dracula_stealer | d8c122e151b45e149a813ce8b90856c4137e94b9e9f8f9a7e1676f032c7f9232

General

Target
p04vgf3bd4c19arp.exe
Size 541KB
Sample260729-sn2ksswglb
SHA256 d8c122e151b45e149a813ce8b90856c4137e94b9e9f8f9a7e1676f032c7f9232
MD5 37677a2e0710995a6fe2ac89a10abdb4
SHA1 5f6d4f8fac4871ddab167dc8660f6c6b0a9aad1c
SHA512 5b1d9e4d543ccc8528200e54ab6ea8f67d19f25af5fee99f648c2d954e1decb1e8fe44d8f9855bcd85dc54a28f90c2082fcfb7593fa741867278834e1fba0278
SSDEEP 6144:gIzBNRPLK3wXC4K4x3MvMDBBFLi7jb0r961Fpply/NsM7DMerxXGQXajTMSZdg1V:FNLNS4K4x3WmFi/KGMSZyLXMcL9
TLSH
T1D3C429183FA58908E590267E419E1609DBAED1F226327303370AFF625D459DEDE2C3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  p04vgf3bd4c19arp.exe
- Size 541KB
- SHA256 d8c122e151b45e149a813ce8b90856c4137e94b9e9f8f9a7e1676f032c7f9232
- MD5 37677a2e0710995a6fe2ac89a10abdb4
- SHA1 5f6d4f8fac4871ddab167dc8660f6c6b0a9aad1c
- SHA512 5b1d9e4d543ccc8528200e54ab6ea8f67d19f25af5fee99f648c2d954e1decb1e8fe44d8f9855bcd85dc54a28f90c2082fcfb7593fa741867278834e1fba0278
- SSDEEP 6144:gIzBNRPLK3wXC4K4x3MvMDBBFLi7jb0r961Fpply/NsM7DMerxXGQXajTMSZdg1V:FNLNS4K4x3WmFi/KGMSZyLXMcL9
- TLSH
  T1D3C429183FA58908E590267E419E1609DBAED1F226327303370AFF625D459DEDE2C3E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2