MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13f8e88a6f37b999c12513887752d7a03637e32106ef4109e11a9a8f260ccfab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13f8e88a6f37b999c12513887752d7a03637e32106ef4109e11a9a8f260ccfab
SHA3-384 hash: 716f9d194f770422d27ba0ca1999b34c3f85341ef0e8837fe787d050da5f93518da0995928627200d8873ddbb9a01118
SHA1 hash: f005b4c43b8bfa0cca215a71c8ba40bf58ceae96
MD5 hash: 85d1e7916f9a1cb12a8f79e9e9f07ce9
humanhash: washington-crazy-illinois-nuts
File name:SecuriteInfo.com.Variant.Zusy.304733.12023.25695
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:478'208 bytes
First seen:2020-05-30 07:54:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e854be910b0d091778c15574f55ff76f (2 x RaccoonStealer, 2 x ArkeiStealer)
ssdeep 12288:hN2ftS6pmfLoEr1LGcKCNy8hi1znOp6DMtkaALKbs:spuLoS1LlKMi5Op6DMtNbs
Threatray 123 similar samples on MalwareBazaar
TLSH B1A412C173B08816C2018530F22591755BF97C79AF26B96E2A4F734A1FB1BF24A7D392
Reporter SecuriteInfoCom
Tags:ArkeiStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.304733.12023.25695.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Stopcrypt
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 17:40:39 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
273555200dbae170a7fc4f0cd5f7d3c9261c39f24e2d51d123534475d16c0e94
ArkeiStealer
30ee19d9f9b1e7c313c08903a1d5150461447f5fd989e82a982c1b6462698c4f
ArkeiStealer
341847d9c11face1487ab04072d6ddc5065a379011c6684e56e1f4fa8d8ab3f3
ArkeiStealer
399712e038d1abc2f9df1c4786f75f3778549068262a8e149837338b25779e82
ArkeiStealer
4b96e7d6b0214530843cb34525de5cbeee5bf2abb971f6a268d2c355cdfcc0cd
ArkeiStealer
7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91
ArkeiStealer
c1b06231624dd9cd446357211a63f8d27f2a7781123c0dff89f277f95e408192
ArkeiStealer
c9dec8504b18f5b1e418d6a19f757b030391d949d76d6b744144b107b5beddd8
ArkeiStealer
e846df33b958032e9fbf264a3dafe63969a6682c1d9232d727d2f7d16d12a418
ArkeiStealer
fcac1c6c86cda94817da16feb772744ab591e3d1192955b32b074034ea122bf1
ArkeiStealer
+ 113 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar stealer
Link:
https://tria.ge/reports/201109-6ytghm1zcj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Vidar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_vidar_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 13f8e88a6f37b999c12513887752d7a03637e32106ef4109e11a9a8f260ccfab

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/372396/
  
Delivery method
Distributed via web download

Comments