dracula_stealer | 0c50154bb0c457e5860aff0e58e341642c1c6fd00ebab490e1a4f6bee1f1f296

Sharing

Copy URL Twitter E-mail

General

Target
Gomo 1.9.rar
Size 66.5MB
Sample260816-qtpgbayfme
SHA256 0c50154bb0c457e5860aff0e58e341642c1c6fd00ebab490e1a4f6bee1f1f296
MD5 867e464e420487e77ac003213d29a0fd
SHA1 5482f24a8ea93c45f75564bebb41275531ba9e77
SHA512 37e9530b078c10a4e21faa8a91b7cd3dde9133db42bcf33db6fa867cb7dab8a580923ee72258ec369cc07e91353fe8a66287cc2515cca1e32f1c8b23d3399ec8
SSDEEP 1572864:LOoZMmuBSJ+cZG0u6ZKH55piburIm52R7OtYrtmoxEX8hwFT1CB:q0MmmS1ExfHEyrj52ROartCXKa1Y
TLSH
T19EE733EDD1835D2A76B118FDACDE87EA58E12A18E73EC353D070257821463B059ACC7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Gomorat 1.9/BouncyCastle.Cryptography.dll
- Size 4.4MB
- SHA256 3d7ced058d7264036323f8cfd87d3203761b5fe45dfddf1ebce069c1e36b81b8
- MD5 a61bc1b4b86e564eadadd005fc7a8516
- SHA1 b272809b5b4d63e4be937ebca81400cd1d357599
- SHA512 75a7d97f904724144b90be9fb041afc480d531f018470505190ba71412853a04b418582e6aef227c206237e251f2e98b86ad141d2c2ecd1538f1894f0b1fb5d0
- SSDEEP 98304:dMckWvzAsUohBJPQdtBuEoSqVCb4rABp+:NL8dHEC+AP+
- TLSH
  T133269F0577F81E32E26FC3B395B19022A7F1E4AB7363EB1B6580A6A65C53B505C413B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Gomorat 1.9/DiscordRPC.dll
- Size 84KB
- SHA256 984b1765dc6698dd3e2a5f9ec55ce0559e2fda60da4da089b0c36f07fb8dfe9c
- MD5 76a0e138a76cca167736dcb6d48acf62
- SHA1 79f3796dc697aa3f966522a1f45d4988d8d3cb4d
- SHA512 c44b4a7ee3d27da194f24eaf2a3097cac69597725259eab5da596f52bd4b344f339b21f5562c5a4425058e3cc009ec95b1a23d63c3c7d8b8b0b21c6183d4d8a1
- SSDEEP 1536:Tp45EBCD+50zqeA1pfEI8FslWtDGt1PMnD+msxpSN5:TW52C6iiEI8VtDIGnD+mt5
- TLSH
  T14983087563FC825DE5BF2B34F0B412114BF6B949B935EB9E5A4420CE2E43B814A613B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Gomorat 1.9/EntityFramework.SqlServer.dll
- Size 577KB
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- TLSH
  T187C4F715B3E45E24C3BB4230583A701CEAB582F3627D0694F95EA3DF6FBA91115A3723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Gomorat 1.9/EntityFramework.dll
- Size 4.8MB
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- TLSH
  T1EA362942F3E81F2AE1FF067AA435604A5AF5FC6A1352D65E381CB1AD1F227005A63737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Gomorat 1.9/GMap.NET.Core.dll
- Size 304KB
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- TLSH
  T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Gomorat 1.9/GMap.NET.WindowsForms.dll
- Size 154KB
- SHA256 f09c31a7f0cde63b914826fcd8b47e7267394175d3fab30cb9615519e5817e5f
- MD5 2110dc2c787880b9ed2ef58f17cf8da9
- SHA1 24edeb5fdd96af28425e28f2682f9874c3f9733c
- SHA512 095a26c3c7389fcabc9f5ff24d4877879d84513e628a20248bae693f1a2241a583e398f8662131dd21c07d919c06bf3d9af54f68f10a6e361e1c0f09e1dc8d31
- SSDEEP 3072:oPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJawdS5DBRS9LXf+6qbugi7vRq:KccbGucgK9vd/0rS9jf+6qq
- TLSH
  T163F39DA273948D7FC66F47BDA0A140C1273AFA02F692D35D5D9070BC4D93B146B227AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Gomorat 1.9/IconExtractor.dll
- Size 10KB
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH
  T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Gomorat 1.9/IndexRange.dll
- Size 11KB
- SHA256 5cd33b79cceb34cd4503bedd0db4f6a6742536cbbb418149c794cf73076f1016
- MD5 7158f0937fa636542d8fc02dba80ddb1
- SHA1 a6cff591b08b7b77ce88349ba51d02f0573c05a8
- SHA512 73bf167c65ea49c03e237d6bd0ef9bf5f1ce768f866501f74ff183d7ecd39e3f5f7a344dc632ea78d9ffa5d4a949806b92ebb2edc72cd511535137cefad1a46c
- SSDEEP 192:My6UdPVgEYUFwDxBChF31e60mQwLb/ZefWanxk:MvkVGmS+e4L7Z2nx
- TLSH
  T138324A22BFEC073BEEF64733A8B6B7502370FA61FA23872F1545522A9C127484566331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Gomorat 1.9/Leb128.dll
- Size 7KB
- SHA256 0e9f5e8cdcaa564d6354c15e2fb4d33dbdead917a2e1388050a68bfb1876ff01
- MD5 e6650e116617c59d46b6f2d3498ee138
- SHA1 f499cf553215a2f4190f0c1e9d35b43dc9e1b092
- SHA512 09f9b493a5accc6ba3e724627b74189e08c34a6f30557a5e07f849957db48b22d496fa38a40640b591c67ed3d9cd797f350136fcc6c5f8fdab6c3d645429cc34
- SSDEEP 192:lxAvycMDDDDDDDDDDaZF6URpVJVXKy83:/+F6URpVJVXz83
- TLSH
  T13FF14304A3D44E24DFA642BEA96A470993B4B71D9C43D71F789456E17D0137E2E121FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Gomorat 1.9/LockerStub/stub.exe
- Size 216KB
- SHA256 b23994580b3ed7dfc00f132ee29966eab7fd4be12e5b3dd5b05944dca5f1d38b
- MD5 c7d8914d87e1545b6d7e945c06c4f853
- SHA1 974acf9bda2347c802c73517678063a7133d7cc5
- SHA512 a32b327181d6bd6b1bae4d41de10526721684bd53540d532c14950345b93fb250bac4d870226d7a4ecd93df7168a2d4cb0f545565457ddfe94863b2ba6ac1a58
- SSDEEP 6144:cyfvZDIlFnRtQ0UjMiI8nzFSdWSV+KUL99:lmjQT
- TLSH
  T196245B88135E4D3ED2AF4BF9E072A20247F8A7278653FB8D9DE585D61E27781CA04713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion persistence
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral19 behavioral20
- Target
  Gomorat 1.9/MaterialSkin.dll
- Size 6.4MB
- SHA256 3f075552e29e58736ff96e00c828a9a4cb28c16337744b69c5114196ad78d59e
- MD5 301d762a76b269e1fdf391d662acc86d
- SHA1 9ddf5bfa4ddd4bb23e02d49f9966338472d21667
- SHA512 25d7a6dac054744e72d97ab388898b708c4d653da474d937a8a88c92f2f6736df735e378b09acda0f33f9ed0e41de88a617262c1970a7f187eadec9a0274df05
- SSDEEP 98304:21vd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uN4E:2gKv8XcXD4K
- TLSH
  T12A662902D642A62ACAC6F6387D3D933E0D70D429FC5DB62674C59F3184CA944EC69BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Gomorat 1.9/Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
- MD5 ff34978b62d5e0be84a895d9c30f99ae
- SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
- SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
- SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
- TLSH
  T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Gomorat 1.9/Microsoft.Extensions.Configuration.Abstractions.dll
- Size 30KB
- SHA256 47bcc0dd74ab89d355309b86aa9bc4da05b250a7d3ae558e424bbb85588d2e95
- MD5 d54af1962bb17e5a1bd39b39c7fc08c5
- SHA1 35cd34cd5bf62139699a14cb3c7e5b4a4c363e14
- SHA512 21aa36906c9567b086a570ddf62bb11045185d610c2a7a84e23e6a8cb54d89c4c00e2d2d40416e8fc176e4e0366315ad672ed0e0e09087a5081113ed1b2b2b6e
- SSDEEP 384:ny/E3cUQGqRKbUND5RdacHh/t1o/98TG/DHzzRjz6oM0GwmHMDlEWsfNWtTb2HRy:ngE+9lDPdhh/volC1sGQ/i+9zV
- TLSH
  T1C1E23A2263AC4337CEBB0FF0E5A8D5413E3AC7567412EA2D699DB1090E27BC4477176A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Gomorat 1.9/Microsoft.Extensions.Configuration.Binder.dll
- Size 47KB
- SHA256 b777fe506fa0e70912a4ef12b3f57d4ba0d8245fda3ea7604872da6997d7a15e
- MD5 70cbae89673e3979115f2025763df10f
- SHA1 2d3ee102be92e1034b0d4b7c72ea84b4652504fc
- SHA512 95459995f13c06ef5f706dbecb02d85febc455c3dc261c2a49a33a327de042d3781c01ec7a4a70e350f321d02759b3a97d0d3f786b4ef73ae0a319049a190cf0
- SSDEEP 768:s6BV5qD19n3dw2h1Bu0rxjVdrxCUu/im9zA:XBV5E5d1c0rxPxCUuiyzA
- TLSH
  T15C236B1663BC872ADDFE0BB07474E4914E3ABA867623D7194D8DB04C1937B809B61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Gomorat 1.9/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 62KB
- SHA256 c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e
- MD5 00053ff3b5744853b9ebf90af4fdd816
- SHA1 13c0a343f38b1bb21a3d90146ed92736a8166fe6
- SHA512 c99fcda5165f8dc7984fb97ce45d00f8b00ca9813b8c591ad86691bd65104bbb86c36b49bb6c638f3b1e9b2642ec9ac830003e894df338acfca2d11296ff9da4
- SSDEEP 768:4r85ZhSBuU1OURH7MV5594phn9Uad5J6Sx+I9W6wjMwRLSEnlHctC63/iOn9zT8c:cH7Mz8DiIW6Pw9SEnl8txviO9zTH
- TLSH
  T1B8533B5533F8C767CBAE5F7338759300DB34A9476532E36F268E70D5088ABC913A0AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Gomorat 1.9/Microsoft.Extensions.Options.ConfigurationExtensions.dll
- Size 27KB
- SHA256 9c4f8fa0e201d2336a97b7868f8229f94f4cdc16a4a44348b924876693c3be3b
- MD5 70e4dcb7364847a277c1e2ddba5663d6
- SHA1 1d872ccf407390a5cf2c2c0a932b074cada1a9ed
- SHA512 641b61b1d448034d9c6d37f06bc0bc26099332a3ea687b0f2d572aa63858d48e3d3fe9347732bd92b35d9ea024b00ab02d346bb31812504bd4cfaf831cd97dad
- SSDEEP 384:ZXK/p2aog1hRR82PWRX03xWnE2zWzP0WQTb2HRN7bVwR9zP15v+/:BcpLvi2Wnpcq/i69zDvu
- TLSH
  T1A5C24A21A76C0336DDBB0A30E9F1E9523D7AD3863811EA7E969DF1090C67B488731779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Drops desktop.ini file(s)

Hide Artifacts: Hidden Files and Directories

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32