dracula_stealer | 2819a5e68cc6679015eb5665fa26ecb413e972014c9b57affca717c9eb270eb6

Sharing

Copy URL Twitter E-mail

General

Target
LibSploit.rar
Size 4.3MB
Sample260718-dnswbshy7y
SHA256 2819a5e68cc6679015eb5665fa26ecb413e972014c9b57affca717c9eb270eb6
MD5 7930769f99c06c4a54fd59fcb58051ac
SHA1 29a0f3c5f382bb10b9d1eb94ccc14f811dfb2de5
SHA512 374d449a940afe1b8556b0b1a2f616d22010d5c6b2da8f6f9264032e38f56425c73b2727b5ef81c0f4c0a235580f63040472145f14728c9592cf61f07d339fec
SSDEEP 98304:qZN3N+4CkmyFYwLO/BFyHiuzXnr1AifWQWU1XqbkzxunY:qr3M4CkTYwLOEr1pWdU4Qz4Y
TLSH
T191263319194C61F86DD9A792313C608E31EE5E46D484808A3DAEDB9B3C7992C0FBF774
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  LiberiumUltimateExploitPro.exe
- Size 53KB
- SHA256 13523d7a58fa3fd2778085b6b774c277561cde36f9c995711d0cc0564d5b895e
- MD5 ad8cb52d371d3f7cecf6fbc347dc96cd
- SHA1 53df487d5ab7db80188d7deeeeb0bb15f5c01c60
- SHA512 c900deee4aba5a6c07dc1eae4740ee8287e1894b5ef838da81953e53bd54609ab917dc91c7d3a534203b23dbbcec61a470f14666997d660b6c46cf874a6e73e7
- SSDEEP 768:ocCMWP5hL2QdNqqJnng6zIbQ9DH2fX+H263GR1UpG2C5LjsM1H9DGfmi2TcRLv+m:oc5mnVDDa7UGRqG2C5LjswH9VK+yH7
- TLSH
  T10233294AA79B6618C9BE42B508FB83C512F1F7072733C74E2D8B21BE6E527D16350B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Panel/BouncyCastle.Crypto.dll
- Size 3.1MB
- SHA256 b474be40249aab5de303b3052c52a1349a06e27e8e54f956085465ce140d2bac
- MD5 3e02a7007f6abc85bb077a955b32b308
- SHA1 0567f20d06efab8f228d2a9f5ec706d9a38e5d24
- SHA512 cde8ed77552afac2489fc301454902b827dac98f0c2f82ad392a8559c454f868a7a65d0f5f8d80605e776bf28b8176cb5cf4e49457100a34867017ead41d555e
- SSDEEP 49152:a8X5gU7N2D0wtc8/ZiM3nxiwhra7HKaGzHIkMNKs6wc2iaoxcglc:a8X5gzDL/ZlXxiS/rxc4c
- TLSH
  T1F6E57C197BF81F23D16AD772D4F00042A3F2F82EB363DB5B2981A27A5C57B405D416AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Panel/Client.exe
- Size 43KB
- SHA256 793480a061cb2af067bf9697649b8e5d0c9d1d58def4e0979feb39490fb47826
- MD5 d605020e1805c860e6b3c059baec938d
- SHA1 17998293f75054f9e2e12a863290e4b4283c0b61
- SHA512 d51a6cdb6caf66e139f424b6d55f1a683b440eda8c77b5e9a67ccac537cb74b16f120599eaefedb4eba12b52440c458d98d45c4470f181803695fda50a259a15
- SSDEEP 768:D7xBmd93XBHhlMywCyloyvc2vN2bdaQ1Z8rnj0Obd66wSEfgy4R:D7xBmTXBHhlMywCyll02vN2bdJ1ijwO3
- TLSH
  T17613D5407BC88A35E7AE4BF8A672521C4272E3636913D70D1CDB05D92532BD5EA01EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

sheetrat trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
behavioral5 behavioral6
- Target
  Panel/dnlib.dll
- Size 1.1MB
- SHA256 f2c1f407811acfd1e926e61d6b71195b2f1c5aa54e59c2a43e6bb63c4e01a1d1
- MD5 fb5ecef1d457e3c5755f15988db493b2
- SHA1 eae333a1e2755155e7b7bc9e6e90706384dc5614
- SHA512 f50268facf89c751fc2f0ff766b4113672c6133d7e6dac670c69bd9df883323376b3962771b1ff041e4689b8eb16c5dd0b4c204026fc4d68f7e7908def3c4d0b
- SSDEEP 24576:kVXy+xgfrjQPiV2X03v7fww8CHvN3GygvHNfU:kVC+0r9t
- TLSH
  T161455A1237EC9B77C4AE477AE43116580BF0E80A676BDB4F6A58F36A6C437409D113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Plugins/Action.dll
- Size 27KB
- SHA256 e02c7d4772460b5ed8c9deb4d9c42f9307ab2e91dcad88d370c56852e2cb3cd9
- MD5 6bcf7dcdd6201723e287296fe6a137a8
- SHA1 90ae2ff990a5d7262303adddce63d966f37b2880
- SHA512 a87be64c53ad55b75dd7273207a1e8ed40c4d37b7936683409088d5d4b961eea9b016133cf79e19fa32e8de2d8819f83c1536bf4411b1580a3e4ac5762cfd185
- SSDEEP 768:GIIy4kFY/dEMKix0thSCBsFY/dEMKix0GbYB/8p3bk4TsHuHTfjOW:zIy4tBUtbpTuuHGW
- TLSH
  T1FBC2F804F7D82A34D2BF47758DB11A14EE7AA147EC72C90D398C40982B727998B61FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Plugins/AntiProcess.dll
- Size 10KB
- SHA256 aa5613397f63e46ba3c6d8f23f15cfc3968715c15eb3c8bb3f7e1e6ebfe05a95
- MD5 48442e4f33ba1c798b8cd9185ca1d9aa
- SHA1 7e525947abdd2a75c2f17bbb99c25f137efd4cae
- SHA512 08c6fedf9c38c73396e7354b6fe4d58657cac480679f310bed206d1c93cbf38e0f6a66dcfa0667c1ecf33c53129213968449e1e0a83cd76a4c14bb32546079c9
- SSDEEP 192:lfNRGGKzmllcJN/jB50Hk68bTygXnFCcPKjVISBaTt:lFbcJduk68bTDXFCcPKjVBBaTt
- TLSH
  T1CC22E900D3E98A20DABD433EA9B3930A4A34F1049D13DB5F29D847F27C517FA56D22A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Plugins/AutoRun.dll
- Size 331KB
- SHA256 07b7c2db79493a5ee49b608360ad480376efb5a2decc53e17938615d0e246143
- MD5 4571541b931bd8b3e7250de365c99b1b
- SHA1 b2896b06c324d6152d38f25b7f77e2795dac917d
- SHA512 1a3e85a04c255b87fa4e9ca99ac0b8e00d70ad78dbf19cce047038ed12874f5b15db559baa162b5b8e26d6fc1ffb062e12f289ccb27748f8d05c663696462e38
- SSDEEP 3072:Kyl8eHoRnxKZILoWl7rjvMy86pJERnjwTqerO9/3n7OSUrwi920aYW9Ba+bQaKxT:/l8vn1LoWNrjvM/Pmi37NULlaba+bQS
- TLSH
  T115743A1523FCC627F6FF27B8F4B250104BB8E40AE96ADB4E4D84A5D86863704A55237F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Plugins/BotKiller.dll
- Size 25KB
- SHA256 93b2051501eafa809166efd20947d3b25dfa09dd8d7e32baf41345cfdde421a0
- MD5 ec8363fdc41624cbb8125fff1ea17ee5
- SHA1 25edf29bfc2a06f8ee9e9968d9578b298334173f
- SHA512 d447a78c4dd5539413e4a116c14d96d48c023d9c03f76f972757dfb1ce936e8075a0de0c677d99a37f2f3976506cf74f548cb576c38fcdcde0bb2845b9bfa2b0
- SSDEEP 768:PxBV0x47ieFY/dEMKix0GAMgnNyw9WbJ4uDCw+VLjp:jV0x47imNubJ4uDK
- TLSH
  T142B2A511B3DD6230D7BF4F366832661086B5B4269C26CA8D39CC92C90B36764E631FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/BotSpeaker.dll
- Size 14KB
- SHA256 5dd8a71a59d707ce9c6391bad79a89fb25ae00c46f366aa4732aada6190b49ad
- MD5 e15b848a004a3e3f53519bd78faaaf13
- SHA1 4d7aec7bfdb0db34fc95430c68bfb7d7fa1a46e7
- SHA512 1ff0c1e30104cf0bc7d9a18ce3e246fddfb9d05cdf1ac5c01c77c28be4eb5d74319326a2e2683ae31f3a27cfc563a17a8f2d18a4cbd08de78cafe685d29a4578
- SSDEEP 384:bp8WObHDe/6BM7GilZpE19NCmBM0bi+D9l/yvFH6qjV8HIbRL:byBWpRmHbfn0ZjSHIR
- TLSH
  T10952D904A3E48B31E6F946BA58A397844730E7015C03CB0F3DDC95E5AC53BBE6B517AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Plugins/Camera.dll
- Size 94KB
- SHA256 e686aa88a2f25a1b966fbcec46be82bf0ed96c54715426ac090b1b71c8972ee6
- MD5 45c5a5745280597756692c69d0b46565
- SHA1 8219006f2631ebd020138b3272c6e4b3c31cfb55
- SHA512 7a97ed692ae722e5c9ce091e1ae200203dc6cccefe3670eacb11546b7ea1a03ba651cab84b214c7a22263db96b0f02c87a98026966792ee1a257682b065b2a21
- SSDEEP 1536:kzKZLDqMIbKrEraXK6upJ8i6f7g27iPU4+a0u6XMRf23FzWPOa98beQSkryrzYT:kzKZqMIbKrEraXK6upJ8i6ffPw2VKPOh
- TLSH
  T105935C1127A8C927D5BE07F8A0734B459B319206E113E7DF1EA454EC7C63B528E632EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Plugins/Chat.dll
- Size 43KB
- SHA256 4bab443475ee2926ef442a2283c55d81dac20d4c7dc4631f54bad03cd1a2f302
- MD5 7b5cf68bf0f453bd53d0ca28e5598923
- SHA1 b3e40dab5a8c8dd76cf07b6c46d9b17c3c346f8d
- SHA512 fa4eed927f6a54e390fe10e648bca6993e2b95eccd05fe317e2256f6e6e5c6478b5e97b5962766ecd61d5228410303a1b1a009ea832af526c619f0ed9ae4d064
- SSDEEP 768:E+vKUUMJeiAItCmtSpiXnNucgU+0IhTPbFbqacBabaGaZQSURjrJ:E+vKUUMJzP0anngU+0IVPbhqaBbadU5J
- TLSH
  T1A4133900B36CC92BE7DF0AFEA41056A413B1D3627883DBDA1DD468EC19D3BD556212EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Plugins/Clipboard.dll
- Size 13KB
- SHA256 94f58501a3d911b7da346861e3f3215ef42ea5af5ff9df6283a278f9322b4d62
- MD5 20cae6df4dcf8d4b8d881037609cd62a
- SHA1 a28ab97a517185ee9c0300d6e4c178c616ef09a8
- SHA512 dc4c6c6f7c779035dfdb48aafe1273f7c3f3cfffaddb622863e792ca9c572634ebce5d89402e0391a552a6a34667f7d2682952274ba0a3f0b6cfa38115ade291
- SSDEEP 384:UOEAk3GkJmpCZhlYmBWbRaDEO1Ft6qjVJt:UUk3GkJm03lYm8bWP1Pjbt
- TLSH
  T13252DA0497A58632CEFE13B7696397488370E2019D03CF0F2DD8A1D5AC47BAD7A257AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Plugins/Clipper.dll
- Size 15KB
- SHA256 a7ed33f5a2ca75094f83d98a2fb9193442cde93aeec09544eee2771ee5340b23
- MD5 e66aa80ce46ee990a4c4a9b097e5edb2
- SHA1 1d3b0f7438b41cbf234400eaa8ea091441808b29
- SHA512 7b17f7ae05d53002fd9af858227502ff0e8cffd16aa122fae59c359cbd10ae8862120364ced0cda7777d79e1882ec3731b357210a147510a88be6e95c8093387
- SSDEEP 384:QP+WeZMOo5uiSqmBrbFaDtfhCYFhaCjVJ8p:QJeeOo5xSqmBbyJhCY3j78p
- TLSH
  T13D620904A7D08632D7FF17B694B3A3484330E7019C43CF1F3DD8A5D56962BAEA7506AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Plugins/DDos.dll
- Size 106KB
- SHA256 22e6b4d12488c38461a4eaa8024c903394f6b2ba0fd079cbaf8e6e715117bfe5
- MD5 4e76455fe46ea39ef8af3b4c6b73b428
- SHA1 2c53a21da2baae658e2f2c963236a11a82a519c7
- SHA512 91cc4e2ba53f3f8c44c0f084bc8e091bd45b28e857057a344af20da800b35d005aabf93f182f4e4287c9d15387d0df19ac0650601929012d3000f191b344f57c
- SSDEEP 3072:06Yh3M2KXKZi6xb+7jd3OqlWj/RxfZwvyM:Nk3M5Cb
- TLSH
  T1F4B3941473F04328F2F7177DF8F95616AA76F642FD32CB9E2965021E0862B448942F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Plugins/Desktop.dll
- Size 696KB
- SHA256 d2c817db4843f8f230dfb9fa3b66ef4aebc75856f1cec3cfb3c3397b8b83092a
- MD5 5c76bcc70a1b202cfc53fdab3fba72b7
- SHA1 0a69734dab5cb32af267b90405c6a6884b69948f
- SHA512 a84aaeb21666dd58014d2a546df4b6ebcb27128e70ad23c7c33a8452628cc6fbc16624eaa888770843e4b9c2d22b9b6adf7e6fe1e860085ef7b79ea3737403cc
- SSDEEP 6144:DzkAANJKjDlNgDib1ahIZNs4z8pjac43jB0ZnmcTyO3EyTFhbZV6i+h6CUYxPkHu:Djz3lO41ZNs4z+jzSAmOy6Tn634gxZ
- TLSH
  T175E41852EF6C9F22EA0F3ABDB411791311B392411701A547A886E0F91FDD389CB1A7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Plugins/DeviceManager.dll
- Size 14KB
- SHA256 badae34033402c006e2d03e6c70be61acbdded08fcc8807d54a9f9b93e23498b
- MD5 c3cf46e883658b2b343479cd24d4895a
- SHA1 4f6b2d2ad0fdb3c47fa7aa72854f293313ccd704
- SHA512 5400862287da511a3c5d5ac0c41bd512c6f0723e6f10f24d58506401c8e454591098fa14a3ea1087014eccad9580a11012eef70fdc45b8a7a5a9124c4fcc2edf
- SSDEEP 384:8IOSKkIS/IGAIcmBj8b4+DEJ6Fi6qjVQWD:8Ik3NmZ8bFO6OjCWD
- TLSH
  T17D62B60467E59A31D6FD83B79CB397049231E6419C43CB0E2DDCD1F56C06BAD6B212EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Detects Sheetrat Payload

Family: Sheetrat, NonEuclid rat

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32