MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60fc42abc7bf2776e7fc32f38fb7ad6cbca757911cfec91a874c6b12bc7f202f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60fc42abc7bf2776e7fc32f38fb7ad6cbca757911cfec91a874c6b12bc7f202f
SHA3-384 hash: 8431f07332947f7b3ada2dc2853ab31c91c16d8e12df0c231a7fb2f6af601ba8490697a737b1081ed1e4b9dfea4d9182
SHA1 hash: 820adea19fa2c21eff1ff88d20ce19588ccface7
MD5 hash: 8c1c9af22752dac6f96d0940e28d8020
humanhash: helium-cat-vermont-low
File name:60FC42ABC7BF2776E7FC32F38FB7AD6CBCA757911CFEC.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:507'392 bytes
First seen:2022-10-25 00:20:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f55fc0481fe939f858f6e3c9baf7b16 (12 x RedLineStealer, 1 x ArkeiStealer)
ssdeep 6144:AEQj7L9NgWLZ/ZaaIJA9elvRlhan9WyH4lfVkri5oXCQRGWWX6BuuTd2L5IyAOf+:ATt+C9GvHhan9WMCQ0pX6BLUCysW+
TLSH T1CEB4AE05F9B3C0F3D6A34AB1D57D932D213A76201B2248EB6BC019B85EA07D16971F7B
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://78.47.204.168/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://78.47.204.168/ https://threatfox.abuse.ch/ioc/891320/

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
60FC42ABC7BF2776E7FC32F38FB7AD6CBCA757911CFEC.exe
Verdict:
Malicious activity
Analysis date:
2022-10-25 00:22:26 UTC
Tags:
trojan rat redline loader stealer vidar
Link:
https://app.any.run/tasks/a28f4018-94d4-4cc5-b8a6-6b63cbbc1fe4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/323703/
Detection(s):
Win.Malware.Exploitx-9967939-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45195/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/effd7e19-18cc-47c9-a536-f45291364b64
Result
Threat name:
RedLine, Vidar, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097124
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Sigma detected: Stop multiple services
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 729765 Sample: 60FC42ABC7BF2776E7FC32F38FB... Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 101 clipper.guru 2->101 131 Snort IDS alert for network traffic 2->131 133 Malicious sample detected (through community Yara rule) 2->133 135 Antivirus detection for dropped file 2->135 137 12 other signatures 2->137 11 60FC42ABC7BF2776E7FC32F38FB7AD6CBCA757911CFEC.exe 1 2->11         started        14 svcupdater.exe 2->14         started        16 chrome.exe 2->16         started        18 chrome.exe 2->18         started        signatures3 process4 signatures5 157 Contains functionality to inject code into remote processes 11->157 159 Writes to foreign memory regions 11->159 161 Allocates memory in foreign processes 11->161 163 Injects a PE file into a foreign processes 11->163 20 AppLaunch.exe 15 11 11->20         started        25 WerFault.exe 23 9 11->25         started        27 conhost.exe 11->27         started        29 WerFault.exe 11->29         started        165 Multi AV Scanner detection for dropped file 14->165 167 Machine Learning detection for dropped file 14->167 process6 dnsIp7 103 77.73.133.19, 31892, 49700 AS43260TR Kazakhstan 20->103 105 adigitalshop.com 151.106.122.215, 443, 49714 PLUSSERVER-ASN1DE Germany 20->105 109 6 other IPs or domains 20->109 85 C:\Users\user\AppData\Local\Temp\fl.exe, PE32 20->85 dropped 87 C:\Users\user\AppData\Local\...\test.exe, PE32 20->87 dropped 89 C:\Users\user\AppData\Local\...\ofg.exe, PE32 20->89 dropped 91 2 other malicious files 20->91 dropped 139 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->139 141 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 20->141 143 Tries to harvest and steal browser information (history, passwords, etc) 20->143 145 Tries to steal Crypto Currency Wallets 20->145 31 chrome.exe 20->31         started        35 test.exe 20->35         started        37 fl.exe 20->37         started        39 2 other processes 20->39 107 192.168.2.1 unknown unknown 25->107 file8 signatures9 process10 file11 93 C:\WindowsbehaviorgraphoogleUpdate.exe, PE32 31->93 dropped 115 Multi AV Scanner detection for dropped file 31->115 117 Detected unpacking (changes PE section rights) 31->117 119 Machine Learning detection for dropped file 31->119 129 2 other signatures 31->129 41 GoogleUpdate.exe 31->41         started        45 powershell.exe 31->45         started        47 schtasks.exe 31->47         started        49 schtasks.exe 31->49         started        121 Writes to foreign memory regions 35->121 123 Allocates memory in foreign processes 35->123 125 Injects a PE file into a foreign processes 35->125 57 2 other processes 35->57 51 conhost.exe 37->51         started        95 C:\Users\user\AppData\...\svcupdater.exe, PE32 39->95 dropped 97 C:\Users\user\AppData\Local\Temp\DE3E.tmp, PE32+ 39->97 dropped 99 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 39->99 dropped 127 Adds a directory exclusion to Windows Defender 39->127 53 cmd.exe 39->53         started        55 powershell.exe 39->55         started        59 3 other processes 39->59 signatures12 process13 dnsIp14 111 141.95.93.175, 443, 49729, 49730 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 41->111 113 api.peer2profit.com 172.66.43.60, 443, 49727, 49728 CLOUDFLARENETUS United States 41->113 147 Detected unpacking (changes PE section rights) 41->147 149 Detected unpacking (overwrites its own PE header) 41->149 151 Uses netsh to modify the Windows network and firewall settings 41->151 153 Modifies the windows firewall 41->153 61 netsh.exe 41->61         started        63 netsh.exe 41->63         started        65 netsh.exe 41->65         started        67 conhost.exe 45->67         started        69 conhost.exe 47->69         started        71 conhost.exe 49->71         started        155 Uses schtasks.exe or at.exe to add and modify task schedules 53->155 75 2 other processes 53->75 73 conhost.exe 55->73         started        77 3 other processes 59->77 signatures15 process16 process17 79 conhost.exe 61->79         started        81 conhost.exe 63->81         started        83 conhost.exe 65->83         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60fc42abc7bf2776e7fc32f38fb7ad6cbca757911cfec91a874c6b12bc7f202f/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-09 03:15:50 UTC
File Type:
PE (Exe)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=md6efk6hx4txnz74glzy7n5nns6kov4rdt7msguhjrvrfpd7eaxq._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:vidar botnet:1707 botnet:@clownadaqwe evasion infostealer persistence spyware stealer upx
Link:
https://tria.ge/reports/221025-anb12abah3/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Uses the VBS compiler for execution
UPX packed file
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Stops running service(s)
Modifies security service
RedLine
RedLine payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Malware Config
C2 Extraction:
77.73.133.19:31892
https://t.me/slivetalks
https://c.im/@xinibin420
Unpacked files
SH256 hash:
42660572eadbc53717d496eb22f4e522b3fa42d239cb53e81e4f2914d6375a13
MD5 hash:
4246cee78c09abb9896e32f32399256d
SHA1 hash:
8c775ce6f361dccf6eff8991be3319f8c10b1a8c
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/11f33faa-7373-44a6-adba-def36d09b334/
SH256 hash:
60fc42abc7bf2776e7fc32f38fb7ad6cbca757911cfec91a874c6b12bc7f202f
MD5 hash:
8c1c9af22752dac6f96d0940e28d8020
SHA1 hash:
820adea19fa2c21eff1ff88d20ce19588ccface7
Link:
https://www.unpac.me/results/11f33faa-7373-44a6-adba-def36d09b334/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/60fc42abc7bf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60fc42abc7bf2776e7fc32f38fb7ad6cbca757911cfec91a874c6b12bc7f202f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323703/

Comments