MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4
SHA3-384 hash: 139470f9b4ec33340b9a0d528129b4f61575412d845a306885dd0c23c5e8f529b97845eb70425ca92cc544497bde308d
SHA1 hash: 94dc0dceab0b93cf0e834f3e6905ddf4a7c0362f
MD5 hash: 2faf53df7832925ed6913f4044791953
humanhash: winter-high-mexico-crazy
File name:2faf53df7832925ed6913f4044791953.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:277'504 bytes
First seen:2022-02-04 08:29:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 186e4123ea2794f96f74a222cc19a4a9 (2 x Loki, 1 x Gozi, 1 x AZORult)
ssdeep 3072:WY6JlHjlDvvLYETNGiF3uJwy5SufTF7NkypU+NVlHaznV3udX6tJS7Uf:EzHpjvLJGiF3uouR7NBVAzFuwL
TLSH T18944CF117E90D432C4D212708429CBE44B7AF872D66485AB77A9FB3F7E703E0562637A
File icon (PE):PE icon
dhash icon 327e7c7f767e6e66 (4 x ArkeiStealer, 2 x RedLineStealer, 1 x Stop)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2faf53df7832925ed6913f4044791953.exe
Verdict:
Malicious activity
Analysis date:
2022-02-04 08:46:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3796b3fb-4e0e-4b12-b296-fba0e3ac4a17

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/232885/
Detection(s):
Win.Malware.Generic-9938273-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61fcea2e6d25ac9e7904b42a/reports/39afe2cb-601b-403a-8f78-c28e74574f85/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d473117b-7e59-4ab0-88d0-2c0cc2072d99
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/934308
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-02-04 08:30:13 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gx34se5yi5txpze5bdkmmkc4ji4qzlgy72ljqoiur5wo3tiuhlka._file
Result
Malware family:
arkei
Create hunting rule
Score:
  10/10
Tags:
family:arkei botnet:default discovery persistence spyware stealer
Link:
https://tria.ge/reports/220204-kd6srsfhfr/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Sets service image path in registry
Arkei Stealer Payload
Arkei
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://coin-file-file-19.com/tratata.php
Unpacked files
SH256 hash:
69ba4e2995d6b11bb319d7373d150560ea295c02773fe5aa9c729bfd2c334e1e
MD5 hash:
58922177676773ec3324c33734ae9ef9
SHA1 hash:
ce0a3cae8ee18c6d1f22361224b3692d61d5d7a2
Link:
https://www.unpac.me/results/aeb91278-367e-4b8f-9139-260a84a777b9/
SH256 hash:
35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4
MD5 hash:
2faf53df7832925ed6913f4044791953
SHA1 hash:
94dc0dceab0b93cf0e834f3e6905ddf4a7c0362f
Link:
https://www.unpac.me/results/aeb91278-367e-4b8f-9139-260a84a777b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/232885/
  
URLhaus
https://urlhaus.abuse.ch/url/1988764/
  
Delivery method
Distributed via web download

Comments