dracula_stealer | b319985762af88e0fb55ce4d7b992002be4cb79df0379a9e55dd8056ac710e09

General

Target
nexura.exe
Size 518KB
Sample260803-bbq5vsvhjc
SHA256 b319985762af88e0fb55ce4d7b992002be4cb79df0379a9e55dd8056ac710e09
MD5 aece87d3e06f802a4081b87628542ca4
SHA1 0f2a433f5fa924648b949478689ceb0db38d3e53
SHA512 24bfc2ad9c05c653620efdbdc59b1231234be749ee32e4937d4abf9837bc102c0617088ee6bc456e6fd2174ce46faddb4c6073aeb77d24d867a3825ab03930fe
SSDEEP 6144:FRNph0ZTqzueOqbgK3AvnWwoOhRc1egUERkOw+V3ltkOdKlH+g19OU3w+gojM+eN:L/h0NqlZgoAB3RMmgryjXpulr1dS
TLSH
T1FDB43A147FA98E08E490253E455E0A09DBEAD1F226327303370AEF615D459DEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  nexura.exe
- Size 518KB
- SHA256 b319985762af88e0fb55ce4d7b992002be4cb79df0379a9e55dd8056ac710e09
- MD5 aece87d3e06f802a4081b87628542ca4
- SHA1 0f2a433f5fa924648b949478689ceb0db38d3e53
- SHA512 24bfc2ad9c05c653620efdbdc59b1231234be749ee32e4937d4abf9837bc102c0617088ee6bc456e6fd2174ce46faddb4c6073aeb77d24d867a3825ab03930fe
- SSDEEP 6144:FRNph0ZTqzueOqbgK3AvnWwoOhRc1egUERkOw+V3ltkOdKlH+g19OU3w+gojM+eN:L/h0NqlZgoAB3RMmgryjXpulr1dS
- TLSH
  T1FDB43A147FA98E08E490253E455E0A09DBEAD1F226327303370AEF615D459DEDE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer aspackv2 banker defense_evasion ramnit trojan upx worm
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Family: Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Modifies WinLogon for persistence
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2