MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5389a958986f6ceccaa9e44006852becbccabfb07f126d69e6b031227fb0b487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ArkeiStealer
Vendor detections: 11
| SHA256 hash: | 5389a958986f6ceccaa9e44006852becbccabfb07f126d69e6b031227fb0b487 |
|---|---|
| SHA3-384 hash: | 1198b81ef6b14ea34125f1ffc9a7b339cf922bd2d98ebdb01b47a8ae408c1ef014353293aaf68345a85413390e232b9e |
| SHA1 hash: | 63f959b1df1e38137b14f5f14cb216b8c96dbd84 |
| MD5 hash: | 73b8f1ec16231a14550fc51007ad07d3 |
| humanhash: | helium-march-bacon-river |
| File name: | 73b8f1ec16231a14550fc51007ad07d3.exe |
| Download: | download sample |
| Signature | ArkeiStealer |
| File size: | 506'718 bytes |
| First seen: | 2021-02-15 07:16:33 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4d17be67c8d0394c5c1b8e725359ed89 (5 x Adware.Generic, 4 x njrat, 3 x NanoCore) |
| ssdeep | 12288:tozjuOV98Gvx2jn5CEyUFqSP5NDUGvbbm:tgjV98GvUj5C8F35N5jbm |
| Threatray | 395 similar samples on MalwareBazaar |
| TLSH | 97B4125E75A1FEA3E1940A31873647329B7B531F4C3A2A2EAB095E9B0D33143550FF26 |
| Reporter |  abuse_ch |
| Tags: | ArkeiStealer exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Enabling the 'hidden' option for files in the %temp% directory
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Deleting a recently created file
Reading critical registry keys
Replacing files
Creating a window
Delayed writing of the file
Running batch commands
Creating a process with a hidden window
Searching for the window
Sending a custom TCP request
Launching a process
Launching the process to change network settings
Moving a recently created file
Sending an HTTP GET request
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Stealing user critical data
Launching a tool to kill processes
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
StormKitty
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Binary contains a suspicious time stamp
Contains functionality to log keystrokes (.Net Source)
Downloads files with wrong headers with respect to MIME Content-Type
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
May check the online IP address of the machine
Modifies existing user documents (likely ransomware behavior)
Posts data to a JPG file (protocol mismatch)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Capture Wi-Fi password
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Yara detected StormKitty Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Phonzy
Status:
Malicious
First seen:
2021-02-15 07:17:09 UTC
AV detection:
29 of 47 (61.70%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 385 additional samples on MalwareBazaar
Result
Malware family:
oski
Score:
10/10
Tags:
family:oski discovery infostealer spyware
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops desktop.ini file(s)
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Oski
Unpacked files
SH256 hash:
c5da03f3da2bcd1503accffbced5d5df96b1de0611498e14efb5bf28e64c1e0d
MD5 hash:
1ddc502feb2d4d0e89e6657cf2268e3f
SHA1 hash:
a5c243149f724cc9b177cb7c044bdfc5feef3e45
SH256 hash:
73fbf9c783b7e3a941837995f1a5181eca114e8923d6cc7ffb362ea88a8d0ba3
MD5 hash:
35958a7d85fc88a18f931ee14e6ec531
SHA1 hash:
087fedd2ac4fe703da8ad32957998d1dffcb728b
Detections:
win_oski_g0
win_oski_auto
SH256 hash:
a56508a041a5b5870578d9f5a1db6ec7186a74a50b391bd6506e9b62022bdf2e
MD5 hash:
198d38f9365499a5b3d62682b6c5afec
SHA1 hash:
cdeb1cbfafdeef9749f5994608f454e04ce6e6b3
SH256 hash:
00818933dfd4df43baffa3a119db981848415ca60a5e9e34184da64001fa72da
MD5 hash:
76b03c5fb5f3ac357211d0cee3e72291
SHA1 hash:
8a4d0384fe6db8a4e7186ed5ad9215edb09365da
SH256 hash:
fc58db92b69fc17bbce2c1dccdfa5bffa3abeadf6b6b188ed0f930ea3d3e637b
MD5 hash:
8dc06e7ad18391c1390fdea6891ea7db
SHA1 hash:
185f9e991544115a65d729f12a68deeccc442bd3
SH256 hash:
1bfcc26faa8e2c5e1531deb2767abc1984c9f51203e4f6e7b372ddf65a7ce944
MD5 hash:
52eb411af234ca95f7e9e31cbe6a7b18
SHA1 hash:
2de63a4940149e64a9a9f71e58f3c6f528185138
SH256 hash:
5389a958986f6ceccaa9e44006852becbccabfb07f126d69e6b031227fb0b487
MD5 hash:
73b8f1ec16231a14550fc51007ad07d3
SHA1 hash:
63f959b1df1e38137b14f5f14cb216b8c96dbd84
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.