dracula_stealer | 46e0df8cae0d062d7947d2b63a19627d7ddef232fefdbb5cec0177261ca6700a

General

Target
DeltaX.exe
Size 542KB
Sample260528-ejy28agx2w
SHA256 46e0df8cae0d062d7947d2b63a19627d7ddef232fefdbb5cec0177261ca6700a
MD5 fc925367927b169ff255149e081f8da7
SHA1 7a9a2c79328903163badba415eff50ccf101e231
SHA512 ba99b8ed212a31b9066650843809beefeace4c4b6295c4555546e898e9055f5793535ed161548f219a5a9c11eadf2a6c00e065a00334a2f5c5c6b0f69a5aafe5
SSDEEP 6144:MBEEkTsE1938TnLGE5PBJ+ublbJwXt1RQal++EAJmD8AMRljLbbXb8NIWbwujx5s:6cl196nLGOb3+aYAMRBbLSIhwYYX8
TLSH
T152C44A147F998E08E481163E455E1609DBEED1F22572B303370AEF624D059DEDE2E3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  DeltaX.exe
- Size 542KB
- SHA256 46e0df8cae0d062d7947d2b63a19627d7ddef232fefdbb5cec0177261ca6700a
- MD5 fc925367927b169ff255149e081f8da7
- SHA1 7a9a2c79328903163badba415eff50ccf101e231
- SHA512 ba99b8ed212a31b9066650843809beefeace4c4b6295c4555546e898e9055f5793535ed161548f219a5a9c11eadf2a6c00e065a00334a2f5c5c6b0f69a5aafe5
- SSDEEP 6144:MBEEkTsE1938TnLGE5PBJ+ublbJwXt1RQal++EAJmD8AMRljLbbXb8NIWbwujx5s:6cl196nLGOb3+aYAMRBbLSIhwYYX8
- TLSH
  T152C44A147F998E08E481163E455E1609DBEED1F22572B303370AEF624D059DEDE2E3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1