dracula_stealer | 9f6a0cdc5d1e58c3ce7abd305b1ccff21ce0e7f831fa3d58abfc906957db3565

General

Target
snds.exe
Size 546KB
Sample260731-rzzpxavdmd
SHA256 9f6a0cdc5d1e58c3ce7abd305b1ccff21ce0e7f831fa3d58abfc906957db3565
MD5 324530b2fff26ed694ed97c5b69081b2
SHA1 1fe17849007be4cf2e573845e1d08a51e8371166
SHA512 2e6caecc395c9859cfa6451b0a7edf120e564b61c0d70569411f5591d36d2ca723e63092f6270c409d6fb3b67889d5b058ee66d312e3af27faef40e480b37947
SSDEEP 12288:g77CFk8ziJ1y94hZJatazJp/dznxH+y03S1:hqey1RZ0CD/Zcr3S
TLSH
T120C43B143FA98A18E581197E455E1A08D7AED1F226327307370AEF620C45DDEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  snds.exe
- Size 546KB
- SHA256 9f6a0cdc5d1e58c3ce7abd305b1ccff21ce0e7f831fa3d58abfc906957db3565
- MD5 324530b2fff26ed694ed97c5b69081b2
- SHA1 1fe17849007be4cf2e573845e1d08a51e8371166
- SHA512 2e6caecc395c9859cfa6451b0a7edf120e564b61c0d70569411f5591d36d2ca723e63092f6270c409d6fb3b67889d5b058ee66d312e3af27faef40e480b37947
- SSDEEP 12288:g77CFk8ziJ1y94hZJatazJp/dznxH+y03S1:hqey1RZ0CD/Zcr3S
- TLSH
  T120C43B143FA98A18E581197E455E1A08D7AED1F226327307370AEF620C45DDEDE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer adware defense_evasion evasion ransomware
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2