dracula_stealer | 71998674ef0ee2b32be623f14a202acdb27a48750695bc9242a5c3d89ae8d8c9

General

Target
loxi.exe
Size 558KB
Sample260808-s8prqshn8z
SHA256 71998674ef0ee2b32be623f14a202acdb27a48750695bc9242a5c3d89ae8d8c9
MD5 b5c4be927eb9ef97096d2c9989ab0888
SHA1 98dc739f98d7cab95455e5522f139d840012ff91
SHA512 bae9dde31d7628f947942757526ac80ccfad1779e81f25b0d66abddbe0beff5ae0d9a8e09902cabbf0d58628eb43213f93c8891febdf11aad82ae4b352b25441
SSDEEP 12288:6WY9qwQKzxBTi3gz5xi6HFkhG9cxzODuongnlTrNF:M3zxRi2Q6lMGyYDuwgn
TLSH
T135C43B147F998A08D181297E454E1609DBEED1F226327303370AEF624D459DEEE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  loxi.exe
- Size 558KB
- SHA256 71998674ef0ee2b32be623f14a202acdb27a48750695bc9242a5c3d89ae8d8c9
- MD5 b5c4be927eb9ef97096d2c9989ab0888
- SHA1 98dc739f98d7cab95455e5522f139d840012ff91
- SHA512 bae9dde31d7628f947942757526ac80ccfad1779e81f25b0d66abddbe0beff5ae0d9a8e09902cabbf0d58628eb43213f93c8891febdf11aad82ae4b352b25441
- SSDEEP 12288:6WY9qwQKzxBTi3gz5xi6HFkhG9cxzODuongnlTrNF:M3zxRi2Q6lMGyYDuwgn
- TLSH
  T135C43B147F998A08D181297E454E1609DBEED1F226327303370AEF624D459DEEE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer defense_evasion evasion ransomware
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2