dracula_stealer | 9b96d4bfc3060a157a929518d5dbdf5265916bd1c383039f0332621666ca02a6

General

Target
VelocityLite.exe
Size 506KB
Sample260730-gd9b4st1a1
SHA256 9b96d4bfc3060a157a929518d5dbdf5265916bd1c383039f0332621666ca02a6
MD5 d313a1bca247cd97e3bb8c2ddde8d966
SHA1 005152ca797e42d93bc47b0acde727698580485b
SHA512 2549ee6596f8f6318ba407318d199fe6d3ac06dcb35d61a7c466c0654c078b62df4c610cc49718b6a02f6097504cde86f2e2480023c85234f4238d43d80d9132
SSDEEP 12288:kEaMVUe7W28mcrB5IoEctOQo6ON8LihzyN06:FBS28mcrBpXGzyN
TLSH
T13DB418247F998A08E580157E455F1A08DBDED2F225326307370AEF660D059EEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  VelocityLite.exe
- Size 506KB
- SHA256 9b96d4bfc3060a157a929518d5dbdf5265916bd1c383039f0332621666ca02a6
- MD5 d313a1bca247cd97e3bb8c2ddde8d966
- SHA1 005152ca797e42d93bc47b0acde727698580485b
- SHA512 2549ee6596f8f6318ba407318d199fe6d3ac06dcb35d61a7c466c0654c078b62df4c610cc49718b6a02f6097504cde86f2e2480023c85234f4238d43d80d9132
- SSDEEP 12288:kEaMVUe7W28mcrB5IoEctOQo6ON8LihzyN06:FBS28mcrBpXGzyN
- TLSH
  T13DB418247F998A08E580157E455F1A08DBDED2F225326307370AEF660D059EEDE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2