dracula_stealer | d2aee3875988075961f7bb5a759b58759d4e873e7257d5119d9178d5d19913d5

General

Target
bv2gfmyhrrkhepg6.exe
Size 621KB
Sample260826-vdrc7asgka
SHA256 d2aee3875988075961f7bb5a759b58759d4e873e7257d5119d9178d5d19913d5
MD5 03e08d50446a45f9d65fb318141f3b95
SHA1 162a9e56f6c7014e64ea1c15b36c5c421a2e8da9
SHA512 45e602ac426a6211f10dafc929a7d9d12764f450fbd66f4ee9b2bfeee81689b8613250054db6ebc12c58c510e19fec9774b626b5e78de5671ad32197bf06bfaa
SSDEEP 12288:iivZqxgWzeJAAGuYS61yAO5zV6Cgeb1wZDp2Xmfw95r:jQLzeJHYS61tS6CZhK2Xn
TLSH
T1B3D4D3143BA9CAC8E44017FE419A1604DB9B99E215F2E303370AFB62DD059DEDE2D3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  bv2gfmyhrrkhepg6.exe
- Size 621KB
- SHA256 d2aee3875988075961f7bb5a759b58759d4e873e7257d5119d9178d5d19913d5
- MD5 03e08d50446a45f9d65fb318141f3b95
- SHA1 162a9e56f6c7014e64ea1c15b36c5c421a2e8da9
- SHA512 45e602ac426a6211f10dafc929a7d9d12764f450fbd66f4ee9b2bfeee81689b8613250054db6ebc12c58c510e19fec9774b626b5e78de5671ad32197bf06bfaa
- SSDEEP 12288:iivZqxgWzeJAAGuYS61yAO5zV6Cgeb1wZDp2Xmfw95r:jQLzeJHYS61tS6CZhK2Xn
- TLSH
  T1B3D4D3143BA9CAC8E44017FE419A1604DB9B99E215F2E303370AFB62DD059DEDE2D3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1