MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933
SHA3-384 hash: f32b260215bb890402c29726c8745b865f913f617276b7b7902b98e50fe66df781dc4a02b6d7fcc4b55dffb33e2752da
SHA1 hash: 5c432aeea9fa2529a5fe519160e0d9351c8e158c
MD5 hash: 8e1c560fdec1a1918c062d33118980d2
humanhash: moon-fifteen-nine-montana
File name:8e1c560fdec1a1918c062d33118980d2.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:676'352 bytes
First seen:2021-10-07 09:01:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 51f224c09b57224d474ba4b21025bdd0 (5 x RaccoonStealer, 4 x ArkeiStealer, 2 x DanaBot)
ssdeep 12288:4D+mGTC6hLOmtzXDqIRnX+QW1l1dxlmPZRGw6Sop:4Dz6OmtKIX+b1lVlo6w
Threatray 3'158 similar samples on MalwareBazaar
TLSH T11BE402717AD0C033E7B31A704971CAB1967BB8720A31928F2BD4167E9F762D1CA6531E
File icon (PE):PE icon
dhash icon a3bcdcac9cccb484 (5 x RaccoonStealer, 4 x RedLineStealer, 4 x ArkeiStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8e1c560fdec1a1918c062d33118980d2.exe
Verdict:
Malicious activity
Analysis date:
2021-10-07 09:18:51 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/feaeda03-c2c0-4638-a207-b4245fefc04f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/195755/
Detection(s):
Win.Malware.Generic-9899898-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/866182
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 09:02:11 UTC
AV detection:
23 of 45 (51.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h2trcxo322gmptpdtpgqzwcqx7shxawtcoxb35lmtmxctxautezq._file
Verdict:
malicious
Similar samples:
3f9632d938647c95eeb79ad82576667f2f3e0110daf368b28159d23e30b20f5d
ArkeiStealer
5cdade4f7abf84af2fab04c925456f616a170751bde63e4c1ce5f5bd7c47762d
ArkeiStealer
6d9395d7caa10c9535aaebf44a6f5a59d6f096ab88bd671db4e55efe69e8f639
ArkeiStealer
71247faf517e2d421cda99741856f21bc1eec72ac6e6ae4aa8a5ca5e5b7e7db4
ArkeiStealer
904c5e2719ea54377d1cc10d28fbf7e99dab11df5c143033d4c9b01b3bc8ee81
ArkeiStealer
938e2b2ee7af3e3dcb1e21f7dfb426f5bde3d715802d3b4bf07119f65c1e0fe6
ArkeiStealer
b044b5fc07f51f91be8fc7b7cc7fd9ce6595ea238951f94410eec6d364d75d59
ArkeiStealer
b9d7a6b2cf9c35cd2aa3b75732e1f1f77e7fc8ed36a7c40a8cd3382b9232d08b
ArkeiStealer
dfffd05bea8aa9f0d2e10dfe06276734ff17522ad3e374f752301c686965a379
ArkeiStealer
e0f882ee034b004232619679b022684ae62e61970b99945b1b01ba65099a1ae1
ArkeiStealer
+ 3'148 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery spyware stealer
Link:
https://tria.ge/reports/211007-kzg2jacba7/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
Unpacked files
SH256 hash:
c6320d7467927e78c205fdca10484c14e53730bddd3958d93e11263e7871536e
MD5 hash:
ce26ceb3191ffa06f2d2879349b77140
SHA1 hash:
8d74d2b1ce1708c5bdcb8462b6c4f04ba2faefb4
Link:
https://www.unpac.me/results/40c80fad-e668-4883-be20-ae96ae424182/
SH256 hash:
3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933
MD5 hash:
8e1c560fdec1a1918c062d33118980d2
SHA1 hash:
5c432aeea9fa2529a5fe519160e0d9351c8e158c
Link:
https://www.unpac.me/results/40c80fad-e668-4883-be20-ae96ae424182/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3ea7115ddbd6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1586513/
Cape
Cape
https://www.capesandbox.com/analysis/195755/

Comments