MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059
SHA3-384 hash: 947f22b0c63448f505b13049712a2736afd8074c083f7652d3a05c681c5cd59c1114fb621e516b5b06d4cc78574b9265
SHA1 hash: 38a918f0fe0fb312403dff2cac94e646848dc8b0
MD5 hash: 3124bed68bba6ffae57e420379d871b6
humanhash: xray-twenty-nineteen-pluto
File name:3124bed68bba6ffae57e420379d871b6.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:17'920 bytes
First seen:2021-10-12 12:06:08 UTC
Last seen:2021-10-12 14:57:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 192:A97XrySozm8JWQmGujPu22psSvRbIHG6GP2pJLVS:AxXrySmBJU626xIHG6GP2pJLV
Threatray 543 similar samples on MalwareBazaar
TLSH T1EC824195A787C132E9614A32DCA3A6F40678BE03ED5F952FCAE53F1F38711680653A70
File icon (PE):PE icon
dhash icon 0f082b332b33332b (1 x ArkeiStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3124bed68bba6ffae57e420379d871b6.exe
Verdict:
Malicious activity
Analysis date:
2021-10-12 20:58:09 UTC
Tags:
opendir stealer loader
Link:
https://app.any.run/tasks/efa7c88d-88d1-4286-b5ce-e1fbd79bfb2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196925/
Detection(s):
SecuriteInfo.com.Variant.Bulz.789301.22005.31796.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
obfuscated remcos
Link:
https://www.filescan.io/uploads/61657a6a1c2d58ba74031e86/reports/f6069db0-a417-4685-8214-0094b3536108/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ad92bbf-a2b9-4bb5-b3c4-3d2a99ed9534
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/868621
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 501045 Sample: TxEjwXD8eb.exe Startdate: 12/10/2021 Architecture: WINDOWS Score: 100 42 Found malware configuration 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected Vidar stealer 2->46 48 3 other signatures 2->48 8 TxEjwXD8eb.exe 15 5 2->8         started        process3 dnsIp4 38 store2.gofile.io 31.14.69.10, 443, 49756 LINKER-ASFR Virgin Islands (BRITISH) 8->38 28 C:\Users\user\AppData\...\TxEjwXD8eb.exe, PE32 8->28 dropped 30 C:\Users\...\TxEjwXD8eb.exe:Zone.Identifier, ASCII 8->30 dropped 32 C:\Users\user\AppData\...\TxEjwXD8eb.exe.log, ASCII 8->32 dropped 50 Writes to foreign memory regions 8->50 52 Allocates memory in foreign processes 8->52 54 Injects a PE file into a foreign processes 8->54 13 TxEjwXD8eb.exe 127 8->13         started        18 TxEjwXD8eb.exe 8->18         started        20 TxEjwXD8eb.exe 8->20         started        file5 signatures6 process7 dnsIp8 40 136.144.41.229, 49769, 80 WORLDSTREAMNL Netherlands 13->40 34 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 13->34 dropped 36 C:\ProgramData\sqlite3.dll, PE32 13->36 dropped 56 Self deletion via cmd delete 13->56 58 Tries to harvest and steal browser information (history, passwords, etc) 13->58 60 Tries to steal Crypto Currency Wallets 13->60 22 cmd.exe 1 13->22         started        62 Machine Learning detection for dropped file 18->62 file9 signatures10 process11 process12 24 conhost.exe 22->24         started        26 timeout.exe 1 22->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-10-12 11:39:53 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2e14b592904e292539d9fc9d57a06df31676d5645ebaa49ebe129044d2d3baa3
ArkeiStealer
5a2eff9610a0bdc09557cd54e9ad7e5b93b930359a8e322fb479ab7b1e20cf7d
ArkeiStealer
5ea70d1ccacc9fde5a0f1cf02273de35c8db3fdcf6ec8d5da788fed041a742ac
ArkeiStealer
66a4ad6ad86ac5cc502368cdd94be1164da5fb4da4b2c2048a09c1c37b175f40
ArkeiStealer
70d2439d21209fcc393ca4989fbe1d5966c651345ad9b38bab512dbe9861e2bb
ArkeiStealer
71afc45f296c232c605e7e18e5303e59efefedc94f3a3c47c6e91ca46d586ce7
ArkeiStealer
8104ca049d63de80339bf38af00601a25405fcc84a7a1df39001d21f1c71f8eb
ArkeiStealer
b3c5e8250ec320fd546df876a5be7ca4e9a70696dc2373ce5ff670def95d5238
ArkeiStealer
b944023d535bc8e5980173e203cee0d2fc2df9e865b4a06fc0694436ce5b6541
ArkeiStealer
ccbded51600db440d54831ff724cf0e988220da4cd069244ade361c959b8c852
ArkeiStealer
+ 533 additional samples on MalwareBazaar
Result
Malware family:
arkei
Create hunting rule
Score:
  10/10
Tags:
family:arkei spyware stealer
Link:
https://tria.ge/reports/211012-pabwfaccf8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Arkei Stealer Payload
Arkei
Unpacked files
SH256 hash:
551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059
MD5 hash:
3124bed68bba6ffae57e420379d871b6
SHA1 hash:
38a918f0fe0fb312403dff2cac94e646848dc8b0
Link:
https://www.unpac.me/results/ba5b0bf3-517d-42f3-a904-5ca8958aed9e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1670444/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196925/

Comments