access.
Technically, the malware employs layered obfuscation including RC4 and XOR encryption to hide its core JavaScript payload. It establishes persistence through registry keys and uses helper binaries like a bundled SQLite CLI to exfiltrate browser data. The operator's recent transition from Node.js to Java indicates an evolving threat landscape aimed at increasing evasion. Given its ability to perform post-infection manual control and Discord client injection, organizations should treat any infection as a full identity compromise.