MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 10

Intelligence 10 IOCs 1 YARA 2 File information Comments

SHA256 hash:	5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98
SHA3-384 hash:	95cc8c9032388fae4df0c37a2966dedaba7622563335ee0737ca82cdfb11ea25c605e06247f2798cce65febc7eefba98
SHA1 hash:	033e80e2008f4f62d2716ce0473bb0d763d52277
MD5 hash:	9c3d4324a153c6438f48083bc333a962
humanhash:	cup-massachusetts-papa-river
File name:	9c3d4324a153c6438f48083bc333a962.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	261'120 bytes
First seen:	2022-10-03 12:10:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bd837f4e3a290baf0a388800378abc3f (4 x GCleaner, 3 x Smoke Loader, 2 x ArkeiStealer)
ssdeep	6144:4hZZz/5rxCxwMgnJzi6ECAybyf0YUyxE7qp17bg:4hjz/zUwMo5U0yx+qXfg
Threatray	549 similar samples on MalwareBazaar
TLSH	T1C3440112BA50C073CA1296B54C74CA567A3F75606BB5CA0F7BA91B2E4F302D19F3A347
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9a9acadecee6eaee (98 x Smoke Loader, 33 x RedLineStealer, 24 x ArkeiStealer)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

abuse_ch

ArkeiStealer C2:
http://23.88.115.141/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://23.88.115.141/	https://threatfox.abuse.ch/ioc/866186/

Intelligence

File Origin

# of uploads :

# of downloads :

286

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/316085/

Detection(s):

Win.Packed.Dropperx-9973281-0

Win.Packed.Dropperx-9973291-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/633ad15749c58ce767c5b56e/reports/1d1a467a-16ba-4642-8743-a2c6e85d155f/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/64d33545-9f0b-47dc-a219-47076f658f4e

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1082438

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2022-10-03 12:11:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=l3sx3bnedobfayegjluftajfh4ubjdivlbvf6ytu2vrn72xjh2ma._file

Verdict:

malicious

ArkeiStealer

0a696cdecabbeb02700dfec14eaa5b165d17267f311ef7ddbb7264caddc551a3

ArkeiStealer

4c41b180f87e9fce98f2da11d11ad01b228d900c8130e6d5c59ff1b3e2184f4e

ArkeiStealer

a1f9821ea237c4d2b3090849a13307d3f4c5ec7c88c8430cac54bd718a6eafb4

ArkeiStealer

dfd29461b16401b73544be8cdc5f594e6eb33e98f33c2809e62163aaf6ae72ec

ArkeiStealer

+ 539 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:517 discovery spyware stealer

Link:

https://tria.ge/reports/221003-pck7wsfabj/

Behaviour

Checks processor information in registry

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Vidar

Malware Config

C2 Extraction:

https://t.me/larsenup
https://ioc.exchange/@zebra54

Gathering data

Unpacked files

SH256 hash:

c3be4948a8ed2352e0a3b8517fea8483dec7e2c579289bee4692ae33ae7046a7

MD5 hash:

dda6c161a6b88fac43530e56c46102f0

SHA1 hash:

9a8456ccd84b6ff6d356913bf1224927698a2e72

Detections:

VidarStealer

win_vidar_auto

Link:

https://www.unpac.me/results/2becc9a4-b041-4dce-9c01-2cf1ef095fdc/

Parent samples :

5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98
389483bad05bfd837b27142afa8116da6e5a34b10be705cae8593b3b8be666be
c125b1d038a15ddb464e212d3ffdf22e9a148acc5c90639ce4f07957fbc8e1d6
5dd761dbc99ba7e46595a31facf46b2a2289815f2db21486959a2da57cc03700
b6add37e22b7b64a0938d0ee4e9a5066dfd067f3aee845581af3c55fc544feb9
a4e82173d8e32c531eae69b102915a4d9626222aa6a63b21f32589e3c814bd61
b20fa8f21254b18ddb0fc16c0775069559bba65a38f38e46f7b4d16914096590

SH256 hash:

5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98

MD5 hash:

9c3d4324a153c6438f48083bc333a962

SHA1 hash:

033e80e2008f4f62d2716ce0473bb0d763d52277

Link:

https://www.unpac.me/results/2becc9a4-b041-4dce-9c01-2cf1ef095fdc/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5ee57d85a41b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.