MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f6aff9bfba1f2b99f44bf234b63b2bbdd9f56accff33e1a258dc229050beb22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f6aff9bfba1f2b99f44bf234b63b2bbdd9f56accff33e1a258dc229050beb22
SHA3-384 hash: 64004527182fcc92335f95311c469c04dd2386368d4f41a495a506ea2f036d987bf8b4ee95f6d40f12e6de8653b315c6
SHA1 hash: 9964a9223ea77f90c2218d5cc9b0a88ccb6bed31
MD5 hash: 8b0d158f371cf99048b93fdf4ff46e2a
humanhash: hydrogen-iowa-nuts-mars
File name:8b0d158f371cf99048b93fdf4ff46e2a
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'760'672 bytes
First seen:2022-07-14 05:35:47 UTC
Last seen:2022-07-22 11:43:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e379f66a7187b91750d7802534777d71 (3 x RedLineStealer, 1 x ArkeiStealer)
ssdeep 49152:oauzSPrjQezNEbwHfpw9Z7iV+NT7gbifjpFooEAEuuAKe:5Qe5Eb8fpJV9ba9FoBM
Threatray 44 similar samples on MalwareBazaar
TLSH T18B85129B32535770F043543BA38EBA389A427E891237F9A91659131A3EF33C75EB1760
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0f0f0f0f4f0ec78 (1 x ArkeiStealer)
Reporter openctibr
Tags:ArkeiStealer exe OpenCTI.BR Sandboxed signed

Code Signing Certificate

Organisation:techhive.com
Issuer:R3
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-23T12:53:46Z
Valid to:2022-08-21T12:53:45Z
Serial number: 03af2650f7de2b156ff933c70ecea51b575d
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: f19e02bec11193580ea1f694a12e010aecad95f7bd3bb51427e8c7bbef950d52
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/288201/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62cfab84d6d93426ceec688c/reports/ef7d4f67-9209-4c09-8257-37da9ba2a05e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20369891-1b77-4b39-a6e7-a7b494c74d43
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1031042
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 663536 Sample: 1JxVZFLDTY.exe Startdate: 14/07/2022 Architecture: WINDOWS Score: 100 80 Snort IDS alert for network traffic 2->80 82 Antivirus detection for URL or domain 2->82 84 Multi AV Scanner detection for submitted file 2->84 86 2 other signatures 2->86 8 DllHelper.exe 2->8         started        11 1JxVZFLDTY.exe 4 2->11         started        process3 file4 88 Writes to foreign memory regions 8->88 90 Allocates memory in foreign processes 8->90 92 Injects a PE file into a foreign processes 8->92 14 InstallUtil.exe 84 8->14         started        46 C:\Users\user\AppVerif\DllHelper.exe, PE32 11->46 dropped 48 C:\Users\...\DllHelper.exe:Zone.Identifier, ASCII 11->48 dropped 94 Self deletion via cmd or bat file 11->94 96 Uses schtasks.exe or at.exe to add and modify task schedules 11->96 19 DllHelper.exe 11->19         started        21 cmd.exe 1 11->21         started        23 schtasks.exe 1 11->23         started        signatures5 process6 dnsIp7 58 193.233.193.68, 49777, 49779, 49780 FREE-NET-ASFREEnetEU Russian Federation 14->58 50 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 14->50 dropped 52 C:\Users\user\AppData\Local\Temp\...\nss3.dll, PE32 14->52 dropped 54 C:\Users\user\AppData\Local\...\mozglue.dll, PE32 14->54 dropped 56 25 other files (none is malicious) 14->56 dropped 64 Tries to harvest and steal ftp login credentials 14->64 66 Tries to harvest and steal browser information (history, passwords, etc) 14->66 68 DLL side loading technique detected 14->68 70 Tries to harvest and steal Bitcoin Wallet information 14->70 25 cmd.exe 1 14->25         started        72 Writes to foreign memory regions 19->72 74 Allocates memory in foreign processes 19->74 76 Injects a PE file into a foreign processes 19->76 27 InstallUtil.exe 19->27         started        29 InstallUtil.exe 19->29         started        78 Uses ping.exe to check the status of other devices and networks 21->78 31 PING.EXE 1 21->31         started        34 conhost.exe 21->34         started        36 chcp.com 1 21->36         started        38 conhost.exe 23->38         started        file8 signatures9 process10 dnsIp11 40 conhost.exe 25->40         started        42 PING.EXE 1 25->42         started        44 chcp.com 1 25->44         started        60 127.0.0.1 unknown unknown 31->60 62 192.168.11.1 unknown unknown 31->62 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f6aff9bfba1f2b99f44bf234b63b2bbdd9f56accff33e1a258dc229050beb22/
Threat name:
Win32.Trojan.Witch
Create hunting rule
Status:
Malicious
First seen:
2022-07-09 07:54:12 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p5vp7g73uhzlth2ex4ruwy5sxpoz6vvmz7zt4grfrxbcsbil5mra._file
Verdict:
malicious
Similar samples:
0a84fc0f1fc811c84e6b138e12d11f935c3907f91e5a09092aa2588dca6145a7
ArkeiStealer
1b31323173493f6a6bd5e7eee14ea280bd08d0d8a6edc5834a36354629f5ce9d
ArkeiStealer
2395406485367f123c11e0ad5b8a1ce58638921fb7e7acfdd06e341135b2d8df
ArkeiStealer
747bff52167a03f0db2458b3a67b8ea292044dafe4dd921f0c6613b7030987a1
ArkeiStealer
8795bb17e6a0ce6dc06236d4042c625f2154bd1d8e5df494c23ffa3e58124395
ArkeiStealer
b6ff145884d38092869144e2e68f0c8e50a64c0f376641396d29778ae96450fd
ArkeiStealer
bc2c5aac27aaaf644147f10e1ad1d43e01ad4cd63787923f6bc81def10067b4b
ArkeiStealer
cbb64bb040b36f1c89cb1fbf72237d46cb31f87ad6e1ea721abff9bc060e3e12
ArkeiStealer
ebcfd0fc3ecbf9281e9f42e858be21770fd7e3d92facd23d3dc589f01b1a1091
ArkeiStealer
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220714-gamc6sgahr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
89a61a8b0a938d8d4dac6714c047c3f674ec4e8ec89b9427ce6ab216b55b7028
MD5 hash:
6a0b70aad8921eb11a79215e8c382bc4
SHA1 hash:
53599b222dcbe2967c89c94af6a46b7d20e701af
Link:
https://www.unpac.me/results/b18821c7-3a0a-48ec-a9b9-8c180339c0c7/
SH256 hash:
7f6aff9bfba1f2b99f44bf234b63b2bbdd9f56accff33e1a258dc229050beb22
MD5 hash:
8b0d158f371cf99048b93fdf4ff46e2a
SHA1 hash:
9964a9223ea77f90c2218d5cc9b0a88ccb6bed31
Link:
https://www.unpac.me/results/b18821c7-3a0a-48ec-a9b9-8c180339c0c7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f6aff9bfba1f2b99f44bf234b63b2bbdd9f56accff33e1a258dc229050beb22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 7f6aff9bfba1f2b99f44bf234b63b2bbdd9f56accff33e1a258dc229050beb22

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2254670/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/288201/

Comments