MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439
SHA3-384 hash: 54286394be8f1976203ffaba7a145737d6ac6470dfa5d043d8f7803bdae7cef8b43d97a9553ba1ad605b1781a89118e1
SHA1 hash: aa30062eb5d63c15eab8db126b78a46e0583e3ba
MD5 hash: c01b4113dcc44ebf6e11fabe213ed4e8
humanhash: avocado-solar-fourteen-missouri
File name:c01b4113dcc44ebf6e11fabe213ed4e8.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:752'128 bytes
First seen:2021-12-14 06:50:56 UTC
Last seen:2021-12-14 09:12:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2f9c37997e4f6c022f6907755dbb312e (15 x RedLineStealer, 1 x ArkeiStealer)
ssdeep 12288:NyWMyGC0xITXzl7pg3JjDH4yBp2Te051y9gyqvIL4d27fd:NyKGCcEXxpGJj0SYenCd3dE
Threatray 3'533 similar samples on MalwareBazaar
TLSH T176F4F110B7B0C034F5F316B81A7A93BDA52FBAA26B7891CB52D156EA0B346D1DC31347
File icon (PE):PE icon
dhash icon badacaaecee6baa6 (16 x Stop, 10 x RedLineStealer, 8 x Smoke Loader)
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://159.69.92.223/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://159.69.92.223/ https://threatfox.abuse.ch/ioc/275517/

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c01b4113dcc44ebf6e11fabe213ed4e8.exe
Verdict:
Malicious activity
Analysis date:
2021-12-14 06:54:47 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/8c1ee688-2088-4808-ba80-71521a1d04fa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/213829/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.15303.4786.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Delayed writing of the file
Creating a window
Sending a UDP request
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Stealing user critical data
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Forced shutdown of a browser
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/1889/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61b83ed847bb875c085c7aba/reports/d355b305-7321-4152-a64e-366f0902b345/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aa2c7c50-889d-4bac-a42c-ed0b25313da3
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/906884
Signature
Antivirus detection for URL or domain
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
vidar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439/
Threat name:
Win32.Trojan.ArkeiStealer
Create hunting rule
Status:
Malicious
First seen:
2021-12-14 06:51:10 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kxhz74m54s7t3kz5ad3bsykvqm7ouoxw25h6sjamtlwdzwtpiq4q._file
Verdict:
malicious
Similar samples:
0cdd906491990c6ba9c24bdd60172057587859a8e649ba7f4b51fece9a0fdac6
ArkeiStealer
15faaeed646173dd72e040e10f873ee1a16217ce0f322abe8de7cc4a32324654
ArkeiStealer
162ab00c0e943f9548b04f3437867508656480585369cb705613dd3accfd54c2
ArkeiStealer
3d70b9871f56942f3f1a9e57226dcc178fdb8d715a919a0689ca715d85ac40ad
ArkeiStealer
52a4ad8395e49789fa987b56b1881fe6093e91f8d5e34b9598e9e7b98cabd570
ArkeiStealer
6abcfcf5d46cf092d6c11e874ab9211c37511c825af9990b79fa38e8c2a3c1b0
ArkeiStealer
836e9de6ff5057a4964402ed5a9695e270a7db9e0d8b756a99203befa70fc4b7
ArkeiStealer
+ 3'523 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:874 discovery spyware stealer suricata
Link:
https://tria.ge/reports/211214-hmg5nagcfj/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
Malware Config
C2 Extraction:
https://noc.social/@sergeev46
https://c.im/@sergeev47
Unpacked files
SH256 hash:
21c701d0778115abf0080fddf7feb5f3c6e8f4a124d677fa676642dd062ab04f
MD5 hash:
b8636f20ab8b453fbef7ea12eab2e687
SHA1 hash:
14e2e4a07924ae6ca5a9913bb0f9ab22decb807f
Link:
https://www.unpac.me/results/5f3dcb39-a051-452e-bac3-7f4fb28d7d28/
SH256 hash:
55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439
MD5 hash:
c01b4113dcc44ebf6e11fabe213ed4e8
SHA1 hash:
aa30062eb5d63c15eab8db126b78a46e0583e3ba
Link:
https://www.unpac.me/results/5f3dcb39-a051-452e-bac3-7f4fb28d7d28/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 55cf9ff19de4bf3dab3d00f6196155833eea3af6d74fe9240c9aec3cda6f4439

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1768192/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/213829/

Comments