MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 1 File information Comments

SHA256 hash:	67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
SHA3-384 hash:	1762b2b7cab8e5684fbaeb7d9fd036d0e7d8021f7b5eb6f66710d318dafe166a620ac4e0528a55d0dc0c235400cd762d
SHA1 hash:	45385e79156656d8e78002241afb6c54f34d3c00
MD5 hash:	826aa9234de38f7df9471a96123353f3
humanhash:	xray-xray-red-mirror
File name:	826aa9234de38f7df9471a96123353f3.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	224'768 bytes
First seen:	2022-10-25 00:21:00 UTC
Last seen:	2022-10-25 01:20:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a2a488c1ba888cbce9fc8f3bca83fd16 (9 x RedLineStealer, 7 x ArkeiStealer, 4 x Tofsee)
ssdeep	3072:+ln05dgYTAGSoLODwl625PJyIkn7Vwe82D/neLO2S4zxAc983Nwhh4X/Ts:+l00EL/lgn7VwexD/eAQxmShh
Threatray	8'586 similar samples on MalwareBazaar
TLSH	T14824BE223AC0C072F67796758875C6B66BBAB8300A35579B3BD8076D8F312D2DE25347
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9a9acadecee6eaee (98 x Smoke Loader, 33 x RedLineStealer, 24 x ArkeiStealer)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

abuse_ch

ArkeiStealer C2:
http://78.47.204.168/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://78.47.204.168/	https://threatfox.abuse.ch/ioc/891320/

Intelligence

File Origin

# of uploads :

# of downloads :

256

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

826aa9234de38f7df9471a96123353f3.exe

Verdict:

No threats detected

Analysis date:

2022-10-25 00:22:25 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/73197e15-e789-4f00-909b-7b57517466c3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

SmokeLoader

Link:

https://www.capesandbox.com/analysis/323706/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.8659.255.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending an HTTP GET request

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce5d3909-9b40-4865-a639-cfc8c60e60c6

Result

Threat name:

DanaBot, SmokeLoader, Vidar

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1097121

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected DanaBot stealer dll

Yara detected SmokeLoader

Yara detected UAC Bypass using CMSTP

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2022-10-25 01:12:16 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m4dw3u4zu6q3up3cdd3hwysbcabedvi4lwfz26n6y5rr3mh6hl7q._file

Verdict:

malicious

ArkeiStealer

35be65280e65cc6b44fb20b468cca606d518aad0cb448127df637e75231d86ec

ArkeiStealer

37dc68a59b91498e5e5af32a912adfdcfad1c36f374dd309c3c3bd736ca9ff59

ArkeiStealer

42222d4215948ab44c3fa539feb56ce78612a7365e888b1834eec81592eacb75

ArkeiStealer

57f45a71581be8db1677109dc507d8421632e9bd0f8ecbf22b73ada97aeecd84

ArkeiStealer

67ac0d1dd4b73ea5d714efb1de0b18631950b1d2aae4a3c25f007eda9f7aa7d8

ArkeiStealer

6a965d9ba8be1636792bf7cdd3ee0c74d94669f5b086fd283d5d7aa66debdaf6

ArkeiStealer

6ffcab1f85946bd710d75a2071503d2aceef234a8ad59a2ad50dbc061262d257

ArkeiStealer

a749aafd3cf83fcfe2a763e09cca6521c3176b3c78af41fecbf5406af99bcfa2

ArkeiStealer

+ 8'576 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:danabot family:smokeloader family:vidar botnet:937 backdoor banker discovery spyware stealer trojan

Link:

https://tria.ge/reports/221025-anb12abahj/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Danabot

Detects Smokeloader packer

SmokeLoader

Vidar

Malware Config

C2 Extraction:

https://t.me/slivetalks
https://c.im/@xinibin420

Unpacked files

SH256 hash:

7a68135c35a476c25bf3b1a0a8eba83b8d2a1b1cf62fa09ed837cdb1bf570455

MD5 hash:

4a9dc069af235d03ec5aaa2b6293b56a

SHA1 hash:

2d1dcdc8146cf01a56b154a54616c263f0e84bdd

Detections:

win_smokeloader_a2

SmokeLoaderStage2

Link:

https://www.unpac.me/results/8af1f36e-4a5f-4dca-bf3f-54b5a57924f2/

Parent samples :

3ff3bd0a125b24b53520ec9ccc0e16d9e0950600ba527754fd194fb1d6a8d099
81e077a7be1719d015dac668d244e423639aab2481ab4dc85965ed3e9149e4f9
7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33
71cb880a73d0cb7eb933a93be2b6bb9ee394a2cda1f0f5e882d5bfc83f4e0609
1d3f37d2989eed7acee995c28e8cb9010ef54c45a4ccf84be54d036388a24ab5
a2bc5e03ed38aaafe284d8b29d896ae2708ca03fc2c732bb986bf50411b08f0a
5d15f594dee648ecd97cc2fbc66ee349991ec6ebd040f49439be2ac81f792fa8
67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4
7f18e1325f88bd8421a03d3d88ad25e2c9e6ff80e39e97efaa7f4d372b3be4dd
4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41

SH256 hash:

67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff

MD5 hash:

826aa9234de38f7df9471a96123353f3

SHA1 hash:

45385e79156656d8e78002241afb6c54f34d3c00

Link:

https://www.unpac.me/results/8af1f36e-4a5f-4dca-bf3f-54b5a57924f2/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/67076dd399a7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.