MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a
SHA3-384 hash:	c53ca08ae566f2c222e337f489c94e162c64f5f1b2b8f33c82dff90597ee08d90224ad939fb57735a19bc1d315b98d6a
SHA1 hash:	90a608ef13f55e0263d96be4c5b128288f934618
MD5 hash:	d01e4000e77e7a50d1720ac1da219528
humanhash:	finch-cola-washington-november
File name:	d01e4000e77e7a50d1720ac1da219528.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	715'776 bytes
First seen:	2021-09-21 13:39:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3a5e62b58b4a57118c6dbb55f27570fc (6 x ArkeiStealer, 3 x Smoke Loader, 2 x Stop)
ssdeep	12288:3YnHu6UL0vZWRQ2/FivdGnleEuXqliEs+OjPh/zcMo/c5vhoAE:QHeLCTvWlJKEsBjZ/zcMo/YvhoA
Threatray	167 similar samples on MalwareBazaar
TLSH	T1EDE4E030B6B1C035E5B782F989B983E8A92D7E71FB2451CB12D567FA5634AE09C30743
File icon (PE):
dhash icon	9824e790c4e72158 (31 x RedLineStealer, 18 x Smoke Loader, 16 x ArkeiStealer)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

196

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d01e4000e77e7a50d1720ac1da219528.exe

Verdict:

Malicious activity

Analysis date:

2021-09-21 13:41:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/34b52e79-cfa0-4707-9767-83984ed49a8e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/189893/

Detection(s):

Win.Malware.Generic-9895371-0

Win.Packed.Generic-9895403-0

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a325f2e0-84bc-4ae2-8935-81ba969ae338

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/854966

Signature

Country aware sample found (crashes after keyboard check)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-09-20 23:41:10 UTC

AV detection:

24 of 27 (88.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ne3qgxqcwma7nfm4xbojotkjk3zopcaodvx25prgdmq6ydzabjfa._file

Verdict:

malicious

ArkeiStealer

57af71329fbcd067e4a0e71b6b6a5ccb22c9ba806843928fcb02196259d34da1

ArkeiStealer

76e3372675b50861ba373f9700db718087d9821cc619e00aca03912f22eeedd1

ArkeiStealer

7b0409caebe92c8b64a6f3b3f071bf7829eb98e4904d077b291695e2b2619413

ArkeiStealer

9f7b738f2ff2ae60844f22c5b4e6e6b42312c2f5f32b3992dc65e5ac6d7a177b

ArkeiStealer

aa662c457cac9785e96f334d19a1eb5517b2ff1630aaadc81a7d62de8cbddabb

ArkeiStealer

b83c933c2216e6b6251fec84fdcce2f341f20f52934977355331cf3a140b83c5

ArkeiStealer

e063c47dce8d2f1121ceb4cf4b20688e975646ac831c0e5843d4536d7e1dfbce

ArkeiStealer

ebf487d463e3e54459f57c250c9ad14b571d1b1d08979f9ef3039bde9e491f58

ArkeiStealer

f1bb2d91c7594b776d0674a778c3208b73ef8caaf63427fb33c97481d783903b

ArkeiStealer

+ 157 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:1008 stealer

Link:

https://tria.ge/reports/210921-qykc6ahff7/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Vidar Stealer

Suspicious use of NtCreateProcessExOtherParentProcess

Vidar

Malware Config

C2 Extraction:

https://petrenko96.tumblr.com/

Unpacked files

SH256 hash:

afbced77762d814a12d80286c5744519541c4836a0c7464c6b4f9e166d474990

MD5 hash:

5cecd28e592ff348a9ac717a1e557a4f

SHA1 hash:

a82750b90b40eb6b583cb6bf97b8a02b8219f730

Link:

https://www.unpac.me/results/fcf98c1a-0fa3-43ed-8661-d7e632ef64bc/

SH256 hash:

6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a

MD5 hash:

d01e4000e77e7a50d1720ac1da219528

SHA1 hash:

90a608ef13f55e0263d96be4c5b128288f934618

Link:

https://www.unpac.me/results/fcf98c1a-0fa3-43ed-8661-d7e632ef64bc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks