MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e8a0a30744ed0130a2b32997e03ba5c07339ddf22e76c7ca64882d5d3f8cc4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 8

Intelligence 8 IOCs 1 YARA 18 File information Comments 1

SHA256 hash:	6e8a0a30744ed0130a2b32997e03ba5c07339ddf22e76c7ca64882d5d3f8cc4f
SHA3-384 hash:	d5112f28879d54fd8cda46794ef0aeba044c4c0313a4390f746fe1162a0ccfdec35cc9ff27a47125c731677661f06848
SHA1 hash:	6efbe33712bddc491f54d7e03d7626941b7bd397
MD5 hash:	455d2c547dcacc8b6794a3fa0ccceac9
humanhash:	coffee-bakerloo-oklahoma-bakerloo
File name:	455D2C547DCACC8B6794A3FA0CCCEAC9.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	10'539'829 bytes
First seen:	2021-04-19 23:50:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep	196608:itLdT4YXjbzV9rzRoITKkV7dFEY+JIV23FILkuBUO6e2u0Co6pkS6kPJ3:yRzbxJ31tdWY+c23FILkuBf6G0Co6pkE
Threatray	56 similar samples on MalwareBazaar
TLSH	D2B633BFA3E1067FD0422E751A17E6B077B9FB48572CD41BEDC6C92859373432A21229
Reporter	abuse_ch
Tags:	ArkeiStealer exe

abuse_ch

ArkeiStealer C2:
http://88.198.106.10/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://88.198.106.10/	https://threatfox.abuse.ch/ioc/8994/

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

mcc505.exe

Verdict:

Malicious activity

Analysis date:

2021-04-16 20:32:22 UTC

Tags:

installer evasion adware innotools trojan loader stealer vidar rat redline

Link:

https://app.any.run/tasks/35a6a311-0de5-41e9-89e9-1eedec987633

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Malware.Score-6915874-0

Win.Malware.Score-6916175-0

Win.Malware.Fabookie-9797757-0

Win.Malware.Generic-9849070-0

SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Delayed reading of the file

Creating a file in the %temp% subdirectories

Creating a file in the Program Files subdirectories

Deleting a recently created file

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file

Creating a file in the Program Files directory

Sending a UDP request

Creating a file in the Windows subdirectories

DNS request

Moving a file to the Program Files subdirectory

Sending a custom TCP request

Moving a recently created file

Reading critical registry keys

Launching a process

Sending an HTTP GET request

Running batch commands

Enabling the 'hidden' option for recently created files

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process by context flags manipulation

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6e8a0a30744ed0130a2b32997e03ba5c07339ddf22e76c7ca64882d5d3f8cc4f/

Gathering data

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=n2faumduj3ibgcrlgkmx4a52lqdthho7eltwy7fgjcbnlu7yzrhq._file

Verdict:

malicious

ArkeiStealer

3535884c0c8041b6f9e27e7e0cf4fbac9abb5f0ca89d793d29d3ffe01e677081

ArkeiStealer

4139739d5bfa8330e095a68c658040fb42c75cde651e3baa8afafb4fc557b202

ArkeiStealer

5114da99edb9632526115354fe8f2a052c84c5da406a923799539fc92df4c9c0

ArkeiStealer

51e48b45ee8d8d7ed18971b8f904f45e8b19b588f9291587f8933bcd8b5d1105

ArkeiStealer

8b6be03e0a14f193dd33c6dfdc1a1c27d3d59044ea246b3a12eb4a7d790dd4ed

ArkeiStealer

9f34d20254c87d8f9c732df75eb5b707c41fd6cd5153f5e4733a0126ed304f0d

ArkeiStealer

ea077019bc7eed24cd45cf0e7b78d8a90ee8a7b8e6a7c7e994d1f62954d00c39

ArkeiStealer

ecf100d294f5b6b63ebc4e1430f6a07b07e3899b0c447a536d7c53c51d711549

ArkeiStealer

fab31b9c336ced2fe83d81198d3ccfa325ca4d4cab2464b72dcda37f34e2dd68

ArkeiStealer

+ 46 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:elysiumstealer family:vidar discovery evasion exploit persistence spyware stealer trojan upx vmprotect

Link:

https://tria.ge/reports/210419-dl277naane/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Download via BitsAdmin

Kills process with taskkill

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Runs ping.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks for any installed AV software in registry

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Reads local data of messenger clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Drops file in Drivers directory

Executes dropped EXE

Modifies Windows Firewall

Possible privilege escalation attempt

Sets service image path in registry

UPX packed file

VMProtect packed file

Checks for common network interception software

ElysiumStealer

Modifies Windows Defender Real-time Protection settings

Modifies security service

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Malware Config

Dropper Extraction:

https://raw.githubusercontent.com/swagkarna/Bypass-Tamper-Protection/main/NSudo.exe

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Eldorado

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/6e8a0a30744ed0130a2b32997e03ba5c07339ddf22e76c7ca64882d5d3f8cc4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	Cryptocoin_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Steam in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	Ping_Del_method_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	cmd ping IP nul del

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Steam_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Steam in files like avemaria

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	Telegram_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Telegram in files like avemaria

Rule name:	win_vidar_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com

Rule name:	XMRIG_Miner Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-20 00:09:43 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
2) [F0002.002] Collection::Polling
4) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
5) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
6) [C0032.001] Data Micro-objective::CRC32::Checksum
7) [C0060] Data Micro-objective::Compression Library
8) [C0026.002] Data Micro-objective::XOR::Encode Data
10) [C0046] File System Micro-objective::Create Directory
11) [C0048] File System Micro-objective::Delete Directory
12) [C0047] File System Micro-objective::Delete File
13) [C0049] File System Micro-objective::Get File Attributes
14) [C0051] File System Micro-objective::Read File
15) [C0050] File System Micro-objective::Set File Attributes
16) [C0052] File System Micro-objective::Writes File
17) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
18) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
19) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
20) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
21) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
22) [C0017] Process Micro-objective::Create Process
23) [C0041] Process Micro-objective::Set Thread Local Storage Value
24) [C0018] Process Micro-objective::Terminate Process