dracula_stealer | 73c28ab31785cdb8b776713ba6a17815fac2832ddde5e03681df1b4caa8d9b70

General

Target
chocoLauncher.exe
Size 893KB
Sample261010-vtp53agz4w
SHA256 73c28ab31785cdb8b776713ba6a17815fac2832ddde5e03681df1b4caa8d9b70
MD5 e11c5b922767b481b6b19cd330d770c6
SHA1 8b11a18df568441435bb2929c5385fc40558e198
SHA512 b870fe95be0b3a0806406aa279b2955b111447024576f4f82183fc549cf6a52c4b9df41510b3cec893706138a75d828fec2183d76c95579527d74b61fc1427a2
SSDEEP 12288:hH+xFknhvpnq1LxFGXPubDPH8o+bjyIVjAFZwJxEh:oTavlunymTHly5VjAexEh
TLSH
T1DD154A252FA94908D2813AFC46AA5124C7ADCDE11A319303B376BE516D319CFED1D3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  chocoLauncher.exe
- Size 893KB
- SHA256 73c28ab31785cdb8b776713ba6a17815fac2832ddde5e03681df1b4caa8d9b70
- MD5 e11c5b922767b481b6b19cd330d770c6
- SHA1 8b11a18df568441435bb2929c5385fc40558e198
- SHA512 b870fe95be0b3a0806406aa279b2955b111447024576f4f82183fc549cf6a52c4b9df41510b3cec893706138a75d828fec2183d76c95579527d74b61fc1427a2
- SSDEEP 12288:hH+xFknhvpnq1LxFGXPubDPH8o+bjyIVjAFZwJxEh:oTavlunymTHly5VjAexEh
- TLSH
  T1DD154A252FA94908D2813AFC46AA5124C7ADCDE11A319303B376BE516D319CFED1D3EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2