dracula_stealer | 7f69f37961e6f7cf1ed16aa1e457509e8bcfde434aa95994de49ef9cac3d2b92

General

Target
start.exe
Size 461KB
Sample260809-wfzb9abk7v
SHA256 7f69f37961e6f7cf1ed16aa1e457509e8bcfde434aa95994de49ef9cac3d2b92
MD5 d229699a6394953dda73b58a28277ab1
SHA1 43a9596856a99479f1f8be07f6fff15a1b0d895e
SHA512 63b2acb40cffb43235b5e718b725ba5e2e72e717df5c46eb96fce542e4a70198b5ba6fedfeba2216847220e4ca77ecee37da83922416d79b6f3f83385d920290
SSDEEP 6144:8IkebwAkjgIoCekYkEngpNCzClFoeFUb3ly2DEdOfUE6+WjHFC7y+7Ec3ux++PcC:LvngpNCz0Uux+/TrNadDyFZiIC
TLSH
T16DA43A243FA98E18D980257E455E5A09CBDAD1F221326303370AEFA15D05DDEDE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  start.exe
- Size 461KB
- SHA256 7f69f37961e6f7cf1ed16aa1e457509e8bcfde434aa95994de49ef9cac3d2b92
- MD5 d229699a6394953dda73b58a28277ab1
- SHA1 43a9596856a99479f1f8be07f6fff15a1b0d895e
- SHA512 63b2acb40cffb43235b5e718b725ba5e2e72e717df5c46eb96fce542e4a70198b5ba6fedfeba2216847220e4ca77ecee37da83922416d79b6f3f83385d920290
- SSDEEP 6144:8IkebwAkjgIoCekYkEngpNCzClFoeFUb3ly2DEdOfUE6+WjHFC7y+7Ec3ux++PcC:LvngpNCz0Uux+/TrNadDyFZiIC
- TLSH
  T16DA43A243FA98E18D980257E455E5A09CBDAD1F221326303370AEFA15D05DDEDE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1