MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2
SHA3-384 hash: 010c1ebf514bde30ef18e8220b47f94ba53e10b99b95003127b87b974aebc5cf7de67febaaae72711e211078fc62dd90
SHA1 hash: 09633b90a0b993fd4dec6d522a1243433fc3ab10
MD5 hash: 7d124bc23be85d73b1177143f41b5e72
humanhash: september-eleven-india-delaware
File name:7d124bc23be85d73b1177143f41b5e72
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'493'440 bytes
First seen:2022-12-09 09:37:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bb2af1988009d4b4491115f62e2f94ab (3 x RedLineStealer, 2 x ArkeiStealer)
ssdeep 24576:jEiV++MCUfiiF5CYElcxGvvJq89F85NURwfCULmNQpBAXFVw/5xbpY0Y8vNcup:jEiV++MCxiF0tJ25NK2mapBA1uxYSlcG
Threatray 1'826 similar samples on MalwareBazaar
TLSH T1BA65236E93951032DAC617342CF7CF9BB739EF2516A897472A869D2A7C31BD0D930306
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c8f4f2e8e8b2e4d8 (1 x ArkeiStealer)
Reporter zbetcheckin
Tags:32 ArkeiStealer exe signed

Code Signing Certificate

Organisation:vcoins.com
Issuer:Amazon
Algorithm:sha256WithRSAEncryption
Valid from:2022-10-25T00:00:00Z
Valid to:2023-11-22T23:59:59Z
Serial number: 050a012c9d98c6d640d2d7f67e016985
Intelligence: 8 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: c831b8a2466c3a56f5aa15e9c540b5a2b3359c94386ee03d349c975f08de1c03
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344651/
Detection(s):
SecuriteInfo.com.BScope.TrojanDownloader.Zlob.3593.17942.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed zlob
Link:
https://www.filescan.io/uploads/639301fb04e0e79bdf41c294/reports/e258e649-e0aa-4752-8f5f-e2f159ade555/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mustang Panda
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efbeb094-5336-42f0-b276-582730778bd6
Result
Threat name:
Amadey, Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1131310
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Detected unpacking (creates a PE file in dynamic memory)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Overwrites code with function prologues
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Self deletion via cmd or bat file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected Amadeys stealer DLL
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 764034 Sample: 5GPueTFF2S.exe Startdate: 09/12/2022 Architecture: WINDOWS Score: 100 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus detection for URL or domain 2->87 89 Multi AV Scanner detection for dropped file 2->89 91 7 other signatures 2->91 9 5GPueTFF2S.exe 22 2->9         started        14 gntuud.exe 2->14         started        process3 dnsIp4 61 135.181.10.220 HETZNER-ASDE Germany 9->61 63 88.119.169.157 IST-ASLT Lithuania 9->63 65 8.8.8.8 GOOGLEUS United States 9->65 55 C:\Users\user\AppData\...\nppshell[1].exe, PE32 9->55 dropped 57 C:\ProgramData\75873290272674793137.exe, PE32 9->57 dropped 101 Detected unpacking (creates a PE file in dynamic memory) 9->101 103 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 9->103 105 Self deletion via cmd or bat file 9->105 111 2 other signatures 9->111 16 75873290272674793137.exe 3 9->16         started        20 cmd.exe 1 9->20         started        107 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 14->107 109 Hides threads from debuggers 14->109 file5 signatures6 process7 file8 49 C:\Users\user\AppData\Local\...\gntuud.exe, PE32 16->49 dropped 77 Multi AV Scanner detection for dropped file 16->77 79 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->79 81 Tries to evade analysis by execution special instruction (VM detection) 16->81 83 2 other signatures 16->83 22 gntuud.exe 17 16->22         started        27 conhost.exe 20->27         started        29 timeout.exe 1 20->29         started        signatures9 process10 dnsIp11 59 85.209.135.109 CMCSUS Germany 22->59 51 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32 22->51 dropped 53 C:\Users\user\AppData\Local\...\cred64[1].dll, PE32 22->53 dropped 93 Multi AV Scanner detection for dropped file 22->93 95 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->95 97 Creates an undocumented autostart registry key 22->97 99 4 other signatures 22->99 31 rundll32.exe 22->31         started        35 cmd.exe 1 22->35         started        37 schtasks.exe 1 22->37         started        file12 signatures13 process14 dnsIp15 67 192.168.2.4 unknown unknown 31->67 69 System process connects to network (likely due to code injection or exploit) 31->69 71 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 31->71 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 31->73 75 6 other signatures 31->75 39 conhost.exe 35->39         started        41 cmd.exe 1 35->41         started        43 cacls.exe 1 35->43         started        47 4 other processes 35->47 45 conhost.exe 37->45         started        signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2/
Threat name:
Win32.Spyware.Vidar
Create hunting rule
Status:
Malicious
First seen:
2022-12-09 09:38:07 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
17 of 26 (65.38%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=asafkewwod5v6n556f57acvonf3gkd4cyc2l2nbpgudnebhxv2ra._file
Verdict:
malicious
Similar samples:
13e1a1e4cceade0d5dc35c874331f7fe5f4e5ce5840abb498786e826f2150fb7
ArkeiStealer
1cf8b640f710551de706cd924819a7fbfce0940f8c49a01a176601355ac35ca0
ArkeiStealer
1f411086d94da3c1e9ec9ef281b490ff06302ad0c2df328f0e08f73d00fea025
ArkeiStealer
25dd0395643f85483595e7968be30b9ab55572f220b52b49ecea6ac3dfaef824
ArkeiStealer
5866f921e4e7d2eef8693f9fefb19ccd46224c02bb46dd51639d8680de185a40
ArkeiStealer
8933d067b619ca799bababb246a9e88a28ee81caeb235dfbe12f9d891b043de5
ArkeiStealer
94667585382dab0329388084a94d85dfa85d611b4049c77a947c04250fd9ed03
ArkeiStealer
99cb9ea998d774a077d760f6a767660a520bc882a73195b3cd0282c2e967fb13
ArkeiStealer
bc376ec9587207d00b9af28189d47c0341a430c93167b732be851a0725f4a37f
ArkeiStealer
d08b59352d10ca03662860fd6f74d4d275e51a019335c50b264abe9e71c900af
ArkeiStealer
+ 1'816 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:systembc family:vidar botnet:1760 discovery persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/221209-ll2z8ach23/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
GoLang User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
Amadey
SystemBC
Vidar
Malware Config
C2 Extraction:
https://t.me/vmt001
85.209.135.109/jg94cVd30f/index.php
89.22.236.225:4193
176.124.205.5:4193
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0b219921-ffff-4ca6-b900-290d34f7f0ba
Unpacked files
SH256 hash:
1a896ea1a8a58615422cb10818d759befffb66c0cc8ebdf42c12bd1be0b63423
MD5 hash:
52f4f5082f42a5cc2d82a1054043db43
SHA1 hash:
38193856992dfd583be5aa5f25cf250b349cde00
Link:
https://www.unpac.me/results/467e81e8-c8c3-4bb3-8a5b-9bd6b1be24c4/
SH256 hash:
04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2
MD5 hash:
7d124bc23be85d73b1177143f41b5e72
SHA1 hash:
09633b90a0b993fd4dec6d522a1243433fc3ab10
Link:
https://www.unpac.me/results/467e81e8-c8c3-4bb3-8a5b-9bd6b1be24c4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/04805512d670/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 04805512d670fb5f37bdf17bf00aae6976650f82c0b4bd342f3506d204f7aea2

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2452298/
Cape
Cape
https://www.capesandbox.com/analysis/344651/

Comments


Avatar
zbet commented on 2022-12-09 09:37:22 UTC

url : hxxp://ripple-wells-2022.net/yzoyoebw6fqrey/iF3JduUnN5dx.exe