dracula_stealer | 2048cab8ec74a38efb0e95073c8bdfc792738dddcde2e49f160d43648c1dce56

General

Target
2048cab8ec74a38e.bin
Size 1.6MB
Sample260907-tbsykazfjf
SHA256 2048cab8ec74a38efb0e95073c8bdfc792738dddcde2e49f160d43648c1dce56
MD5 d9f1b20bdad0938d0ec2af1a7399d9b2
SHA1 1bb5bc3a78d1725673a7a7c0d717779c7a62c19b
SHA512 f89d71ea522165943e6f7b8c6be9b3044d452f77336f5ec28e9f4fcb4e08a09cdbc1ed50782d7d237745d4cd7385c6d1a8ba220b50694d8bb96e77b964636b4e
SSDEEP 49152:K4FdetMVCK1LVXXQezP3+Wgm18VeWoA/rEVE8x:PdkCCK3XXQO18VeWnU
TLSH
T148753315F29DD853C01F0EF2165263FB0E26B1FCD9360B369F18226E9D1397916AC26B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2048cab8ec74a38e.bin
- Size 1.6MB
- SHA256 2048cab8ec74a38efb0e95073c8bdfc792738dddcde2e49f160d43648c1dce56
- MD5 d9f1b20bdad0938d0ec2af1a7399d9b2
- SHA1 1bb5bc3a78d1725673a7a7c0d717779c7a62c19b
- SHA512 f89d71ea522165943e6f7b8c6be9b3044d452f77336f5ec28e9f4fcb4e08a09cdbc1ed50782d7d237745d4cd7385c6d1a8ba220b50694d8bb96e77b964636b4e
- SSDEEP 49152:K4FdetMVCK1LVXXQezP3+Wgm18VeWoA/rEVE8x:PdkCCK3XXQO18VeWnU
- TLSH
  T148753315F29DD853C01F0EF2165263FB0E26B1FCD9360B369F18226E9D1397916AC26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer defense_evasion trojan
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2