dracula_stealer | 1785ff7894936feb26edd22597e65dc2f971fa1e882cc4908bdd063df28fa38b

General

Target
h20ninkmori61dcf.exe
Size 592KB
Sample260811-k232sazdle
SHA256 1785ff7894936feb26edd22597e65dc2f971fa1e882cc4908bdd063df28fa38b
MD5 77a7f0f31e23ae403d62e7cff8aa6031
SHA1 f21e8fb52b4a6a7275f9df89da5285c768efda76
SHA512 d8dbd9b6245ec38cd91db636968c2834c205adc3a4d35c47a7062817fd62874fa994c6def8c6bfe85abe97c3dd63d75fb425e5645cf7ce66459262f30d78a38b
SSDEEP 6144:b3gFfLfJpvMFK7sHqi+4d+F3konkxzNxrTgmYABbTNz1ou4IHCRF4V+dT/YtDXj0:LqfLfJIu7i69nkxzNxULWluYEFW4
TLSH
T1D0D4B3147BA5CAC8D94017FE415E1A14CB9B99E111F2E303370AFB61CE459EE9E2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  h20ninkmori61dcf.exe
- Size 592KB
- SHA256 1785ff7894936feb26edd22597e65dc2f971fa1e882cc4908bdd063df28fa38b
- MD5 77a7f0f31e23ae403d62e7cff8aa6031
- SHA1 f21e8fb52b4a6a7275f9df89da5285c768efda76
- SHA512 d8dbd9b6245ec38cd91db636968c2834c205adc3a4d35c47a7062817fd62874fa994c6def8c6bfe85abe97c3dd63d75fb425e5645cf7ce66459262f30d78a38b
- SSDEEP 6144:b3gFfLfJpvMFK7sHqi+4d+F3konkxzNxrTgmYABbTNz1ou4IHCRF4V+dT/YtDXj0:LqfLfJIu7i69nkxzNxULWluYEFW4
- TLSH
  T1D0D4B3147BA5CAC8D94017FE415E1A14CB9B99E111F2E303370AFB61CE459EE9E2C3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer defense_evasion trojan
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2