dracula_stealer | 9f2f54e3b031776ff62b533576c6e30276d66185bcfa49e0683d9b2435e430d4

General

Target
Radmin-VPN-Fix.exe
Size 518KB
Sample260807-sdnwysfp8s
SHA256 9f2f54e3b031776ff62b533576c6e30276d66185bcfa49e0683d9b2435e430d4
MD5 1b05b2f6926c705080c0180663429a19
SHA1 a5f3e3823ffe8014f560e3718dbee743aad2b216
SHA512 3cfa954e891dcab8acb758c99801e0cb0658b7143671088c60d2b18a9cbf8ab9d001dc0ea551c346ee9ae12604d1b131cb5df50799f5ad12c6444b64167f6cf5
SSDEEP 12288:bf1jsy4Avk2waJAPbVlDEtVl31xIMjsP5z52+9:6gvk2waEkl31GMjGy
TLSH
T186B43A143FA98E08E580153E469E1609DBAED6F125326343370AEF620D45DDEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Radmin-VPN-Fix.exe
- Size 518KB
- SHA256 9f2f54e3b031776ff62b533576c6e30276d66185bcfa49e0683d9b2435e430d4
- MD5 1b05b2f6926c705080c0180663429a19
- SHA1 a5f3e3823ffe8014f560e3718dbee743aad2b216
- SHA512 3cfa954e891dcab8acb758c99801e0cb0658b7143671088c60d2b18a9cbf8ab9d001dc0ea551c346ee9ae12604d1b131cb5df50799f5ad12c6444b64167f6cf5
- SSDEEP 12288:bf1jsy4Avk2waJAPbVlDEtVl31xIMjsP5z52+9:6gvk2waEkl31GMjGy
- TLSH
  T186B43A143FA98E08E580153E469E1609DBAED6F125326343370AEF620D45DDEDE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation ransomware spyware stealer adware
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2