dracula_stealer | c377d3185edddefb26b052e1d2d6a2df7bc17106afb387452b06f4b9a41de7f1

General

Target
jre-8u501-windows-x64.exe
Size 547KB
Sample260804-db288sbh56
SHA256 c377d3185edddefb26b052e1d2d6a2df7bc17106afb387452b06f4b9a41de7f1
MD5 561b4f89322864f223c779f083a3fb3d
SHA1 d3c1c64bad463ed176cf026fd5ae8acda8d1ade3
SHA512 af66958586768cd94781bc7a7175f69e15f9921419a99ae45ba034e964e688e8c15f8acdadb012c9a17064e88051e3ec38c338b67ab9214265b2118a0c4460ee
SSDEEP 6144:+nH7TAu3kNfkQixy2Zm2FR8fe83NZfhkfqgIS7ocisF2oO5Ic1fAZpKUmpL8bb7R:IIMQwZzF6e83m1oD1fK0pL8cPB372
TLSH
T17EC43B157FA98A08E480257E455E1619DBAED1F222327303770AEF620D45DDEEE2C3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jre-8u501-windows-x64.exe
- Size 547KB
- SHA256 c377d3185edddefb26b052e1d2d6a2df7bc17106afb387452b06f4b9a41de7f1
- MD5 561b4f89322864f223c779f083a3fb3d
- SHA1 d3c1c64bad463ed176cf026fd5ae8acda8d1ade3
- SHA512 af66958586768cd94781bc7a7175f69e15f9921419a99ae45ba034e964e688e8c15f8acdadb012c9a17064e88051e3ec38c338b67ab9214265b2118a0c4460ee
- SSDEEP 6144:+nH7TAu3kNfkQixy2Zm2FR8fe83NZfhkfqgIS7ocisF2oO5Ic1fAZpKUmpL8bb7R:IIMQwZzF6e83m1oD1fK0pL8cPB372
- TLSH
  T17EC43B157FA98A08E480257E455E1619DBAED1F222327303770AEF620D45DDEEE2C3DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2