Extracted

• • Target

    f543698185b9317144afc30bef3fe4c225f4c6e1c02e8394702a37423f666077_JC.exe

  • Size

    54.3MB

  • MD5

    ccf8ac85bd8c852fe818875ad7cdccd4

  • SHA1

    1938cfb720e3a0fe2af2aaf28755d9d2749f65af

  • SHA256

    f543698185b9317144afc30bef3fe4c225f4c6e1c02e8394702a37423f666077

  • SHA512

    ef9253507d90b1731f05811ba4ed263ecccbc1e8abdcaf1ee7b2f9a5ce5cf66dedb3c5ca99a47b9516aa8ae7bf7c07c0a7b98f7eec33e33bb7b1eda7abf7911f

  • SSDEEP

    1572864:YXog+tP2EY414hjFiHaAXH7JxA+GBO+shlvjgg9sf:8t+tP12E3Ud43h1cg9

  Score

  10^/10

  lucastealerxwormpersistenceratstealertrojan

  • Detect Xworm Payload

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

    stealerlucastealer

  • Luca Stealer payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2