dracula_stealer | c180a932a47f82fe6672eea92584a1f399eabcd1d7c5ad19e70e2c7c7dee3a09

General

Target
phiqpgzcyt2am9va.exe
Size 518KB
Sample260803-klbmlasape
SHA256 c180a932a47f82fe6672eea92584a1f399eabcd1d7c5ad19e70e2c7c7dee3a09
MD5 3f26ed5d3a09444dae5a72617a3d6cce
SHA1 2b8289612f375e47c59a9f640e0e45c13b23e13b
SHA512 33e5008784e157df9d2b8abf3c88d0dafb5cac4b7794b418aac6a55d9c823fb620f0c251e5fad6b6a1d365c543b610c4469c7b04a1bf97f19893aff0f4e4c9cd
SSDEEP 6144:WgPlEJg86ERV6iDi99c1igwSvWFIwiyLzaWqveKHZV9M4MG6h+kaGUotowKNKcbk:H+vz6imPcBvW2LAYJDx0QU
TLSH
T16AB42A243FA98E08E590257E455E1609D7AAD1F225327303370AEF624D05DDEEE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  phiqpgzcyt2am9va.exe
- Size 518KB
- SHA256 c180a932a47f82fe6672eea92584a1f399eabcd1d7c5ad19e70e2c7c7dee3a09
- MD5 3f26ed5d3a09444dae5a72617a3d6cce
- SHA1 2b8289612f375e47c59a9f640e0e45c13b23e13b
- SHA512 33e5008784e157df9d2b8abf3c88d0dafb5cac4b7794b418aac6a55d9c823fb620f0c251e5fad6b6a1d365c543b610c4469c7b04a1bf97f19893aff0f4e4c9cd
- SSDEEP 6144:WgPlEJg86ERV6iDi99c1igwSvWFIwiyLzaWqveKHZV9M4MG6h+kaGUotowKNKcbk:H+vz6imPcBvW2LAYJDx0QU
- TLSH
  T16AB42A243FA98E08E590257E455E1609D7AAD1F225327303370AEF624D05DDEEE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation spyware stealer trojan
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2