MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8211ffa22a40ceb40b8aaa8102064550624b4d3977a6232c2b9bfaae4fdb071a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	8211ffa22a40ceb40b8aaa8102064550624b4d3977a6232c2b9bfaae4fdb071a
SHA3-384 hash:	fd460944ad767a2bfbe365ee07d68dfa7f142cc038d961a96d06dbfa748bb37a8f1fae3e76da92c1b435b4b261fecebb
SHA1 hash:	7954ce0c541f4bc021d91c05235e8e22799a00a1
MD5 hash:	185bf36185cd8bb1ad463a70214ff84b
humanhash:	thirteen-robin-march-july
File name:	Evil Hunters Launcher.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	758'272 bytes
First seen:	2022-12-16 19:44:38 UTC
Last seen:	2022-12-16 21:30:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	50fac56420301590bb5c790f6fb6225c (4 x ArkeiStealer)
ssdeep	12288:beD12u7YVn46STyDzjusB9yzIrN263//T6zthC5:bhfn4lyDzj9B9yzw20s/
Threatray	699 similar samples on MalwareBazaar
TLSH	T18BF45B33354050B2F57E17F11BDAA6B659AE6DBB1FD044C723C832F995722E0987822B
TrID	74.9% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 4.0% (.EXE) Win64 Executable (generic) (10523/12/4) 2.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	c8e2eae6e292c2ee (14 x ArkeiStealer, 10 x RedLineStealer, 3 x PythonStealer)
Reporter	iamdeadlyz
Tags:	82-115-223-60 ArkeiStealer exe FakeEvilHunters vidar

Iamdeadlyz

From evilhunters.com (impersonation of Evil Hunters by divovision)
De-pump of: 062030cce6788dbf897cdbca2f9bcc43a3af94c1838f48f84f935c9374306242
Vidar C&C: http://82.115.223.60/ | 82.115.223.60:80

Intelligence

File Origin

# of uploads :

# of downloads :

193

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Evil Hunters Launcher.exe

Verdict:

Malicious activity

Analysis date:

2022-12-16 19:46:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7410e1d1-0a82-46f2-b690-fd80445ee6cf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/347094/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.94163.20898.21284.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Sending a custom TCP request

Gathering data

Malware family:

Arkei Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/600bbd3e-d254-46cf-809d-2c3b767263c8

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1135950

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (creates a PE file in dynamic memory)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for sample

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8211ffa22a40ceb40b8aaa8102064550624b4d3977a6232c2b9bfaae4fdb071a/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2022-12-16 19:45:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qii77irkidhlic4kvkaqebsfkbrewtjzo6tcglbltp5k4t63a4na._file

Verdict:

malicious

ArkeiStealer

08c7eb81c268bbae91dedf391c1901461e786ee5cd401872100efad10812efc9

ArkeiStealer

2c993eb220436695d78783d2a6520951e4ce2b65311a96b904a063abdc088235

ArkeiStealer

6eaa17442216edf6c184c03e3b7468922c1b6d59fbf419f811552e2e86e0bcfe

ArkeiStealer

7a303a644be83a3692e2e6b871db1f3ed0614846377a6f43df53c77be161d22b

ArkeiStealer

90e453d7ffc1f80ae55e826e424eedbb56038650bb9d72ac729d62ad828dfee3

ArkeiStealer

bacdddfabf0476948f55a43f5bda407afa2f1cd4884e973a1722e3f674cc2a94

ArkeiStealer

c2caba260a9be5ad379a78211931ad66d1224aed61aee239874f5677f5aa38f9

ArkeiStealer

d7c42d1df0e957935b672b0633cf3dad39b5d8c85eec4631c62191915af02379

ArkeiStealer

+ 689 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/221216-ygdhaaac51/

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/2132073d-4824-4486-abfc-adbbc0f2b291

Unpacked files

SH256 hash:

8211ffa22a40ceb40b8aaa8102064550624b4d3977a6232c2b9bfaae4fdb071a

MD5 hash:

185bf36185cd8bb1ad463a70214ff84b

SHA1 hash:

7954ce0c541f4bc021d91c05235e8e22799a00a1

Link:

https://www.unpac.me/results/f2dadb11-a3f1-401f-bba3-33a918e22dc6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8211ffa22a40ceb40b8aaa8102064550624b4d3977a6232c2b9bfaae4fdb071a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.