MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4
SHA3-384 hash: 81c41de51c88f62e6edffdd6743815aa56c7d9286e3ad46d4bde98c915182da5a1fa6d90eda9e7215b98cb6c967f8c79
SHA1 hash: 87bda30ca85ecf5706a93f89f2966a68adb9605b
MD5 hash: 0a5007c5f610bc2c0045ef7e6ce5849d
humanhash: indigo-fruit-twelve-yankee
File name:0a5007c5f610bc2c0045ef7e6ce5849d.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:226'304 bytes
First seen:2022-10-25 02:15:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a2a488c1ba888cbce9fc8f3bca83fd16 (9 x RedLineStealer, 7 x ArkeiStealer, 4 x Tofsee)
ssdeep 3072:+Un65dHsTQm7uvL7/ws6d536ll/9ua9aOpY/JvHf3sH+QlZ:+U6zrL8s90OpY/xHf3V
Threatray 673 similar samples on MalwareBazaar
TLSH T17024CF2236C0C8B2E22712759D55DAB45ABFB8341A359AAB7BC8136C4F343D2DF35306
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9a9acafecee6eaee (53 x Smoke Loader, 24 x Amadey, 14 x RedLineStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://78.47.204.168/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://78.47.204.168/ https://threatfox.abuse.ch/ioc/891320/

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0a5007c5f610bc2c0045ef7e6ce5849d.exe
Verdict:
No threats detected
Analysis date:
2022-10-25 02:18:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/168285cc-b1c8-4cb8-88aa-6874b50a7a3b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/323735/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.5588.18861.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Reading critical registry keys
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c310a365-a200-4125-ad4e-da69bc543f9d
Result
Threat name:
DanaBot, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097165
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 729806 Sample: xLZcepb8GE.exe Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 45 gayworld.at 2->45 47 t.me 2->47 49 serotyw.site 2->49 51 Snort IDS alert for network traffic 2->51 53 Multi AV Scanner detection for domain / URL 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 9 other signatures 2->57 10 xLZcepb8GE.exe 2->10         started        13 cahciaf 2->13         started        15 B0CC.exe 2->15         started        signatures3 process4 signatures5 71 Detected unpacking (changes PE section rights) 10->71 73 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->73 75 Maps a DLL or memory area into another process 10->75 17 explorer.exe 6 10->17 injected 77 Machine Learning detection for dropped file 13->77 79 Checks if the current machine is a virtual machine (disk enumeration) 13->79 81 Creates a thread in another existing process (thread injection) 13->81 process6 dnsIp7 39 thepokeway.nl 5.135.247.111, 443, 49727 OVHFR France 17->39 41 gayworld.at 211.171.233.129, 49703, 49704, 49705 LGDACOMLGDACOMCorporationKR Korea Republic of 17->41 43 6 other IPs or domains 17->43 31 C:\Users\user\AppData\Roaming\cahciaf, PE32 17->31 dropped 33 C:\Users\user\AppData\Local\Temp\B0CC.exe, PE32 17->33 dropped 35 C:\Users\user\AppData\Local\Temp\769.exe, PE32 17->35 dropped 37 3 other malicious files 17->37 dropped 59 System process connects to network (likely due to code injection or exploit) 17->59 61 Benign windows process drops PE files 17->61 63 Deletes itself after installation 17->63 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->65 22 1BA0.exe 17->22         started        25 B0CC.exe 17->25         started        file8 signatures9 process10 signatures11 67 Multi AV Scanner detection for dropped file 22->67 69 Machine Learning detection for dropped file 22->69 27 7za.exe 1 22->27         started        process12 process13 29 conhost.exe 27->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-10-25 03:13:04 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
33 of 41 (80.49%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jghngcvqxdj2cn4mduqjmcm42sknovb5q67dtshsa4ja4yi3vpca._file
Verdict:
malicious
Similar samples:
0629427415d61b098e8145081faeba2026d16aca3858dd873b48b2ae71ec8dba
ArkeiStealer
45856e2198031b795bf02bb06ed8a38bbc03e7432a9c978685f3852eb2fcd223
ArkeiStealer
4edf038c49138517002ecc7e8e76b92f68ba97a6c5c665a3b1eddf9bdd79bb96
ArkeiStealer
5698d1085a1623993f14c1863bb59ea6f7b664afb1e0b9cc79c53c36b91815ba
ArkeiStealer
644ecdd263538e3f6da1689a78b77101dd86451afb376e785b33d1e7c9cd6f82
ArkeiStealer
67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
ArkeiStealer
7f57547f6b8deecb741ab99ee18acad723df2e2765c5523a30738dd8019b311d
ArkeiStealer
a756e5252d0e0f34e1da494e60d65a3e3c17497101e0800110f59d443ca420dd
ArkeiStealer
b1d61dc75046c0eb1c4418131fac2c8710248cbdd001dbd7b0df6d39a4d5bfb8
ArkeiStealer
dec8ff627523eedf33698a21a9177cbdd11c61c2da9da45f0ef549096fd7a210
ArkeiStealer
+ 663 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:danabot family:smokeloader family:vidar botnet:937 backdoor banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/221025-cp5e3sbcgj/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Danabot
Detects Smokeloader packer
SmokeLoader
Vidar
Malware Config
C2 Extraction:
https://t.me/slivetalks
https://c.im/@xinibin420
Unpacked files
SH256 hash:
7a68135c35a476c25bf3b1a0a8eba83b8d2a1b1cf62fa09ed837cdb1bf570455
MD5 hash:
4a9dc069af235d03ec5aaa2b6293b56a
SHA1 hash:
2d1dcdc8146cf01a56b154a54616c263f0e84bdd
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/40570761-2d67-4133-90c4-59c225bb1634/
Parent samples :
3ff3bd0a125b24b53520ec9ccc0e16d9e0950600ba527754fd194fb1d6a8d099
81e077a7be1719d015dac668d244e423639aab2481ab4dc85965ed3e9149e4f9
7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33
71cb880a73d0cb7eb933a93be2b6bb9ee394a2cda1f0f5e882d5bfc83f4e0609
1d3f37d2989eed7acee995c28e8cb9010ef54c45a4ccf84be54d036388a24ab5
a2bc5e03ed38aaafe284d8b29d896ae2708ca03fc2c732bb986bf50411b08f0a
5d15f594dee648ecd97cc2fbc66ee349991ec6ebd040f49439be2ac81f792fa8
67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4
7f18e1325f88bd8421a03d3d88ad25e2c9e6ff80e39e97efaa7f4d372b3be4dd
4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41
SH256 hash:
498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4
MD5 hash:
0a5007c5f610bc2c0045ef7e6ce5849d
SHA1 hash:
87bda30ca85ecf5706a93f89f2966a68adb9605b
Link:
https://www.unpac.me/results/40570761-2d67-4133-90c4-59c225bb1634/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/498ed30ab0b8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2365784/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/323735/

Comments