MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ae2b85bbb7df33cb5c97373647b30331f8dfffd1ec0f76a11a0af81d1c1d592. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ae2b85bbb7df33cb5c97373647b30331f8dfffd1ec0f76a11a0af81d1c1d592
SHA3-384 hash: 0bcf5e6e336cd4615e72919a11fe672cd9881b9c14dab0b94583cd9e97bc306d6f60bb80f07e393deebe5a0c14eb5901
SHA1 hash: c0e7bab163116d6c5c01d4baec97c9cdda09491b
MD5 hash: 7336d5532b53b3e7dbb9abbef4c04b55
humanhash: illinois-hydrogen-stairway-six
File name:file4.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:146'064 bytes
First seen:2021-06-16 13:02:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 1536:LkJ6V1+FcD0ZCAz15f22kDM7bOjaH4ZinJ0i757FB:LkJmwFcD0gOqQ757FB
Threatray 1'523 similar samples on MalwareBazaar
TLSH 91E3CFACD6B8BCDBD41BA0F59C76F6E5191BEA185468092A342E711314723933CF6C2F
Reporter 0x746f6d6669
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file4.exe
Verdict:
Malicious activity
Analysis date:
2021-06-16 13:54:43 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/77db2beb-69b6-4e4f-915a-65c8e39f09cf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.3151.13588.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Moving a recently created file
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process
Adding an access-denied ACE
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Connection attempt
Deleting a recently created file
Replacing files
Reading critical registry keys
Creating a window
Delayed writing of the file
Using the Windows Management Instrumentation requests
Searching for the window
Stealing user critical data
Launching a tool to kill processes
Forced shutdown of a browser
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/13547074-b26c-40e6-abb3-6648975c233c
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/803040
Signature
Country aware sample found (crashes after keyboard check)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 435450 Sample: file4.exe Startdate: 16/06/2021 Architecture: WINDOWS Score: 84 47 Found malware configuration 2->47 49 Yara detected Vidar stealer 2->49 51 Found many strings related to Crypto-Wallets (likely being stolen) 2->51 53 Country aware sample found (crashes after keyboard check) 2->53 8 file4.exe 15 12 2->8         started        process3 dnsIp4 41 apdocroto.gq 172.67.158.27, 49720, 80 CLOUDFLARENETUS United States 8->41 55 Hides threads from debuggers 8->55 57 Injects a PE file into a foreign processes 8->57 12 file4.exe 92 8->12         started        17 WerFault.exe 23 9 8->17         started        19 cmd.exe 1 8->19         started        signatures5 process6 dnsIp7 43 159.69.20.131, 49737, 80 HETZNER-ASDE Germany 12->43 45 bandakere.tumblr.com 74.114.154.18, 443, 49736 AUTOMATTICUS Canada 12->45 33 C:\Users\user\AppData\...\softokn3[1].dll, PE32 12->33 dropped 35 C:\Users\user\AppData\...\freebl3[1].dll, PE32 12->35 dropped 37 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 12->37 dropped 39 9 other files (none is malicious) 12->39 dropped 59 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->59 61 Tries to harvest and steal browser information (history, passwords, etc) 12->61 63 Tries to steal Crypto Currency Wallets 12->63 21 cmd.exe 1 12->21         started        65 Tries to evade analysis by execution special instruction which cause usermode exception 17->65 23 conhost.exe 19->23         started        25 timeout.exe 1 19->25         started        file8 signatures9 process10 process11 27 taskkill.exe 1 21->27         started        29 conhost.exe 21->29         started        31 timeout.exe 1 21->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ae2b85bbb7df33cb5c97373647b30331f8dfffd1ec0f76a11a0af81d1c1d592/
Threat name:
ByteCode-MSIL.Downloader.Foold
Create hunting rule
Status:
Malicious
First seen:
2021-06-16 13:02:24 UTC
AV detection:
9 of 29 (31.03%)
Threat level:
  3/5
Verdict:
malicious
Similar samples:
0140e6a13431a2f6e9157b7d602fd38f4f1603aee2c07219ff8af2fa2f63fce9
ArkeiStealer
186e9e1877c50ecf4619bf75856c84bf1305ce117ad9b2e14410a340cccfd2a0
ArkeiStealer
377030b4311c86adfdbab3a625400cfeae0288f71bb6a3530ed022a9ff87b04e
ArkeiStealer
6dfc5e15040bfa96f6d5042287a4433c3cad197d4528f885dfafb456cf147a1b
ArkeiStealer
800f7ba104da52d35697bf910bb102ecf9cef21966eae89fc59d348d3fa0ceea
ArkeiStealer
b9f5bca9a22f08aad48674bc42e4eaf72ab8aa3d652ba7a10dc4686b5b183a33
ArkeiStealer
c391ea2f8b72e2810362cd512a640220f20fb149bdd85eaef408c25471f74b92
ArkeiStealer
c7d0d8513552fd13ecb15e4fd518549aa71498af923b024e721a527b5d7682b3
ArkeiStealer
e8da10d6d1bc9983ce35416b130f9814e346ada4ea0117fe78b4805c26c96a72
ArkeiStealer
f3111a72a43115727e0224015777dbde5f4dbf285fff1b7b28f5444fa19c5310
ArkeiStealer
+ 1'513 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery spyware stealer
Link:
https://tria.ge/reports/210616-57m43veyq2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
Unpacked files
SH256 hash:
6ae2b85bbb7df33cb5c97373647b30331f8dfffd1ec0f76a11a0af81d1c1d592
MD5 hash:
7336d5532b53b3e7dbb9abbef4c04b55
SHA1 hash:
c0e7bab163116d6c5c01d4baec97c9cdda09491b
Link:
https://www.unpac.me/results/bf67e07a-bd80-4d0d-8b70-d13d7c331dd0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6ae2b85bbb7df33cb5c97373647b30331f8dfffd1ec0f76a11a0af81d1c1d592

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments