MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf
SHA3-384 hash: 785365933fbea1fde85919a2da67b1d7beb3987baa4d3a6073c25d1918e104960e46b174bf551af2caf6822dfd3d6cac
SHA1 hash: a1844f9caf08a5bb69c8706c621e3694a9ea4fe7
MD5 hash: f237b02b626eeb01ec6d3d4828312799
humanhash: minnesota-alanine-twelve-connecticut
File name:f237b02b626eeb01ec6d3d4828312799.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:121'344 bytes
First seen:2021-04-09 15:45:27 UTC
Last seen:2021-04-09 16:51:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:Fx8X7oChjE0dZwh8dEzMSApf4sdr6JIJxBSE8oZvRQMELGPF:yHp4sdrOYSoD68
Threatray 122 similar samples on MalwareBazaar
TLSH 3DC37E18538D0937E469337D2C6B735DBAF0AB406539A52972DE1B2C2A933205B53BFC
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
34.91.253.186:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
34.91.253.186:80 https://threatfox.abuse.ch/ioc/7540/

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133417/
Detection(s):
SecuriteInfo.com.Adware.WizzMonetize.1.20052.7638.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Connecting to a non-recommended domain
Sending a custom TCP request
Creating a file
Creating a window
Launching a process
Sending a UDP request
Sending an HTTP GET request
Sending an HTTP POST request
Connection attempt
Unauthorized injection to a recently created process
Sending an HTTP GET request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25ec0636-58a4-4009-abc7-3b5f0bfb1222
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/671582
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 384737 Sample: 6BympvyPAv.exe Startdate: 09/04/2021 Architecture: WINDOWS Score: 72 62 www.google.ch 2->62 64 www.gearbest.com 2->64 66 24 other IPs or domains 2->66 96 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->96 98 Multi AV Scanner detection for submitted file 2->98 100 .NET source code contains potential unpacker 2->100 102 Machine Learning detection for sample 2->102 10 6BympvyPAv.exe 14 9 2->10         started        signatures3 process4 dnsIp5 68 greataccesstoserver.com 159.89.4.33, 49717, 80 DIGITALOCEAN-ASNUS United States 10->68 70 digitalassets.ams3.digitaloceanspaces.com 5.101.110.225, 443, 49718 DIGITALOCEAN-ASNUS Netherlands 10->70 72 192.168.2.1 unknown unknown 10->72 48 C:\Users\user\AppData\...\multitimer.exe, PE32 10->48 dropped 50 C:\Users\user\AppData\...\6BympvyPAv.exe.log, ASCII 10->50 dropped 52 C:\Users\user\AppData\Local\...\setups.exe, PE32 10->52 dropped 14 setups.exe 2 10->14         started        17 multitimer.exe 14 17 10->17         started        file6 process7 dnsIp8 54 C:\Users\user\AppData\Local\...\setups.tmp, PE32 14->54 dropped 21 setups.tmp 5 26 14->21         started        56 new.multitimer.fun 104.248.226.77, 443, 49720 DIGITALOCEAN-ASNUS United States 17->56 58 catser.inappapiurl.com 138.197.53.157, 443, 49719, 49721 DIGITALOCEAN-ASNUS United States 17->58 60 2 other IPs or domains 17->60 94 Multi AV Scanner detection for dropped file 17->94 24 multitimer.exe 17->24         started        file9 signatures10 process11 file12 40 C:\Users\user\AppData\Local\...\psvince.dll, PE32 21->40 dropped 42 C:\Users\user\AppData\...\itdownload.dll, PE32 21->42 dropped 44 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 21->44 dropped 46 2 other files (none is malicious) 21->46 dropped 26 iexplore.exe 7 189 21->26         started        29 iexplore.exe 21->29         started        process13 dnsIp14 74 www.gearbest.com 26->74 76 propeller-tracking.com 26->76 78 catser.inappapiurl.com 26->78 31 iexplore.exe 26->31         started        34 iexplore.exe 26->34         started        36 iexplore.exe 26->36         started        38 13 other processes 26->38 process15 dnsIp16 86 2 other IPs or domains 31->86 80 87.248.118.23, 443, 49904, 49905 YAHOO-DEBDE United Kingdom 34->80 88 22 other IPs or domains 34->88 82 spdc-global.pbp.gysm.yahoodns.net 212.82.100.181, 443, 49859, 49860 YAHOO-IRDGB United Kingdom 36->82 84 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49849, 49850 YAHOO-DEBDE United Kingdom 36->84 90 36 other IPs or domains 36->90 92 121 other IPs or domains 38->92
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf/
Threat name:
ByteCode-MSIL.Adware.CSDIMonetize
Create hunting rule
Status:
Malicious
First seen:
2021-04-09 15:11:46 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ej2ptbudau2bb4vuxfnz7upmaqo7z72crv3g6kuymgktqoad5sxq._file
Verdict:
malicious
Similar samples:
0cae975d5c602437ef781f39605c9a79fe0c0bca956bd4fecb21e17ace1c58ca
ArkeiStealer
0ed95818ba222ec8d2ae4fdaaed1b143d9faada09c27a6c8aaecb8aa5ceb270f
ArkeiStealer
28f1bd1e02427a817d05c69884c5d5ccf3455859a2f1c3a6dce5e6da75141bcd
ArkeiStealer
5440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
ArkeiStealer
5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5
ArkeiStealer
97db3a9f804cdc5a97cfc32fede3ce5f31ed7756be6d4749123e87967e810dc2
ArkeiStealer
a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
ArkeiStealer
b1adf30c5cb4c1a7c06e877308d0f0e32f6ea1b21105de5db7583a889d089373
ArkeiStealer
b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7
ArkeiStealer
e99107f51a615207824a28411b0355fba67cbda8dbd24d450a84cbe40aa8faf5
ArkeiStealer
+ 112 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:metasploit family:vidar backdoor discovery dropper evasion loader persistence spyware stealer trojan upx vmprotect
Link:
https://tria.ge/reports/210409-zrpplhdq9x/
Behaviour
Delays execution with timeout.exe
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Checks for any installed AV software in registry
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Maps connected drives based on registry
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
UPX packed file
VMProtect packed file
ACProtect 1.3x - 1.4x DLL software
Checks for common network interception software
Glupteba
Glupteba Payload
MetaSploit
Vidar
Malware Config
Dropper Extraction:
http://labsclub.com/welcome
Unpacked files
SH256 hash:
2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf
MD5 hash:
f237b02b626eeb01ec6d3d4828312799
SHA1 hash:
a1844f9caf08a5bb69c8706c621e3694a9ea4fe7
Link:
https://www.unpac.me/results/f2efa62f-b3e8-4916-8f64-4b00f52686e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Amonetize
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 2274f98683053410f2b4b95b9fd1ec041dfcff428d766f2a986195383803ecaf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104388/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133417/

Comments