MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643
SHA3-384 hash: 44a4fa544cd4801c9c2499be14a3ca59ecb0e7b25b893fd76f8c6094800c51aacd733c9870a4ad21f6d90a7ba64c7d76
SHA1 hash: 0c7deb4ac306dac893c6ba30f81d9519a3f409a6
MD5 hash: 593eea90e533ed14757d62b4f2c7d969
humanhash: ink-leopard-connecticut-leopard
File name:593eea90e533ed14757d62b4f2c7d969.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:809'984 bytes
First seen:2021-01-02 08:08:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:gCgriNqlI2iNyWBphvD/hHp+vFOI/95W5EBK+NMh:gn+Nqy1YWVbhHp+vsmRB1
Threatray 567 similar samples on MalwareBazaar
TLSH 41052B0133F46C43E47A0276233537C8DB7CA443B6D9E21E5AB269D4C27B6B6F694E42
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://malscxa.ac.ug/

Intelligence

File Origin
# of uploads :
1
# of downloads :
317
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
593eea90e533ed14757d62b4f2c7d969.exe
Verdict:
Malicious activity
Analysis date:
2021-01-02 08:10:27 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/75dddfb6-7964-441f-96dc-5f73b2fc566c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/110286/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
DNS request
Connection attempt
Deleting a recently created file
Reading critical registry keys
Replacing files
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Stealing user critical data
Launching a tool to kill processes
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/572912
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM_3
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 335517 Sample: ndUmkEM8KO.exe Startdate: 02/01/2021 Architecture: WINDOWS Score: 84 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected AntiVM_3 2->37 39 Yara detected Vidar stealer 2->39 41 2 other signatures 2->41 8 ndUmkEM8KO.exe 3 2->8         started        process3 file4 23 C:\Users\user\AppData\...\ndUmkEM8KO.exe.log, ASCII 8->23 dropped 43 Injects a PE file into a foreign processes 8->43 12 ndUmkEM8KO.exe 188 8->12         started        signatures5 process6 dnsIp7 33 malscxa.ac.ug 194.61.53.10, 49723, 80 M247GB Russian Federation 12->33 25 C:\ProgramData\vcruntime140.dll, PE32 12->25 dropped 27 C:\ProgramData\sqlite3.dll, PE32 12->27 dropped 29 C:\ProgramData\softokn3.dll, PE32 12->29 dropped 31 4 other files (none is malicious) 12->31 dropped 45 Tries to harvest and steal browser information (history, passwords, etc) 12->45 47 Tries to steal Crypto Currency Wallets 12->47 17 cmd.exe 1 12->17         started        file8 signatures9 process10 process11 19 taskkill.exe 1 17->19         started        21 conhost.exe 17->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-02 05:09:55 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvuzgrtebvkit2rxnk6e2oxl56xlli4wn542rpccqqhmvowfizbq._file
Verdict:
malicious
Similar samples:
033dd7d02172855d2e61e1dcfae24bdeb9136310503e06bf7079ef78db9422ae
ArkeiStealer
15145ed8e5ae3cf2acf9ad25bbcb3f782c4d8ba9674185d06baa66ae6d17f25a
ArkeiStealer
4be1e912f4b6f65dd938f0a6fa1f1d9b8d4c20fc25ac3c3189e10013c29e4dea
ArkeiStealer
682be0853ccd6f60deb69d27941a628758c4e13e7d2e6ee95a95f415f3a9f0c6
ArkeiStealer
7dd09a71615dc2a60ba9dd906aebcff010f8442f4db392e4feb88baa01f8c999
ArkeiStealer
8bbb8fe69100550248f4663e911a16bca03432bef9112dd0924d7a9c3dae8464
ArkeiStealer
ac8a0b325adca9cc88fc6ee32c912024adfe5228024712e1c757183c51260d16
ArkeiStealer
bad1feef0055835db4f894b4885b48d596788458bc9095d4c0af9ec36a97077d
ArkeiStealer
cb581d356a20e0845006197aed2cc99463a9759f3f8c6a6d0783a553c88fda1b
ArkeiStealer
ce4c9d123144cb01aaa09ecfc34a21b6808c8d891fdd777e3bc8736fc3d877ca
ArkeiStealer
+ 557 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware
Link:
https://tria.ge/reports/210102-shy6z6fjb2/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
JavaScript code in executable
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Oski
Unpacked files
SH256 hash:
6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643
MD5 hash:
593eea90e533ed14757d62b4f2c7d969
SHA1 hash:
0c7deb4ac306dac893c6ba30f81d9519a3f409a6
Link:
https://www.unpac.me/results/7eb0457d-87f2-4906-a0bc-b8cdae8282a6/
SH256 hash:
ea9053bc1e57f1a2aaf2b00fd575926b56da582b9186b2029bfb4a79656c9850
MD5 hash:
19106a0b63922c3b3f97fbcbd761a846
SHA1 hash:
0e9f7da8d836b19a44a67ad2fd0fa1e5819b5a8a
Link:
https://www.unpac.me/results/7eb0457d-87f2-4906-a0bc-b8cdae8282a6/
SH256 hash:
64a419709ad219ffc006bda776b650da486d55048d2fa34525f40227da0e5c86
MD5 hash:
88c0ec8398978fa2e4240f02765086ad
SHA1 hash:
5a5c4935b2d70e890c89ad9332365f4f4aa86f3c
Link:
https://www.unpac.me/results/7eb0457d-87f2-4906-a0bc-b8cdae8282a6/
SH256 hash:
71be81ebd49fd7262d8e1baea01f0ab0b3422262f5ba89f57d3a99d96582387a
MD5 hash:
0d606c59ce60c86357636fe21264e8b1
SHA1 hash:
6903e2f759737c6020b6a8d4653d01df2a645426
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/7eb0457d-87f2-4906-a0bc-b8cdae8282a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_oski_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 6d699346640d5489ea376abc4d3aebefaeb5a3966f79a8bc42840ecabac54643

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/110286/
  
URLhaus
https://urlhaus.abuse.ch/url/947445/
  
Delivery method
Distributed via web download

Comments