MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea
SHA3-384 hash: 88bb54af0c9efd5cafac882568fe0b33b3ee5d712f317146c95913a541e687a401d2e214adfa45e9331b28c930a966c1
SHA1 hash: 9e894362c1be77eae233fbe20d9be5b7e4d095b3
MD5 hash: 8322e07c26f7c6e100e5b2be34080db4
humanhash: bakerloo-solar-timing-single
File name:8322e07c26f7c6e100e5b2be34080db4.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'970'592 bytes
First seen:2022-11-14 19:10:24 UTC
Last seen:2022-11-14 20:44:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a474abaebc5d0adef07154b9e44ae03b (1 x lgoogLoader, 1 x ArkeiStealer)
ssdeep 49152:SxwfjEfKpxnL0IDkgRI2AdPLNz3rfDBFN1s0mL3X:sA9p9lhRb6F7LBFY
TLSH T12595F103A693899CCAFC343149C8491F0B2B15D9F75C25CDE6D9A70A68B1BDC0B95B2F
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 929280a2a280a242 (1 x ArkeiStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe signed

Code Signing Certificate

Organisation:synthesis.com
Issuer:R3
Algorithm:sha256WithRSAEncryption
Valid from:2022-09-29T18:13:49Z
Valid to:2022-12-28T18:13:48Z
Serial number: 03e4cc02542459b73e5f191e4187d42b149c
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: f310c0f2c93ff4363fd437fa54fe6ca515a6e0357db8d00f7c4c94dbb83cc506
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
ArkeiStealer C2:
http://85.31.44.207/

Intelligence

File Origin
# of uploads :
2
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
8322e07c26f7c6e100e5b2be34080db4.exe
Verdict:
Malicious activity
Analysis date:
2022-11-14 19:13:27 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/d84b2a45-e526-47f7-bae2-805d7d1b35b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/333901/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.24378.146.18935.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Running batch commands
Creating a process with a hidden window
Launching a process
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed redline
Link:
https://www.filescan.io/uploads/637292c77db879aacbce9f0e/reports/ebd609a2-2e32-468f-aeda-53d3f2acf06b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6f3c4124-2c42-4393-a0d5-003909a6d0b6
Result
Threat name:
SmokeLoader, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1113194
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd or bat file
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected SmokeLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 745888 Sample: d8eP6x1Gfn.exe Startdate: 14/11/2022 Architecture: WINDOWS Score: 100 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 Antivirus detection for dropped file 2->45 47 8 other signatures 2->47 7 d8eP6x1Gfn.exe 24 2->7         started        process3 dnsIp4 37 85.31.44.207, 49704, 80 CLOUDCOMPUTINGDE Germany 7->37 39 31.42.177.171, 49705, 80 YANINA-ASUA Ukraine 7->39 25 C:\Users\user\AppData\...\wevtutil[1].exe, PE32 7->25 dropped 27 C:\Users\user\AppData\Local\...\kurwa[1].exe, PE32 7->27 dropped 29 C:\ProgramData\32114717292771027532.exe, PE32 7->29 dropped 31 C:\ProgramData\21954926967849429297.exe, PE32 7->31 dropped 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 7->49 51 Self deletion via cmd or bat file 7->51 53 Tries to harvest and steal browser information (history, passwords, etc) 7->53 55 Tries to steal Crypto Currency Wallets 7->55 12 21954926967849429297.exe 2 7->12         started        16 32114717292771027532.exe 1 7->16         started        19 cmd.exe 1 7->19         started        file5 signatures6 process7 dnsIp8 33 C:\Users\...\hiwolos febocisi moq kadi.exe, PE32 12->33 dropped 57 Query firmware table information (likely to detect VMs) 12->57 59 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->59 61 Machine Learning detection for dropped file 12->61 35 192.168.2.1 unknown unknown 16->35 63 Antivirus detection for dropped file 16->63 65 Hides threads from debuggers 16->65 67 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->67 21 conhost.exe 19->21         started        23 timeout.exe 1 19->23         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea/
Threat name:
Win32.Infostealer.Bandra
Create hunting rule
Status:
Malicious
First seen:
2022-11-12 00:37:18 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ijummkfsz7hwoag4ad2dur2l2d5hec2dacf4g2cggfctkqsshpva._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:1760 discovery spyware stealer
Link:
https://tria.ge/reports/221114-xvxmmsdb33/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Vidar
Malware Config
C2 Extraction:
https://t.me/dahakatv
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5489d064-b70e-4e16-bdb1-cbfa281bccf2
Unpacked files
SH256 hash:
22e01c64e516c74b010ffdba17c5bf91e468c5dcd8f442aaf15177e93522f8ed
MD5 hash:
84a72f2caec006bcefeb90964304ff5e
SHA1 hash:
3534c307c9380a75b73ca1419f4d35967c457d29
Link:
https://www.unpac.me/results/5b1a5a0d-e260-4ccb-8f1b-8f7786016204/
SH256 hash:
9ddf4a3531bae8dec4a4a330ee92c648f5fd0a989d925e1494cba8de2e920294
MD5 hash:
75717b4c9b9d85840e1e50f3b31ca290
SHA1 hash:
b2b757577311a98fb55e4f9847b64a209db91932
Link:
https://www.unpac.me/results/5b1a5a0d-e260-4ccb-8f1b-8f7786016204/
SH256 hash:
4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea
MD5 hash:
8322e07c26f7c6e100e5b2be34080db4
SHA1 hash:
9e894362c1be77eae233fbe20d9be5b7e4d095b3
Link:
https://www.unpac.me/results/5b1a5a0d-e260-4ccb-8f1b-8f7786016204/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Arkei Stealer
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4268c628b2cfcf6700dc00f43a474bd0fa720b43008bc3684631453542523bea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/333901/

Comments