dracula_stealer | 497fb435ae1bf1f16d81ff79e4b8088cb1c254d648b13235c20a4e2d37165a96

General

Target
xui4.exe
Size 648KB
Sample260802-qfrdrazwcz
SHA256 497fb435ae1bf1f16d81ff79e4b8088cb1c254d648b13235c20a4e2d37165a96
MD5 bf99d4b03d852e46b2c8ab5a8c1ed432
SHA1 790d30d1e971c067e7319f4beff9e72a27b3901d
SHA512 03fc4d70cfe53d42b28036116a6919e89c6926336c4af117149e8bdfe467acc41c858c442d4b41e300f6505e21c63f0d5b773d971a2b80aea5e227d5bac908b4
SSDEEP 6144:YwFuh28zfPTSW75ncDvg/iuLGY5x//rN53qsL197vywbM8GD7SjiiDy5AXqfW3CT:tCzN75cDg95xXSZs7jcNwWk
TLSH
T1D4E4D4142BA9C9C8E49017FE455A1509CB9B99F212F2E303330AFB65CD459DEEE2C3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  xui4.exe
- Size 648KB
- SHA256 497fb435ae1bf1f16d81ff79e4b8088cb1c254d648b13235c20a4e2d37165a96
- MD5 bf99d4b03d852e46b2c8ab5a8c1ed432
- SHA1 790d30d1e971c067e7319f4beff9e72a27b3901d
- SHA512 03fc4d70cfe53d42b28036116a6919e89c6926336c4af117149e8bdfe467acc41c858c442d4b41e300f6505e21c63f0d5b773d971a2b80aea5e227d5bac908b4
- SSDEEP 6144:YwFuh28zfPTSW75ncDvg/iuLGY5x//rN53qsL197vywbM8GD7SjiiDy5AXqfW3CT:tCzN75cDg95xXSZs7jcNwWk
- TLSH
  T1D4E4D4142BA9C9C8E49017FE455A1509CB9B99F212F2E303330AFB65CD459DEEE2C3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2