lucastealer | 52b49593cbcc54f429acc71458e2c0b1a1a120ba97566ca212a5890bb6f57f60

General

Target

Remcos-RAT-2022-main.zip
Size

6.2MB
Sample

240329-x49nkagf25
MD5

0f9f51e0ead01237835ff0b282f4a64d
SHA1

e8b17f04903a949e62829e170e304197f0a7aa4c
SHA256

52b49593cbcc54f429acc71458e2c0b1a1a120ba97566ca212a5890bb6f57f60
SHA512

432468d81970396d68f76b43118d8eafc89a7065eccb1f5353de214ec98987938e7cdf8d8a8940e2d19f68825a78f0f20af02d7da708dd4d7f2c6a6ed29a5ba8
SSDEEP

196608:k3uWGcLxB07EwdVWexixm0dSIl9LtEF1XrZPXIX8u6p:PRZdV2cmSacF1NPX0x+

Score

10^/10

Malware Config

Targets

- Target
  
  Remcos-RAT-2022-main.zip
- Size
  
  6.2MB
- MD5
  
  0f9f51e0ead01237835ff0b282f4a64d
- SHA1
  
  e8b17f04903a949e62829e170e304197f0a7aa4c
- SHA256
  
  52b49593cbcc54f429acc71458e2c0b1a1a120ba97566ca212a5890bb6f57f60
- SHA512
  
  432468d81970396d68f76b43118d8eafc89a7065eccb1f5353de214ec98987938e7cdf8d8a8940e2d19f68825a78f0f20af02d7da708dd4d7f2c6a6ed29a5ba8
- SSDEEP
  
  196608:k3uWGcLxB07EwdVWexixm0dSIl9LtEF1XrZPXIX8u6p:PRZdV2cmSacF1NPX0x+
Score

10^/10

lucastealer spyware stealer upx
- Luca Stealer
  Info stealer written in Rust first seen in July 2022.
  stealer lucastealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  
  Remcos-RAT-2022-main/Remcos Professional.exe
- Size
  
  6.5MB
- MD5
  
  1ecae7b88236fff686604c40f2ec8ef0
- SHA1
  
  5338d387c764b7da0a097e4dd38c17c603e62b08
- SHA256
  
  95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf
- SHA512
  
  6a396bf98181250a2a386c2ee4dbcd8a4be6e23de029d614296e6f33a66b6f6049b487ef07d70936812c31f6cce7bb1b709361b749e0b1ad3507382b26c00a5c
- SSDEEP
  
  196608:CyDxS34Qskc93Uuze5VbN0Wp4ctz7Z9aVi:txb1kcWuzku84cNd
Score

10^/10

lucastealer spyware stealer upx
- Luca Stealer
  Info stealer written in Rust first seen in July 2022.
  stealer lucastealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral2