MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a
SHA3-384 hash: f3f98e05b669ed719aea7a86f690d94e105a15345a10be57cd1dc89fb43452ae999e5c3219c7d2836a9fbb87a29bdfd2
SHA1 hash: bf920f1fe420f1c8dc8dba7112f1b57bf0d6dfb7
MD5 hash: e52f5370a68e1ee7b5f24b708924025b
humanhash: mountain-fix-eighteen-juliet
File name:file
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:2'210'280 bytes
First seen:2023-01-08 20:19:18 UTC
Last seen:2023-01-09 00:11:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a8dd79e416c4138aa16ca4355a4f7ebb (2 x Rhadamanthys, 1 x ArkeiStealer, 1 x Adware.Neoreklami)
ssdeep 49152:B61lu6RZizQwhPuMaWFVCInTda0xW7hl8A:gG6KQwh2Mao9w+W7DZ
TLSH T1A0A5BF0DD939E369CEC7C834ABD803A5D2FD347BDDA7211E5BB129994030EE46E912C6
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0d4acc8d2f0cccc (1 x RedLineStealer, 1 x ArkeiStealer)
Reporter andretavare5
Tags:ArkeiStealer exe signed

Code Signing Certificate

Organisation:*.w3.org
Issuer:Gandi Standard SSL CA 2
Algorithm:sha256WithRSAEncryption
Valid from:2022-07-01T00:00:00Z
Valid to:2023-06-02T23:59:59Z
Serial number: 09e32347f56f58b1e0220774f39fedc8
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 1e404b417969f885e9e6ace074647998f2c932c4b56ce95dca558970f60ab9c6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://www.isurucabs.lk/Ads11.exe

Intelligence

File Origin
# of uploads :
6
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-08 20:20:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c9d16ef8-40df-4462-99e9-a39c94b6bd29

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/350872/
Detection(s):
SecuriteInfo.com.Generic.ML.PUA.26586.2653.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Launching a process
Creating a file
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Using the Windows Management Instrumentation requests
Creating a window
Searching for synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63bb2577a70bef46551dc856/reports/d9a8fe34-f94d-413d-9e40-f475a8339f17/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mustang Panda
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c7ccc342-07c4-4b5c-ac79-689af687caf2
Result
Threat name:
Vidar, lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1147591
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected lgoogLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-01-08 20:05:43 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ox6llwkbett7huez22wdlinpian5klli2zeauiyrogxdwsbtncfa._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader family:vidar botnet:641 downloader spyware stealer
Link:
https://tria.ge/reports/230108-y4fadsab4w/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Detects LgoogLoader payload
LgoogLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Malware Config
C2 Extraction:
https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923
Unpacked files
SH256 hash:
cd662fab10969955d389d3b366be42e9a09aab3766387f8a1119af5875ff21be
MD5 hash:
937ebcfa44521de5fb73f6173b2d415a
SHA1 hash:
f420697b6dba0e87377ef49e1692d2dd6b8bae27
Link:
https://www.unpac.me/results/a442e6ee-e1e5-4a2e-99e7-7372ee18b110/
SH256 hash:
75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a
MD5 hash:
e52f5370a68e1ee7b5f24b708924025b
SHA1 hash:
bf920f1fe420f1c8dc8dba7112f1b57bf0d6dfb7
Link:
https://www.unpac.me/results/a442e6ee-e1e5-4a2e-99e7-7372ee18b110/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/75fcb5d94124/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Telegram_Links
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/350872/
  
URLhaus
https://urlhaus.abuse.ch/url/2488375/

Comments