dracula_stealer | d25ecbca379a5582a9331093d6f67f65480225f042d30c0a3033fcc4c91a15cf

General

Target
v4rfocd2lsioblmm.exe
Size 614KB
Sample260726-13sv7ssbnb
SHA256 d25ecbca379a5582a9331093d6f67f65480225f042d30c0a3033fcc4c91a15cf
MD5 2980ed84fe9933bba9c0ec5fefe4b205
SHA1 13d546d9229920f5bb8c3edffafa9571694436bc
SHA512 df85c8c756bc93e6fc1665ea1e32d70c7832ec574f25249375dd570be9fdfe381106cfeb7cce091946b5351cebe5c1a36bcf3c9e9c4d0b42081fd3d5dee3097c
SSDEEP 6144:+avj92NU7A29yzad13JB24HT6/PTxhk01n/vIBMcoL+ZABTb8K/qbRRbr6RO+Uv8:Xr92E7AaT2dPTLk0F9IKuRVHd1S
TLSH
T1C5D428183FA58A08E580193E424E5A34DB9ADDF225322303374AFF625D359DEDE2D3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  v4rfocd2lsioblmm.exe
- Size 614KB
- SHA256 d25ecbca379a5582a9331093d6f67f65480225f042d30c0a3033fcc4c91a15cf
- MD5 2980ed84fe9933bba9c0ec5fefe4b205
- SHA1 13d546d9229920f5bb8c3edffafa9571694436bc
- SHA512 df85c8c756bc93e6fc1665ea1e32d70c7832ec574f25249375dd570be9fdfe381106cfeb7cce091946b5351cebe5c1a36bcf3c9e9c4d0b42081fd3d5dee3097c
- SSDEEP 6144:+avj92NU7A29yzad13JB24HT6/PTxhk01n/vIBMcoL+ZABTb8K/qbRRbr6RO+Uv8:Xr92E7AaT2dPTLk0F9IKuRVHd1S
- TLSH
  T1C5D428183FA58A08E580193E424E5A34DB9ADDF225322303374AFF625D359DEDE2D3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation ransomware rat spyware stealer trojan
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Renames multiple (61) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- RustDesk remote access tool
  RustDesk is an open-source remote admin tool.
  backdoor rat
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1