dracula_stealer | 4901dcff7ba81e29793f528db28bdfcba5d1c6b02e2793206295d72b8a3ab07b

General

Target
full.exe
Size 509KB
Sample261013-ndaxwabe35
SHA256 4901dcff7ba81e29793f528db28bdfcba5d1c6b02e2793206295d72b8a3ab07b
MD5 02661ede9275584761f0a7140e678182
SHA1 f9c7ee2c7d56d4cd6df3ca857df5fd086eb353bc
SHA512 d100b937317d1140062f34b7bdce00269221f9a3aed89fbbcd8d8342bdaed9a6730de5fc9bfd84f82861996915d4e2345e9161256d982301317ce8716c070c24
SSDEEP 6144:ppjg54fgeGii8k23yWkxXo5NtcT0UqqG5t8pVqEdjjGNl7opKQayfgGVbokbWNR2:Lg2oUkeyZxXo5z2rqqG5+1AyfTbVo2
TLSH
T126B429147F998E08E480267E455E1A09DBAED1F225327303770AEF620D45DDEDE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  full.exe
- Size 509KB
- SHA256 4901dcff7ba81e29793f528db28bdfcba5d1c6b02e2793206295d72b8a3ab07b
- MD5 02661ede9275584761f0a7140e678182
- SHA1 f9c7ee2c7d56d4cd6df3ca857df5fd086eb353bc
- SHA512 d100b937317d1140062f34b7bdce00269221f9a3aed89fbbcd8d8342bdaed9a6730de5fc9bfd84f82861996915d4e2345e9161256d982301317ce8716c070c24
- SSDEEP 6144:ppjg54fgeGii8k23yWkxXo5NtcT0UqqG5t8pVqEdjjGNl7opKQayfgGVbokbWNR2:Lg2oUkeyZxXo5z2rqqG5+1AyfTbVo2
- TLSH
  T126B429147F998E08E480267E455E1A09DBAED1F225327303770AEF620D45DDEDE2D3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery evasion execution dracula_stealer persistence privilege_escalation ransomware spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (4146) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1