dracula_stealer | cc537f11b4c1d37b373edcff91cfd716d85ed3784343bdea2a573d996ccb842d

General

Target
sxczs.exe
Size 498KB
Sample260826-x4cc3avelf
SHA256 cc537f11b4c1d37b373edcff91cfd716d85ed3784343bdea2a573d996ccb842d
MD5 72b0c641295204291fd915fbb9739c05
SHA1 07106dbbb8fc87119d28385fc39b6d4d329ab868
SHA512 9fb6d7e5713f80cfddae9562b31908297377e002cc019e9538402c622c9a59c1ef9c760d71b7a590a468e0061aac239c4fd0c8bda1dd9714a70b89d01920abd5
SSDEEP 6144:Rqc9K4JPnDkWxjP/+w46rREyODho0OJvIlYaMvfc9UQgL891EJm9DvoPcbYwJjy2:1Keb+WxO2RIyLL8g9K5j
TLSH
T13AB42A147FA98A08D585257E459E5A08CBDAD1F21132B303330AEFA10D45DDEEE6D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  sxczs.exe
- Size 498KB
- SHA256 cc537f11b4c1d37b373edcff91cfd716d85ed3784343bdea2a573d996ccb842d
- MD5 72b0c641295204291fd915fbb9739c05
- SHA1 07106dbbb8fc87119d28385fc39b6d4d329ab868
- SHA512 9fb6d7e5713f80cfddae9562b31908297377e002cc019e9538402c622c9a59c1ef9c760d71b7a590a468e0061aac239c4fd0c8bda1dd9714a70b89d01920abd5
- SSDEEP 6144:Rqc9K4JPnDkWxjP/+w46rREyODho0OJvIlYaMvfc9UQgL891EJm9DvoPcbYwJjy2:1Keb+WxO2RIyLL8g9K5j
- TLSH
  T13AB42A147FA98A08D585257E459E5A08CBDAD1F21132B303330AEFA10D45DDEEE6D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2