MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea15fabb1d0594c00ac541. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea15fabb1d0594c00ac541
SHA3-384 hash: e083c0eea7ef460c560ae88ea24866fb8535de299c55694ea74f17b146b2796db58d42b45e301c671c98499e1d29762f
SHA1 hash: 31f4a39da9b0f35b5c34754c3562cbab4b32ec6f
MD5 hash: cf384a9131bc5831f2e87dd8deba8918
humanhash: east-london-pip-lima
File name:4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea1.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'289'056 bytes
First seen:2022-08-30 19:55:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash abe189cbc71c03ee98ccf85981981dfe (6 x RedLineStealer, 3 x RecordBreaker, 2 x ArkeiStealer)
ssdeep 24576:GM5q9osQunZ+HNr2aDJxoi2I6WNMsOq66fGN4Vl:j5a+HNr2HigqOq+KV
TLSH T1C8558CF13884917EFDE210FA02ECBD22766DA570071149CB569522EEB6207DA3E33776
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://116.202.180.202/

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
arkei
Create hunting rule
ID:
1
File name:
4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea1.exe
Verdict:
Malicious activity
Analysis date:
2022-08-31 13:21:08 UTC
Tags:
stealer arkei
Link:
https://app.any.run/tasks/70174744-f609-41fe-8be7-d80e8458eb59

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/304444/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Searching for the window
Searching for many windows
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630e6cb02fdf5a082593b9d1/reports/eaaceea1-c0e0-4ec8-abef-b3a82415f6b5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c1b85644-0d31-482c-a481-9020b737eb34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea15fabb1d0594c00ac541/
Threat name:
Win32.Backdoor.Mokes
Create hunting rule
Status:
Malicious
First seen:
2022-08-30 19:56:22 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmf5xbemd4e32swuw2ogiqyf5jtye3eqwpvbl6v3duczjqakyvaq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220830-ynrngshee3/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
83388e4e3c7a7ccf2611f0db7a09c4eeb57fe98e4017257219a9a5c079bb75f7
MD5 hash:
cb219fec66898e1a59485ce6ee27b29d
SHA1 hash:
cb28b9c941790881a181005fe7ce5c5959135c7e
Detections:
win_vidar_auto
Create hunting rule
Link:
https://www.unpac.me/results/66f942a1-acab-4d39-a20d-0f3162023d9f/
Parent samples :
4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea15fabb1d0594c00ac541
a8f95b722754971c282d05eee5ed21ca8538a17b008f00b4515da5e58a4ee5e1
SH256 hash:
4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea15fabb1d0594c00ac541
MD5 hash:
cf384a9131bc5831f2e87dd8deba8918
SHA1 hash:
31f4a39da9b0f35b5c34754c3562cbab4b32ec6f
Link:
https://www.unpac.me/results/66f942a1-acab-4d39-a20d-0f3162023d9f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4b0bdb848c1f09bd4ad4b69c644305ea67826c90b3ea15fabb1d0594c00ac541

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/304444/

Comments