MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
SHA3-384 hash: 673268aae53378536e0cba3f2738f2da4d8e4cf7590a1ba27def431c51c6310828a51f0560f41c03066aece5df1bd08e
SHA1 hash: f5d472d3a3d201a788194d3c0b41d830ed443f21
MD5 hash: 7c2a21d3187176310f83181a3e6c8c58
humanhash: december-sweet-juliet-double
File name:7c2a21d3187176310f83181a3e6c8c58.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:880'778 bytes
First seen:2022-08-09 16:55:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep 24576:pAT8QE+kuKkUsAqQwN7ywiphPnUhEqMVdPaDr:pAI+5Kkkq3N7UZCMLPir
Threatray 1'873 similar samples on MalwareBazaar
TLSH T13015123AA202853AD0610939884BE3BAF53ABB041F7D08DF77DD0D5C9C273566E7625B
TrID 86.6% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
5.6% (.EXE) InstallShield setup (43053/19/16)
1.8% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.7% (.SCR) Windows screen saver (13101/52/3)
1.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
265
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7c2a21d3187176310f83181a3e6c8c58.exe
Verdict:
No threats detected
Analysis date:
2022-08-09 17:10:52 UTC
Tags:
installer
Link:
https://app.any.run/tasks/ea63c545-b723-4b07-b6f5-a538963d7ddc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/297435/
Detection(s):
SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file in the Program Files subdirectories
Modifying a system file
Launching a process
Creating a process with a hidden window
Creating a process from a recently created file
Searching for the browser window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28450/overview
Behaviour
MalwareBazaar
CPUID_Instruction
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62f291fc080024921b62e77e/reports/f75d4c64-395f-4dbc-b02a-25f656cb8a3d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2214e342-a448-4472-b003-92ea1e0a4b86
Result
Threat name:
CryptOne, Raccoon Stealer v2, RedLine, V
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1048674
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected CryptOne packer
Yara detected Generic Downloader
Yara detected Raccoon Stealer v2
Yara detected RedLine Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 681167 Sample: 80J4pAFU0A.exe Startdate: 09/08/2022 Architecture: WINDOWS Score: 100 40 iplogger.org 2->40 42 cdn.discordapp.com 2->42 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 Antivirus detection for dropped file 2->62 64 13 other signatures 2->64 8 80J4pAFU0A.exe 16 27 2->8         started        signatures3 process4 file5 32 C:\Program Files (x86)\Company\...\tag.exe, PE32 8->32 dropped 34 C:\Program Files (x86)\...\safert44.exe, PE32 8->34 dropped 36 C:\Program Files (x86)\Company\...\real.exe, PE32 8->36 dropped 38 6 other malicious files 8->38 dropped 11 real.exe 18 8->11         started        15 kukurzka9000.exe 8->15         started        17 chrome.exe 13 160 8->17         started        19 14 other processes 8->19 process6 dnsIp7 50 45.159.248.53, 49819, 80 VMAGE-ASRU Russian Federation 11->50 66 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->66 68 Tries to harvest and steal browser information (history, passwords, etc) 11->68 70 Tries to steal Crypto Currency Wallets 11->70 52 77.73.132.74, 80 AS43260TR Kazakhstan 15->52 54 192.168.2.1 unknown unknown 17->54 56 239.255.255.250 unknown Reserved 17->56 21 chrome.exe 13 17->21         started        24 chrome.exe 19->24         started        26 chrome.exe 19->26         started        28 chrome.exe 19->28         started        30 4 other processes 19->30 signatures8 process9 dnsIp10 44 iplogger.org 148.251.234.83, 443, 49751, 49752 HETZNER-ASDE Germany 21->44 46 accounts.google.com 142.250.203.109, 443, 49754 GOOGLEUS United States 21->46 48 3 other IPs or domains 21->48
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0/
Threat name:
Win32.Infostealer.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-08-09 06:20:17 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oksa2ku7q3rdubfaosced6ysfn6jghq3lczmxj6kf5p5pq772sya._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
01e1bbb9bb2c3e5ed68df65a2846faa611ec9bfcbf664e0abd5b72005502cac4
ArkeiStealer
15021b22e43f3522e7da1ba69256c9d9cda849794d44aa1e58cabc3282818362
ArkeiStealer
3427583e84dda3d92aab9f9b9050d7cfe9bcb43094acc08f02f0166f310702cc
ArkeiStealer
45aebea9d7e8dfe9d950cc6cf90b5c6e023bd90ef810d8dfde5c9462c642617a
ArkeiStealer
9bc8a9f52041123c3c471dd111a2ce0ee39eaf5e59d7949826d08601a3511f10
ArkeiStealer
aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
ArkeiStealer
b91e7fd40c84298ad53bae03f61d45d9e8ea323c6fecded7a4b98f53ebf36110
ArkeiStealer
d294a8bc0b704479728f1db750e69503c7d9623690b5b3fbfd7802c4e0be10b1
ArkeiStealer
e7924441cf355557372d5d058eeb30341f9bb4be80f54449ea66b288d183b928
ArkeiStealer
+ 1'863 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline botnet:4 botnet:5076357887 botnet:@tag12312341 botnet:afb5c633c4650f69312baef49db9dfa4 botnet:alfa botnet:f0c8034c83808635df0d9d8726d1bfd6 botnet:nam3 discovery evasion exploit infostealer persistence spyware stealer upx
Link:
https://tria.ge/reports/220809-vfn1vadcen/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Looks for VMWare drivers on disk
Possible privilege escalation attempt
Stops running service(s)
UPX packed file
Enumerates VirtualBox DLL files
Looks for VirtualBox drivers on disk
Looks for VirtualBox executables on disk
Modifies security service
Raccoon
Raccoon Stealer payload
RedLine
RedLine payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
103.89.90.61:18728
31.41.244.134:11643
62.204.41.144:14096
195.54.170.157:16525
46.175.148.142:32178
http://77.73.132.74
http://45.95.11.158/
Unpacked files
SH256 hash:
ac235a673e0ea2bfb0d2e6f2b8253699ffa4ea618e4d910f556e2ecbb5c25c0e
MD5 hash:
d28fd6744208e7fb03ae3ab8663961ae
SHA1 hash:
ddc4d920c5ddab6d8521aa1abbbea11e7f09e421
Detections:
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/22e3e7a8-e7a8-4fe2-bf25-5a0481c5c111/
Parent samples :
8a631481dec5c4bfde1b90e812868a5edd093f44ebbb0625f91e6548c500ef67
3df88f2029a31f78dd274a199c37a0295aeed62e8dbe3b111e5e078058e97e08
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
dd867eaf8b2afabdee44b3abe0c40ef727e9d5d7c5092a7a2be398e077c1ce03
36f0665c83b2c0b2968654d6f982d886500abfffb470c72e44331eade368e656
c2edb4657f300a58da83f9a6874575eec3e14622aedd1fe6f2e50d4a844f4e8b
SH256 hash:
88061fc99b8d011006de3f808f8b1c8d239268ef76585eacf2cbb29d7926c800
MD5 hash:
3ec84227a46b0cddb9ddf31a2168e66d
SHA1 hash:
6f8861a0cd91ea97b1f2125319b55cbee689627f
Link:
https://www.unpac.me/results/22e3e7a8-e7a8-4fe2-bf25-5a0481c5c111/
SH256 hash:
228edf139bd9ecc269943af6a04d29ef25e3fb0bd04f3590d49105e536188339
MD5 hash:
39a0e25190044817cc709ccaa17cd405
SHA1 hash:
5a58974f436caf5623d77370f03e269fb806fe99
Link:
https://www.unpac.me/results/22e3e7a8-e7a8-4fe2-bf25-5a0481c5c111/
SH256 hash:
825998f2e3577e9493b4a2fd9b542c2eed296853a1d6dddd17c9219654819e03
MD5 hash:
e405755995b7d446557b2b99f4e603d3
SHA1 hash:
f49d77184e32db7dd09240e08633aceb61504eed
Link:
https://www.unpac.me/results/22e3e7a8-e7a8-4fe2-bf25-5a0481c5c111/
SH256 hash:
72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0
MD5 hash:
7c2a21d3187176310f83181a3e6c8c58
SHA1 hash:
f5d472d3a3d201a788194d3c0b41d830ed443f21
Link:
https://www.unpac.me/results/22e3e7a8-e7a8-4fe2-bf25-5a0481c5c111/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/72a40d2a9f86/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 72a40d2a9f86e23a04a0748441fb122b7c931e1b58b2cba7ca2f5fd7c3ffd4b0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2264089/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/297435/

Comments