dracula_stealer | fbe1a132a4dda975e349ba6c6d29e79bf247f0f18a1aeec6d80ce16e7e92ccbb

General

Target
start.exe
Size 558KB
Sample260812-etm3psycpc
SHA256 fbe1a132a4dda975e349ba6c6d29e79bf247f0f18a1aeec6d80ce16e7e92ccbb
MD5 0322baf8c0e2e6567934f5d94bde7e84
SHA1 c25932c7836bc7f749879efe68153c7d8084b852
SHA512 1d63b187a6871a6ae27dffaf37fa62b4a487b016097a3819a23bdbf2d944aace2b068a366d795ef97b8e0110ab859f70d683a2f6016bf5dc46cdbb6009da09b4
SSDEEP 6144:lJCVxPDfssFMU23mGk6F0Ew+NtTkyxRFVgylVza9GvPswRXNpBdYu7zbfv/Rd7LA:ls9fssq3mSO6tbYITRXNJ/v7LcmsqA
TLSH
T167C439247F948608E590197E459E1A11C7AA91F226327303371AFF611D8ADDEDF2C3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  start.exe
- Size 558KB
- SHA256 fbe1a132a4dda975e349ba6c6d29e79bf247f0f18a1aeec6d80ce16e7e92ccbb
- MD5 0322baf8c0e2e6567934f5d94bde7e84
- SHA1 c25932c7836bc7f749879efe68153c7d8084b852
- SHA512 1d63b187a6871a6ae27dffaf37fa62b4a487b016097a3819a23bdbf2d944aace2b068a366d795ef97b8e0110ab859f70d683a2f6016bf5dc46cdbb6009da09b4
- SSDEEP 6144:lJCVxPDfssFMU23mGk6F0Ew+NtTkyxRFVgylVza9GvPswRXNpBdYu7zbfv/Rd7LA:ls9fssq3mSO6tbYITRXNJ/v7LcmsqA
- TLSH
  T167C439247F948608E590197E459E1A11C7AA91F226327303371AFF611D8ADDEDF2C3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1