dracula_stealer | 0bb0894dc84cdf91bb5719a638bab8fe3eaf676e539a76c18ac9b5ea2bb846d5

Sharing

General

Target
smokehostinstaller.exe
Size 875KB
Sample261001-tstanaxgrb
SHA256 0bb0894dc84cdf91bb5719a638bab8fe3eaf676e539a76c18ac9b5ea2bb846d5
MD5 c71d910692ffc16295989c8d82dd8fa4
SHA1 e3d82c6d464981aced8b4fe7e9a78e47a06518e4
SHA512 9a63400387192f32e764653b6d9fe7ae6e45939e18e10179def047b1b41455d46a08c987ebccd12c3878de25d707808e1567c94cfc27deca4dada4829ed43451
SSDEEP 12288:sOgIWvEYLYon0WTnrMQf619dhRvwzpCyIVjAFZwJxEh:xWvEHI0mV0CAVjAexEh
TLSH
T1AE154A242FA94908D6413AFD45AA5128CBADCDE12921D303B336BE516D319CFED1D3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  smokehostinstaller.exe
- Size 875KB
- SHA256 0bb0894dc84cdf91bb5719a638bab8fe3eaf676e539a76c18ac9b5ea2bb846d5
- MD5 c71d910692ffc16295989c8d82dd8fa4
- SHA1 e3d82c6d464981aced8b4fe7e9a78e47a06518e4
- SHA512 9a63400387192f32e764653b6d9fe7ae6e45939e18e10179def047b1b41455d46a08c987ebccd12c3878de25d707808e1567c94cfc27deca4dada4829ed43451
- SSDEEP 12288:sOgIWvEYLYon0WTnrMQf619dhRvwzpCyIVjAFZwJxEh:xWvEHI0mV0CAVjAexEh
- TLSH
  T1AE154A242FA94908D6413AFD45AA5128CBADCDE12921D303B336BE516D319CFED1D3EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit collection credential_access defense_evasion discovery evasion execution exploit dracula_stealer persistence privilege_escalation ransomware spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Possible privilege escalation attempt
  exploit
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Creates new service(s)
  persistence execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1