MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 499656d285442a548d0f0356a414b5c50b7bd7815db52e845cf8729cd4bcc9bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments 1

SHA256 hash:	499656d285442a548d0f0356a414b5c50b7bd7815db52e845cf8729cd4bcc9bc
SHA3-384 hash:	669c4cc9128c06129607e5602356acb0e5ce7511a126b0afb2e3e35e08216749982a8d56b3e52688d862923e14ee25db
SHA1 hash:	9c4bc5d26f0932e2504ef092fadb6f04e068b346
MD5 hash:	ae69610987f7b56b918136a543ac4231
humanhash:	two-blossom-indigo-grey
File name:	ae69610987f7b56b918136a543ac4231
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	291'328 bytes
First seen:	2022-03-23 11:58:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bc433f6843a10e776cec26e35404bcd3 (4 x Stop, 2 x ArkeiStealer)
ssdeep	6144:5CNRsWWq8bcLtC4FqqWgKdNDH13roYMuu44hOi/qv/:MMWWq+cLtCdV9RtJ9u44h0/
Threatray	4'080 similar samples on MalwareBazaar
TLSH	T1EE54AE00BBA0C035E5B752F4497A83ACB93E7EB15B2494CB62D55BEA16346E0EC3135F
File icon (PE):
dhash icon	b6dacabecee6baa6 (72 x Stop, 68 x RedLineStealer, 55 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/256345/

Detection(s):

Win.Dropper.Generickdz-9939781-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/10875/overview

Behaviour

MalwareBazaar

SystemUptime

CPUID_Instruction

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/623b0bc7dfdfa8501cd2d884/reports/919afc5f-18a7-4a68-b718-8c838ceb38bd/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/963393

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Possible FUD Crypter (malicious underground PE packer) detected

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/499656d285442a548d0f0356a414b5c50b7bd7815db52e845cf8729cd4bcc9bc/

Threat name:

Win32.Trojan.GenSteal

Status:

Malicious

First seen:

2022-03-23 11:59:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Verdict:

malicious

ArkeiStealer

3a2a1eff040a79d603b1ac2609a423ad8beb46d2876aa959f60dc98477707c0f

ArkeiStealer

5aefbefef1a5a2ee938f4d9c7705b6e38b375b858d21dae1efc137f36b29751d

ArkeiStealer

63fed261af5fb2e1eb439256eba9b6f96bbb9e2ee97c7f8211c5f60992f5a7e0

ArkeiStealer

6b18a223ce8f1f42880a54809880cd5c3a6890955d2469b10ea771dab333871e

ArkeiStealer

7022a16d455a3ad78d0bbeeb2793cb35e48822c3a0a8d9eaa326ffc91dd9e625

ArkeiStealer

7f19bc8eb8f0555986de478bc9a17a8e052f4a9262b0a19b924d8e9c66a01ca7

ArkeiStealer

de147d635d7404111032d34845dd05eddc00ae6ecf0814d89eed3c6a81c06629

ArkeiStealer

e3cf84cf7f8d85d334d107e4fda6a98b021a8d004ef88708957629d0f10be5fe

ArkeiStealer

+ 4'070 additional samples on MalwareBazaar

Result

Malware family:

arkei

Score:

10/10

Tags:

family:arkei botnet:default stealer

Link:

https://tria.ge/reports/220323-n5tjasdde8/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Arkei

Malware Config

C2 Extraction:

http://cheapa.link/4874185.php

Unpacked files

SH256 hash:

10879498aaf173229244d08e53cb3d31586061b7d97fb0a6ab1fbac7e74acb1a

MD5 hash:

bc990388a6c4d86a3be84dc3ad944ba4

SHA1 hash:

66c3686c7585771d6632e169b153a7559e986d66

Link:

https://www.unpac.me/results/a933b831-1bc5-4bf7-8eae-30cb481ef041/

SH256 hash:

499656d285442a548d0f0356a414b5c50b7bd7815db52e845cf8729cd4bcc9bc

MD5 hash:

ae69610987f7b56b918136a543ac4231

SHA1 hash:

9c4bc5d26f0932e2504ef092fadb6f04e068b346

Link:

https://www.unpac.me/results/a933b831-1bc5-4bf7-8eae-30cb481ef041/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/499656d285442a548d0f0356a414b5c50b7bd7815db52e845cf8729cd4bcc9bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.