MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c
SHA3-384 hash: 5cf8f94f82c1abc37fad7b03f2b363bfb29ca8595cf12180e6ead78e4759f9192a38444b6147ba58cbc1888507c3c359
SHA1 hash: f77c871f72f9329c0d2a2d1459198b66f1fb1f44
MD5 hash: ebdab561089965de92abfe5c3d2ac72c
humanhash: ink-yankee-fourteen-foxtrot
File name:ebdab561089965de92abfe5c3d2ac72c.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:651'776 bytes
First seen:2021-09-29 08:30:44 UTC
Last seen:2021-09-29 09:31:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1b0c9928ebc845bd66569c85cdb994cb (1 x ArkeiStealer, 1 x Formbook, 1 x Stop)
ssdeep 12288:Ntc67K/KCqXh7rPglTPB3w1tWMQIdAcPvdvp+NrJY7fsxCWI1g+:Ntc67KLK7rPglTJ3wFF+cPv+N7x9I1
Threatray 635 similar samples on MalwareBazaar
TLSH T147D41211B582C3F7C713007EA5288A9CE92D799CEFE977753B5922CF5B381A3B522205
File icon (PE):PE icon
dhash icon 4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://23.88.111.187/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://23.88.111.187/ https://threatfox.abuse.ch/ioc/227508/

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ebdab561089965de92abfe5c3d2ac72c.exe
Verdict:
Malicious activity
Analysis date:
2021-09-29 08:34:59 UTC
Tags:
trojan stealer vidar
Link:
https://app.any.run/tasks/290f2e3a-753e-4575-a90d-aa5463c57dbd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193056/
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.13681.13424.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/51a84384-df94-464a-90f0-9fcc36aec906
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/860676
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 08:31:05 UTC
AV detection:
20 of 45 (44.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bo4nkpuoohaqhgk5j6jrzpt3hxdjfsrixd3hjqkrlavtfy3dkkga._file
Verdict:
malicious
Similar samples:
3decf0329e1b897bb576210f182a3e9d1369613a117cb02d6e47ccaaa151c7b9
ArkeiStealer
43280785b563edd0d7af1fb1041f15fd311b610b63bbc794f76f52bb2e7c6794
ArkeiStealer
434a28e5e131dff29b239284643df2370d0f317d0a8621b682c26ec944d8889a
ArkeiStealer
65fc50d2de580eb94f18a7c6ce0e98080cc7174b4df77d5252ec4525e9ef3fad
ArkeiStealer
7be91219c070a7fc70784daa8e7de2af75fdfb23719fa277d8135e7c2aa3872b
ArkeiStealer
96458b37d93d0638e168dd2c880e2b34b08d448cd163d11fccf2d80a3d5be726
ArkeiStealer
b50c7130579836db25bf5264f66b21f4d182ec753ae19fb0a52b33f7ef36dfd4
ArkeiStealer
c5b20a9c143f3e6036a467b0805327997863738aae1de585c1a600fae122c11c
ArkeiStealer
c625e0872eb2819660ca4866d6baf587f81312e0cd99e5c1c5e22b009f2e2e7f
ArkeiStealer
f3880cc610096c5ce3a7407741d8679de5b4f163fe1df37a051cb6026afe56d3
ArkeiStealer
+ 625 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar stealer
Link:
https://tria.ge/reports/210929-kep7eaecb9/
Behaviour
Modifies system certificate store
Vidar Stealer
Vidar
Unpacked files
SH256 hash:
3a36485d09c10d881a8a5992c6f293b8239c4da81f3b31927581bbf17b964f9c
MD5 hash:
b55a872097578a66aef4edaddf9af33b
SHA1 hash:
9a05ed83a367e4cffe6de255a43fbafc80154abd
Link:
https://www.unpac.me/results/92c2a9b9-c1ba-4c5d-a364-e3603202afe8/
SH256 hash:
0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c
MD5 hash:
ebdab561089965de92abfe5c3d2ac72c
SHA1 hash:
f77c871f72f9329c0d2a2d1459198b66f1fb1f44
Link:
https://www.unpac.me/results/92c2a9b9-c1ba-4c5d-a364-e3603202afe8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0bb8d53e8e71/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 0bb8d53e8e71c103995d4f931cbe7b3dc692ca28b8f674c151582b32e363528c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1586513/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
Cape
Cape
https://www.capesandbox.com/analysis/193056/

Comments