dracula_stealer | f572a28b4708b35e22ec3b3b6f259248a65a326ef7bca05276dda5589f65ac94

General

Target
Nvidia Drivers.exe
Size 7.4MB
Sample260623-klrc2sbt8r
SHA256 f572a28b4708b35e22ec3b3b6f259248a65a326ef7bca05276dda5589f65ac94
MD5 6a0bdfd226bf23d2138ea9c9f8504633
SHA1 5f29c434dc29770b6497ed01eaa0b5746f158a88
SHA512 d7b83ad2a294ee5afcf09d634bf0cae32ac52a3a4dfb97a4455a79d44013a6c67c0be6d125059b30d9f032ef4192db4a1a547c105c149a058047ea35e1dff108
SSDEEP 196608:fdSy1ifssEERpsxMOVnzNZ8VNHv+hi396hg3AQo7M2H0fAl8D:lS2ifssE4psxdDOjWA3QgwQF2WAl8
TLSH
T1DA763359FFD4FC1AE2C6257E9E2159CEA617BA350E7C8B8C66F428A4FC44241CE4244F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Nvidia Drivers.exe
- Size 7.4MB
- SHA256 f572a28b4708b35e22ec3b3b6f259248a65a326ef7bca05276dda5589f65ac94
- MD5 6a0bdfd226bf23d2138ea9c9f8504633
- SHA1 5f29c434dc29770b6497ed01eaa0b5746f158a88
- SHA512 d7b83ad2a294ee5afcf09d634bf0cae32ac52a3a4dfb97a4455a79d44013a6c67c0be6d125059b30d9f032ef4192db4a1a547c105c149a058047ea35e1dff108
- SSDEEP 196608:fdSy1ifssEERpsxMOVnzNZ8VNHv+hi396hg3AQo7M2H0fAl8D:lS2ifssE4psxdDOjWA3QgwQF2WAl8
- TLSH
  T1DA763359FFD4FC1AE2C6257E9E2159CEA617BA350E7C8B8C66F428A4FC44241CE4244F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution persistence privilege_escalation collection dracula_stealer spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2