dracula_stealer | d35584b0827cc8ac1d932e9fa1f4e4717439816b76cc327dd2c9292ee17a7065

General

Target
6u55pe633nnizg4a.exe
Size 429KB
Sample260717-kklfeafy2k
SHA256 d35584b0827cc8ac1d932e9fa1f4e4717439816b76cc327dd2c9292ee17a7065
MD5 6d115e57540e577011e31f4d333d10f4
SHA1 3db2f6758560e47e2a0c94d231c961d9ed05aa0a
SHA512 b6d2da0a3901d37b7e40b7826a641a7d211d5ca66d7e0bd6a62b8051b67beb3193efe92fdd8632279f804001f633589fb521538c7e12d049b34b448009635dc9
SSDEEP 6144:DsiOjhXFnIMOLNhkcwKZ1EgK/mZhJ4FEnAvbnbkoxb9gYniSbyCX2BXhm:AJfMAiO2m
TLSH
T1E19460147BF58E08DC50267E455A0AC8CBA9ADE1112263037F06BF610D7D9DEDE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  6u55pe633nnizg4a.exe
- Size 429KB
- SHA256 d35584b0827cc8ac1d932e9fa1f4e4717439816b76cc327dd2c9292ee17a7065
- MD5 6d115e57540e577011e31f4d333d10f4
- SHA1 3db2f6758560e47e2a0c94d231c961d9ed05aa0a
- SHA512 b6d2da0a3901d37b7e40b7826a641a7d211d5ca66d7e0bd6a62b8051b67beb3193efe92fdd8632279f804001f633589fb521538c7e12d049b34b448009635dc9
- SSDEEP 6144:DsiOjhXFnIMOLNhkcwKZ1EgK/mZhJ4FEnAvbnbkoxb9gYniSbyCX2BXhm:AJfMAiO2m
- TLSH
  T1E19460147BF58E08DC50267E455A0AC8CBA9ADE1112263037F06BF610D7D9DEDE2D3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery evasion execution dracula_stealer persistence privilege_escalation ransomware spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1