DRAGSTARE

DRAGSTARE is a C# information-stealing malware used by the UAC-0099 threat actor in phishing-driven cyberespionage campaigns targeting Ukrainian state authorities, the Defense Forces of Ukraine, and defense-industrial enterprises. It is typically deployed as a follow-on payload by the MATCHBOIL loader alongside the MATCHWOK backdoor. Reported initial access involves phishing emails, often themed as court summons and sent via UKR.NET, linking to legitimate file-hosting services that deliver a double archive containing an HTA file; execution of the HTA launches obfuscated VBScript and PowerShell that ultimately activates MATCHBOIL, which then deploys DRAGSTARE.

DRAGSTARE is described as a stealer focused on broad host and user data collection. High-confidence capabilities mentioned in the source material include collecting system information; stealing browser data from Chrome and Mozilla browsers, including credentials, cookies, and decryption keys; copying files matching specified extensions from common user folders such as Desktop, Documents, and Downloads; capturing screenshots; archiving/staging collected data for exfiltration; and executing PowerShell commands received from attacker-controlled infrastructure. Reporting also notes anti-analysis or evasion behavior, including virtual machine checks, and persistence via a registry key. Exfiltration is performed to a dynamic URL obtained from command-and-control infrastructure. The malware is also referred to in one source as NordDragonScan.