Extracted

• • Target

    Generic Patch-Smeagol-TheRadziu-x64.exe

  • Size

    4.5MB

  • MD5

    702f014a9a2fd33905fbcbcfd2ea7012

  • SHA1

    39f9c29d3991209b36c0c857975c7a2d85980d4a

  • SHA256

    6a292b1db13521d69a235cad26fc3a1b440d914f34903ae6ec2629df85022fa9

  • SHA512

    b24cc67150b90aad0f85473ff1df892ce55570518313ddee559d9470c42076314d150e22727052b951fdf780b7e8f35326835cb6013a9ddcef6a3f93210d53e3

  • SSDEEP

    98304:zgtrbTA1Y3C+Ni0iKD6vXLW6jRhdGVQguhhW31ZH:z2c1Yy8iDL5LdGVzu+lJ

  Score

  10^/10

  lucastealerevasionpersistencestealer

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

    stealerlucastealer

  • Luca Stealer payload

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1