MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 18 File information Comments

SHA256 hash:	6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace
SHA3-384 hash:	ac9b7bc2ef488321e2d42db3cff323372f74c835e59cfbff3d97799f1d3dd442e9af5a341dd4838320cb4ec54cab210f
SHA1 hash:	5630004ec723bb75eb42596bf962063b92e334dd
MD5 hash:	6e86172f6fd5e9401c6fd3d7c5fa6a01
humanhash:	william-lamp-music-carolina
File name:	file
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	4'626'432 bytes
First seen:	2026-01-09 08:23:45 UTC
Last seen:	2026-01-09 08:34:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c25f27d433e84e004eba6eba6c3cb034 (2 x ArkeiStealer)
ssdeep	98304:9zlg7hAT9bgEDTUMeYd4/T67HPUXPWQh4m0Pk/BCW8Uh/:ZTr46HPU/DemckRtR
TLSH	T1EE26334553B172BDF0239670127F6BF6C1B1B5338D6A8BFB895847B13D01F422A62B29
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	ArkeiStealer dropped-by-amadey exe fbf543

Bitsight

url: http://130.12.180.43/files/7103746036/Z4H0HNY.exe

Intelligence

File Origin

# of uploads :

# of downloads :

151

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

teamviewer

ID:

File name:

_6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace.exe

Verdict:

Malicious activity

Analysis date:

2026-01-09 08:25:19 UTC

Tags:

stealer crypto-regex auto-reg teamviewer rmm-tool tightvnc

Link:

https://app.any.run/tasks/21e7e57b-d84e-4474-9866-1cb49a0bfb79

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/48260/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6960bb49f50945831dff2ce4

Tags:

emotet lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% subdirectories

Launching a process

Creating a process with a hidden window

Loading a suspicious library

Creating a window

Reading critical registry keys

Creating a file in the %temp% directory

Changing a file

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Sending an HTTP POST request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug crypto packed

Link:

https://www.filescan.io/uploads/6960bb4107ef5fa68e825d9c/reports/02e2b445-e297-4fca-bc91-e0629a566732/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace/results?tab=lookup

Malware family:

Santastealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/65ec7611-3457-4e5e-afeb-a1d696d26ba6

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/6e86172f6fd5e9401c6fd3d7c5fa6a01

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace/

Verdict:

Malicious

Threat:

Family.TIGHTVNC

Link:

https://tip.neiki.dev/file/6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace

Threat name:

Win64.Trojan.GenSteal

Status:

Malicious

First seen:

2026-01-09 08:24:37 UTC

File Type:

PE+ (Exe)

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=notdooxrnlru2pydeltpkqehxqz6mifaunuteo6hninn3saxllha._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access discovery persistence spyware stealer

Link:

https://tria.ge/reports/260109-kazv2sex6b/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Checks computer location settings

Credentials from Password Stores: Windows Credential Manager

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/93f6921b-afad-473f-bd47-0b1528c23c34

Unpacked files

SH256 hash:

6ba6373af16ae34d3f0322e6f54087bc33e620a0a369323bc76a1addc8175ace

MD5 hash:

6e86172f6fd5e9401c6fd3d7c5fa6a01

SHA1 hash:

5630004ec723bb75eb42596bf962063b92e334dd

Link:

https://www.unpac.me/results/855a6e07-49c2-44fb-8770-92e8ffbf5de9/

Malware family:

SantaStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6ba6373af16a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research