dracula_stealer | 22dae34c2c163a3a010dc06a6cad3cb451c527c0d18d6dfc3b960994cfef95b2

General

Target
start.exe
Size 515KB
Sample260809-jqhe9stcpc
SHA256 22dae34c2c163a3a010dc06a6cad3cb451c527c0d18d6dfc3b960994cfef95b2
MD5 58b2cf2cd7f12a2a3000dc6bf17c262f
SHA1 c5054507424749aeae227cb9ee6f20913223b1ad
SHA512 39a7c7154bb4255bf9cf2766a41eac952d5111c6c4703f0356b61fb5bb59f85ee5e10e977edbf8325152c5e439ca60aa59679a833f6e312d5a2e0da6407b3134
SSDEEP 6144:bDmLeZwi9a7vPv/rXXi4zrlwrHtwyV/sqeAha38KrgrwvmRI46RrwyIzFkbD0IcU:fLi7rHiuwJzvdyIC0D2Wo7D1Fxt
TLSH
T1DBB43A143FA98A08E580293E459E1615DB9AD2F126327303370AEF625D05DDEDE3D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  start.exe
- Size 515KB
- SHA256 22dae34c2c163a3a010dc06a6cad3cb451c527c0d18d6dfc3b960994cfef95b2
- MD5 58b2cf2cd7f12a2a3000dc6bf17c262f
- SHA1 c5054507424749aeae227cb9ee6f20913223b1ad
- SHA512 39a7c7154bb4255bf9cf2766a41eac952d5111c6c4703f0356b61fb5bb59f85ee5e10e977edbf8325152c5e439ca60aa59679a833f6e312d5a2e0da6407b3134
- SSDEEP 6144:bDmLeZwi9a7vPv/rXXi4zrlwrHtwyV/sqeAha38KrgrwvmRI46RrwyIzFkbD0IcU:fLi7rHiuwJzvdyIC0D2Wo7D1Fxt
- TLSH
  T1DBB43A143FA98A08E580293E459E1615DB9AD2F126327303370AEF625D05DDEDE3D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1