dracula_stealer | 5b81c42d91621082cf6f7ea55849fcc6052eca4f093a25c6bc0af2798d094f07

General

Target
kkdk.exe
Size 609KB
Sample260801-whk8easgkf
SHA256 5b81c42d91621082cf6f7ea55849fcc6052eca4f093a25c6bc0af2798d094f07
MD5 1e3ff054a6f482af6eb82cfa484f529f
SHA1 63885d2e314b64888ce6d436dad0123b2c1527b3
SHA512 1df9891fdbb87a5afe2679e5cf64d7464bb0a8b34ace4cf32981d1394804c0f80b0a7a557bdd81c7b45278078dfed4e9b82fad08f4607898ebe8ca9595469380
SSDEEP 12288:bwleqQC5P9K14KqdwdrlTxZ0u+yFC8dxzV3K:SQC5P9KpW8pTxZ0u/t
TLSH
T136D4C3143BA5CAC8E58057FE458A1604DB9B99E125F2E303370AFB61CD058DEDE2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  kkdk.exe
- Size 609KB
- SHA256 5b81c42d91621082cf6f7ea55849fcc6052eca4f093a25c6bc0af2798d094f07
- MD5 1e3ff054a6f482af6eb82cfa484f529f
- SHA1 63885d2e314b64888ce6d436dad0123b2c1527b3
- SHA512 1df9891fdbb87a5afe2679e5cf64d7464bb0a8b34ace4cf32981d1394804c0f80b0a7a557bdd81c7b45278078dfed4e9b82fad08f4607898ebe8ca9595469380
- SSDEEP 12288:bwleqQC5P9K14KqdwdrlTxZ0u+yFC8dxzV3K:SQC5P9KpW8pTxZ0u/t
- TLSH
  T136D4C3143BA5CAC8E58057FE458A1604DB9B99E125F2E303370AFB61CD058DEDE2D3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2