dracula_stealer | 441013aaee6eb7864455f6ea15cd4e3c0b8e3bb3862941f50a41dbbe5b09a19e

General

Target
jdqvg5aps4kw5bjh.rar
Size 274KB
Sample260702-tqlsssew3k
SHA256 441013aaee6eb7864455f6ea15cd4e3c0b8e3bb3862941f50a41dbbe5b09a19e
MD5 cb04036e9e9420d4710ab951a72ee6ba
SHA1 7876297d04abb0f939d2fcacdec907ba20fe615a
SHA512 517f076363f9880f9a33e7c2d5f426ed394c2169c59b45127c3a7a95daa8b109409a6455db57728f344643a0ecd0500a2d02349c6bc51eca49e97635a1768160
SSDEEP 6144:iHLN/OlprE+rzZTxU2rEl3iZHaVLA9ceQQdLBgtc:yOlrzZT3G3iVmA9ceQQdLytc
TLSH
T1B154232783CDDA8290E534529572AAD354B433E866B88448DEF3E34E5193FF62D34DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jdqvg5aps4kw5bjh.rar
- Size 274KB
- SHA256 441013aaee6eb7864455f6ea15cd4e3c0b8e3bb3862941f50a41dbbe5b09a19e
- MD5 cb04036e9e9420d4710ab951a72ee6ba
- SHA1 7876297d04abb0f939d2fcacdec907ba20fe615a
- SHA512 517f076363f9880f9a33e7c2d5f426ed394c2169c59b45127c3a7a95daa8b109409a6455db57728f344643a0ecd0500a2d02349c6bc51eca49e97635a1768160
- SSDEEP 6144:iHLN/OlprE+rzZTxU2rEl3iZHaVLA9ceQQdLBgtc:yOlrzZT3G3iVmA9ceQQdLytc
- TLSH
  T1B154232783CDDA8290E534529572AAD354B433E866B88448DEF3E34E5193FF62D34DB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation ransomware spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1