MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19de7b0f27bd7c3f2e3881ae20ff9efaa73a1c676b611c2111422ef10c325477. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	19de7b0f27bd7c3f2e3881ae20ff9efaa73a1c676b611c2111422ef10c325477
SHA3-384 hash:	d28a28babfc44908650efc26e9497e0ab06e3650d4f3aa2742426eec32948af662de29b5554713e3081a0adcf08428d4
SHA1 hash:	a4bca9afdfc703766cd24648f5d54ffba234767d
MD5 hash:	bd6ca935384d94f516196cda365a55c6
humanhash:	jig-mango-speaker-monkey
File name:	bd6ca935384d94f516196cda365a55c6.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	673'280 bytes
First seen:	2021-09-21 13:22:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	019bced73b51911db702af2d47c34cb7 (6 x RaccoonStealer, 2 x ArkeiStealer, 2 x Stop)
ssdeep	12288:q9Uln8P7OHIrj/ySPnpFWCA+66/zOrnn7E4fuLbrXH8bTWeKgPp3+72AWVBai:q6l8P7Oo///GCA+6Iu7E4fuPrH8gMpS0
Threatray	166 similar samples on MalwareBazaar
TLSH	T1F4E4122131A0C776C96F01358318E6E05E6BBD62666483772787AB9FDF30361BE5234E
File icon (PE):
dhash icon	327e7c7d727e6e72 (1 x Smoke Loader, 1 x RaccoonStealer, 1 x ArkeiStealer)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

207

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

bd6ca935384d94f516196cda365a55c6.exe

Verdict:

Malicious activity

Analysis date:

2021-09-21 13:25:42 UTC

Tags:

installer

Link:

https://app.any.run/tasks/bcbd556d-d62a-4d60-a711-5da207593603

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/189879/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.3717.25186.UNOFFICIAL

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b5dbfe52-8552-4e10-b009-a371604bfc87

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/855005

Signature

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19de7b0f27bd7c3f2e3881ae20ff9efaa73a1c676b611c2111422ef10c325477/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2021-09-21 13:23:08 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dhphwdzhxv6d6lryqgxcb7467kttuhdhnnqryiiriixpcdbskr3q._file

Verdict:

malicious

ArkeiStealer

7b603dd82cb87eca59e93b2cd9c0eb8e613339097b23ac07daa9220a2eb4a7b4

ArkeiStealer

8470a13ce50314b24f998a31289fb7cd0a9c8e281c14b5f05ae4027554cfec2b

ArkeiStealer

a6a4ea6a622b43f7f7b866d147b70db495c7595ce85895c55e5a2b9fbf4291a2

ArkeiStealer

aa662c457cac9785e96f334d19a1eb5517b2ff1630aaadc81a7d62de8cbddabb

ArkeiStealer

bb5a82d435e5b35379d83d69c5c9ff7881b1963a8480b9b15193245927fd55f8

ArkeiStealer

c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a

ArkeiStealer

c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904

ArkeiStealer

d677f8738307640320bd09f609d9203e0d3bb924db4746a895829b253edcbead

ArkeiStealer

f1bb2d91c7594b776d0674a778c3208b73ef8caaf63427fb33c97481d783903b

ArkeiStealer

+ 156 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:1008 stealer

Link:

https://tria.ge/reports/210921-qmsv6ahfc9/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Vidar Stealer

Suspicious use of NtCreateProcessExOtherParentProcess

Vidar

Malware Config

C2 Extraction:

https://petrenko96.tumblr.com/

Unpacked files

SH256 hash:

afbced77762d814a12d80286c5744519541c4836a0c7464c6b4f9e166d474990

MD5 hash:

5cecd28e592ff348a9ac717a1e557a4f

SHA1 hash:

a82750b90b40eb6b583cb6bf97b8a02b8219f730

Link:

https://www.unpac.me/results/45178a89-ae1a-4b1b-b220-0d73b376e1f4/

SH256 hash:

19de7b0f27bd7c3f2e3881ae20ff9efaa73a1c676b611c2111422ef10c325477

MD5 hash:

bd6ca935384d94f516196cda365a55c6

SHA1 hash:

a4bca9afdfc703766cd24648f5d54ffba234767d

Link:

https://www.unpac.me/results/45178a89-ae1a-4b1b-b220-0d73b376e1f4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/19de7b0f27bd7c3f2e3881ae20ff9efaa73a1c676b611c2111422ef10c325477

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks