MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c
SHA3-384 hash: b7138097fa65b758c14d2b25d95d65713e6bc5d82f53b97064ab063c3218d953306b6659052f2d7b7439884979ae73c4
SHA1 hash: 96a99cc3f60aaa86fd951eecdc22d0b6117ccbfa
MD5 hash: 753f316cffd68bd3c5161c8387a770b4
humanhash: mountain-queen-mike-emma
File name:753f316cffd68bd3c5161c8387a770b4.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:710'656 bytes
First seen:2021-02-16 18:53:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:FleNG/r9AP+CpkUoZUpgzMtv/ZAgEXF2/cpurmcYv2tasGHW:+k/ntRKpgotv/6Xl8AutasoW
Threatray 667 similar samples on MalwareBazaar
TLSH 67E402C2336C5F97E9BE67F26635200147F56C2B2A29E21EADD121DA14A2F01CF12F57
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://hanxlas.ac.ug/

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
azorult.bin
Verdict:
Malicious activity
Analysis date:
2021-02-17 01:49:27 UTC
Tags:
trojan rat azorult loader
Link:
https://app.any.run/tasks/b592c5b9-2bc2-476c-9453-f6a2388ae1c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117402/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
DNS request
Deleting a recently created file
Reading critical registry keys
Replacing files
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Connection attempt to an infection source
Stealing user critical data
Launching a tool to kill processes
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/609343
Signature
Binary contains a suspicious time stamp
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 353698 Sample: O2F83zdaKx.exe Startdate: 16/02/2021 Architecture: WINDOWS Score: 84 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected Vidar stealer 2->40 42 3 other signatures 2->42 8 O2F83zdaKx.exe 3 2->8         started        process3 file4 24 C:\Users\user\AppData\...\O2F83zdaKx.exe.log, ASCII 8->24 dropped 11 O2F83zdaKx.exe 188 8->11         started        16 O2F83zdaKx.exe 8->16         started        process5 dnsIp6 34 hanxlas.ac.ug 185.215.113.77, 49751, 80 WHOLESALECONNECTIONSNL Portugal 11->34 26 C:\ProgramData\vcruntime140.dll, PE32 11->26 dropped 28 C:\ProgramData\sqlite3.dll, PE32 11->28 dropped 30 C:\ProgramData\softokn3.dll, PE32 11->30 dropped 32 4 other files (none is malicious) 11->32 dropped 44 Tries to harvest and steal browser information (history, passwords, etc) 11->44 46 Tries to steal Crypto Currency Wallets 11->46 18 cmd.exe 1 11->18         started        file7 signatures8 process9 process10 20 taskkill.exe 1 18->20         started        22 conhost.exe 18->22         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 16:43:40 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d34alubxuptnkzt4l4etc3mfemosc7cffqdvt7iwztju65pdyiwa._file
Verdict:
malicious
Similar samples:
033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae
ArkeiStealer
7dd09a71615dc2a60ba9dd906aebcff010f8442f4db392e4feb88baa01f8c999
ArkeiStealer
a74793a39fe6c942643ceb7ec5640d92890dd34b49244582113b3161863c3409
ArkeiStealer
b7b5a82b1c9b3c2ffeedcc57b2bef35f61c7e93ec2d5ae784f667e4d8d534009
ArkeiStealer
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
ArkeiStealer
cb581d356a20e0845006197aed2cc99463a9759f3f8c6a6d0783a553c88fda1b
ArkeiStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
ArkeiStealer
d2c1530870532abdf2123652c9f97dc9de79dc8aabbb8cfd185b1011d6cdbb01
ArkeiStealer
d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e
ArkeiStealer
ff22d13021f2bd9af9ec6f70782562460c5ea710e1fbbaa50ba997294c506a7e
ArkeiStealer
+ 657 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware
Link:
https://tria.ge/reports/210216-szhrrh91wj/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Oski
Unpacked files
SH256 hash:
28f6f8918f525f035d5f52b7f308d2d53030d62739574d903abef5e9d4474f82
MD5 hash:
e0f42515d89634903ce4bb80f901ad21
SHA1 hash:
a2af14f8089328b7e2d02279082f1c4f3e728881
Link:
https://www.unpac.me/results/1f4a15c0-b4dd-4445-80a7-cb638bb39ae2/
SH256 hash:
2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788
MD5 hash:
987ce346069cf47535e5ac57265c7228
SHA1 hash:
d0085325ed78fcac6d1f605753237abd1c40db22
Link:
https://www.unpac.me/results/1f4a15c0-b4dd-4445-80a7-cb638bb39ae2/
SH256 hash:
d1af815b1fc2db7164b0ab408ff1db19074f1c38e9878fb49691f5ab92f28ad4
MD5 hash:
2041135f9ec3e332e08e1d04b9dfe3ae
SHA1 hash:
d3e16c230713bcef4d6d253b67807637253af737
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/1f4a15c0-b4dd-4445-80a7-cb638bb39ae2/
Parent samples :
780316d5248b75354fd95a49441813a7f59e7fe1126fd337bc378fcad603fab0
1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c
SH256 hash:
1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c
MD5 hash:
753f316cffd68bd3c5161c8387a770b4
SHA1 hash:
96a99cc3f60aaa86fd951eecdc22d0b6117ccbfa
Link:
https://www.unpac.me/results/1f4a15c0-b4dd-4445-80a7-cb638bb39ae2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar infostealer variants
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1013087/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117402/

Comments