dracula_stealer | 73e51a6cbee50a1f32a7d05b23a28e35163b936ae8a15b6e8e6080505ce2340a

General

Target
test.exe
Size 463KB
Sample260808-msc54sdq3x
SHA256 73e51a6cbee50a1f32a7d05b23a28e35163b936ae8a15b6e8e6080505ce2340a
MD5 ad39710555de9d9993a388b50fe96567
SHA1 02d47977e2c609f210e94cb0c0bf671e2dfbebac
SHA512 1a77ac08c24a5a9fd6f30a0a8df02ac862f452407099f953c0d44d4091ebad4fb56222a2295210edd3080ce75e44ff2aa09797c78845271a888f6b75fe6f591b
SSDEEP 6144:uzgR4fK1QelPp148pe/bphb4RacFYoDUy2DLhs7abchDtKTPZt3Gglw:kHfKOeRw8pObQzDUthw+z3n
TLSH
T13CA42B283F998E04E940257E455E2A08DBEED2F1153273033706EFA15E459DEDE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  test.exe
- Size 463KB
- SHA256 73e51a6cbee50a1f32a7d05b23a28e35163b936ae8a15b6e8e6080505ce2340a
- MD5 ad39710555de9d9993a388b50fe96567
- SHA1 02d47977e2c609f210e94cb0c0bf671e2dfbebac
- SHA512 1a77ac08c24a5a9fd6f30a0a8df02ac862f452407099f953c0d44d4091ebad4fb56222a2295210edd3080ce75e44ff2aa09797c78845271a888f6b75fe6f591b
- SSDEEP 6144:uzgR4fK1QelPp148pe/bphb4RacFYoDUy2DLhs7abchDtKTPZt3Gglw:kHfKOeRw8pObQzDUthw+z3n
- TLSH
  T13CA42B283F998E04E940257E455E2A08DBEED2F1153273033706EFA15E459DEDE2D3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1