dracula_stealer | e478a60520a83a5d1421d5981f17305b2b246344f7f07094fa279b678be85db6

General

Target
Nireva.exe
Size 613KB
Sample261113-slc5esw15q
SHA256 e478a60520a83a5d1421d5981f17305b2b246344f7f07094fa279b678be85db6
MD5 9c2b8ce0bfb29ac0b269d190c2aeaf0d
SHA1 9d93260f0367753614d0564c2d9cc032faa21469
SHA512 e989a5b7ba8971dda8d8a45d3be9af50739e83ac8f3fff6c1e1e37f4e96baf42823ac61d90164f22044e76239d507dd6472debb91495e985ff71fb25bac18784
SSDEEP 12288:hhCW73Y6YHzgUpCKAZvcNRrf82FP8eAMS6deYQr/X:bm6YTgUpCh1gk217ysQr/
TLSH
T1B9D4D4147B99CAC8E4501BFE455A1904DB9B99E115F2E303370AFB62CD048DEDE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Nireva.exe
- Size 613KB
- SHA256 e478a60520a83a5d1421d5981f17305b2b246344f7f07094fa279b678be85db6
- MD5 9c2b8ce0bfb29ac0b269d190c2aeaf0d
- SHA1 9d93260f0367753614d0564c2d9cc032faa21469
- SHA512 e989a5b7ba8971dda8d8a45d3be9af50739e83ac8f3fff6c1e1e37f4e96baf42823ac61d90164f22044e76239d507dd6472debb91495e985ff71fb25bac18784
- SSDEEP 12288:hhCW73Y6YHzgUpCKAZvcNRrf82FP8eAMS6deYQr/X:bm6YTgUpCh1gk217ysQr/
- TLSH
  T1B9D4D4147B99CAC8E4501BFE455A1904DB9B99E115F2E303370AFB62CD048DEDE2D3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer
- Detects Dracula aka Samurai Stealer payload
- Family: Dracula, Samurai
  Dracula aka Samurai is a stealer written in C#.
  stealer dracula_stealer
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2