Rclone — Malware Profile

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.

MITRE ATT&CK techniques (6)

• T1030 Data Transfer Size Limits
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1083 File and Directory Discovery
• T1560.001 Archive via Utility
• T1567.002 Exfiltration to Cloud Storage

Read the full analysis on IntelFusions