dracula_stealer | fe75ad96cd86538670b8a60f1f7811f1aa8e24fca919c6113402e6a3cd6dd363

General

Target
dscgb.exe
Size 521KB
Sample260827-m4vjjasvbv
SHA256 fe75ad96cd86538670b8a60f1f7811f1aa8e24fca919c6113402e6a3cd6dd363
MD5 1b87d76780ef10479d43927e80f6000e
SHA1 f15c6ba288fba11acae2c7549d1b2e5b8cb1e3f7
SHA512 8384564497acdf4ce6a0f106a3d6a061cfe7372bcc76882d65f7216cf9cdb10a19a260aecbcd1d52762bd6caa938d9f86541a8e6467f2ed2c06c5ba66e14b6b2
SSDEEP 12288:fc7bI42rvB7mwhoGrdrawft2Lwax9BNGDb:yc42rXhQwEEaP
TLSH
T17AB42A193FA98A08E540253E455E5609DBDAE1F226327303370AEF614D05DDEEE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  dscgb.exe
- Size 521KB
- SHA256 fe75ad96cd86538670b8a60f1f7811f1aa8e24fca919c6113402e6a3cd6dd363
- MD5 1b87d76780ef10479d43927e80f6000e
- SHA1 f15c6ba288fba11acae2c7549d1b2e5b8cb1e3f7
- SHA512 8384564497acdf4ce6a0f106a3d6a061cfe7372bcc76882d65f7216cf9cdb10a19a260aecbcd1d52762bd6caa938d9f86541a8e6467f2ed2c06c5ba66e14b6b2
- SSDEEP 12288:fc7bI42rvB7mwhoGrdrawft2Lwax9BNGDb:yc42rXhQwEEaP
- TLSH
  T17AB42A193FA98A08E540253E455E5609DBDAE1F226327303370AEF614D05DDEEE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution dracula_stealer persistence privilege_escalation ransomware spyware stealer adware
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2