dracula_stealer | 31b2572fb91b2230a331177893f2d09e0da65a16bb732516ebe03e56bf186464

General

Target
yspvyow721pqrnc0.exe
Size 533KB
Sample260415-pt8draev2p
SHA256 31b2572fb91b2230a331177893f2d09e0da65a16bb732516ebe03e56bf186464
MD5 ba484247f3173b9cce4fc1f69340afa9
SHA1 95bb748d765b65578aab3bd3e78e44c451701746
SHA512 484b217c7d660b5d769f7dc3a7f51f6bd8d4027bfb6556fbbcc0c33fdbf637eb731d342bcb3ddfcfabad6bbd495dc75f6a082539f724e51677c95b0e622a95a4
SSDEEP 12288:lsDS6PsN+g0Z6JUfeJtreOzTurC6kSrPbQSxL:ecCMufe7HurC6kOzL
TLSH
T14EC4B0146B948A08E44C263E455A1704DB9A9DF12633E3C3370BBA634D35BDEDE2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  yspvyow721pqrnc0.exe
- Size 533KB
- SHA256 31b2572fb91b2230a331177893f2d09e0da65a16bb732516ebe03e56bf186464
- MD5 ba484247f3173b9cce4fc1f69340afa9
- SHA1 95bb748d765b65578aab3bd3e78e44c451701746
- SHA512 484b217c7d660b5d769f7dc3a7f51f6bd8d4027bfb6556fbbcc0c33fdbf637eb731d342bcb3ddfcfabad6bbd495dc75f6a082539f724e51677c95b0e622a95a4
- SSDEEP 12288:lsDS6PsN+g0Z6JUfeJtreOzTurC6kSrPbQSxL:ecCMufe7HurC6kOzL
- TLSH
  T14EC4B0146B948A08E44C263E455A1704DB9A9DF12633E3C3370BBA634D35BDEDE2D3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
behavioral1