dracula_stealer | 119c25aba497d53a4c9ac60895f9bf638c78f644b510b4fe8924e2be2c036538

General

Target
Nursultan.exe
Size 634KB
Sample260730-dpmqps1zet
SHA256 119c25aba497d53a4c9ac60895f9bf638c78f644b510b4fe8924e2be2c036538
MD5 2a812ec547faa62154144732beb019e4
SHA1 e2ecf025333084409aabd6e997ccbc3f2aded0ca
SHA512 63cb4a1f9c8662557ffaa15b32573a5ae28ea99398cad5c2d642419cf897b0227f96980a8d254c0987badc14b8db0067481329e54399c7c535bd9936ddb258af
SSDEEP 12288:V/Fob/Hd7R7O72ssuK014GWjBlIyZ1EB+GtXRQSd:nqd9fuK014jB
TLSH
T1C3D4D3143BA5CAC8E45417FE414A1604DB9B99E125F2E303370AFB62DC458DEEE2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Nursultan.exe
- Size 634KB
- SHA256 119c25aba497d53a4c9ac60895f9bf638c78f644b510b4fe8924e2be2c036538
- MD5 2a812ec547faa62154144732beb019e4
- SHA1 e2ecf025333084409aabd6e997ccbc3f2aded0ca
- SHA512 63cb4a1f9c8662557ffaa15b32573a5ae28ea99398cad5c2d642419cf897b0227f96980a8d254c0987badc14b8db0067481329e54399c7c535bd9936ddb258af
- SSDEEP 12288:V/Fob/Hd7R7O72ssuK014GWjBlIyZ1EB+GtXRQSd:nqd9fuK014jB
- TLSH
  T1C3D4D3143BA5CAC8E45417FE414A1604DB9B99E125F2E303370AFB62DC458DEEE2D3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1