dracula_stealer | b319985762af88e0fb55ce4d7b992002be4cb79df0379a9e55dd8056ac710e09

General

Target
nexura.exe
Size 518KB
Sample260803-dapazsxbpc
SHA256 b319985762af88e0fb55ce4d7b992002be4cb79df0379a9e55dd8056ac710e09
MD5 aece87d3e06f802a4081b87628542ca4
SHA1 0f2a433f5fa924648b949478689ceb0db38d3e53
SHA512 24bfc2ad9c05c653620efdbdc59b1231234be749ee32e4937d4abf9837bc102c0617088ee6bc456e6fd2174ce46faddb4c6073aeb77d24d867a3825ab03930fe
SSDEEP 6144:FRNph0ZTqzueOqbgK3AvnWwoOhRc1egUERkOw+V3ltkOdKlH+g19OU3w+gojM+eN:L/h0NqlZgoAB3RMmgryjXpulr1dS
TLSH
T1FDB43A147FA98E08E490253E455E0A09DBEAD1F226327303370AEF615D459DEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  nexura.exe
- Size 518KB
- SHA256 b319985762af88e0fb55ce4d7b992002be4cb79df0379a9e55dd8056ac710e09
- MD5 aece87d3e06f802a4081b87628542ca4
- SHA1 0f2a433f5fa924648b949478689ceb0db38d3e53
- SHA512 24bfc2ad9c05c653620efdbdc59b1231234be749ee32e4937d4abf9837bc102c0617088ee6bc456e6fd2174ce46faddb4c6073aeb77d24d867a3825ab03930fe
- SSDEEP 6144:FRNph0ZTqzueOqbgK3AvnWwoOhRc1egUERkOw+V3ltkOdKlH+g19OU3w+gojM+eN:L/h0NqlZgoAB3RMmgryjXpulr1dS
- TLSH
  T1FDB43A147FA98E08E490253E455E0A09DBEAD1F226327303370AEF615D459DEDE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution dracula_stealer persistence privilege_escalation ransomware spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (8188) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2