dracula_stealer | bf5aea496d5dbc0ad3010758a3dd3924528bfc4a10b53ee967856f4d72df968e

General

Target
start.exe
Size 523KB
Sample260809-pa6e2sem2w
SHA256 bf5aea496d5dbc0ad3010758a3dd3924528bfc4a10b53ee967856f4d72df968e
MD5 5db7d0cd11aaee3506777d1c72805b5d
SHA1 04b0c8e0cff103e00bcacf0d8c2ee2cc0a41ddb3
SHA512 ce422a9809f27ca14c511536ddd24b1c6bc8b3261bfa3f7db5810b17e9fe09eb1e81ffd30acfa4c1e86b92f24efc0cd36df10841c7c3f81cdc2595928e907ae3
SSDEEP 6144:DH5GlZqWTgk2FSE+Crco2AkUqpUMcEb2xxIg0hZZM1sDmHtn+00HCEM+ue8Lhw1p:TG5gVuSgAkUhIXiNlLhw1oZ9pGv162O
TLSH
T135B44A247FE98A08D480167E415E5A18DB9ED1F22132B303370AEF625D45DEEDE2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  start.exe
- Size 523KB
- SHA256 bf5aea496d5dbc0ad3010758a3dd3924528bfc4a10b53ee967856f4d72df968e
- MD5 5db7d0cd11aaee3506777d1c72805b5d
- SHA1 04b0c8e0cff103e00bcacf0d8c2ee2cc0a41ddb3
- SHA512 ce422a9809f27ca14c511536ddd24b1c6bc8b3261bfa3f7db5810b17e9fe09eb1e81ffd30acfa4c1e86b92f24efc0cd36df10841c7c3f81cdc2595928e907ae3
- SSDEEP 6144:DH5GlZqWTgk2FSE+Crco2AkUqpUMcEb2xxIg0hZZM1sDmHtn+00HCEM+ue8Lhw1p:TG5gVuSgAkUhIXiNlLhw1oZ9pGv162O
- TLSH
  T135B44A247FE98A08D480167E415E5A18DB9ED1F22132B303370AEF625D45DEEDE2D3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1