MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4
SHA3-384 hash: 515fe6b030dfd7d05bfebfa289691abd533035952182576804fc0cf62fda4425e934585ddd9b922b69c10fb160c2d873
SHA1 hash: 8df7fa396847aac6da5cf39d79d2cb02e86fbce2
MD5 hash: 3d35e52d9430297bb0e2e59acece074e
humanhash: friend-dakota-two-crazy
File name:3d35e52d9430297bb0e2e59acece074e.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:711'168 bytes
First seen:2021-09-08 13:44:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6dab62bef35d8c78b898fe6e2d2563ad (6 x RaccoonStealer, 2 x RedLineStealer, 1 x CoinMiner)
ssdeep 12288:EGxWPebj7n54eflbj+YzDN4JPmzph/p6Lg/Y0Ki4Esyp4XvBkO5qzBJUnaYO:EJ4fNfVZDN4VmHp6x0XlpKksuHUnaY
Threatray 3'265 similar samples on MalwareBazaar
TLSH T1E8E4F130A6A0C037F6A761F549BD8F68252DBDB19B3450CB22D43AAE53345E09D347AF
dhash icon d824e790c4e72158 (30 x RaccoonStealer, 18 x RedLineStealer, 16 x Smoke Loader)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Cube_WW2.exe
Verdict:
Malicious activity
Analysis date:
2021-09-08 11:08:27 UTC
Tags:
loader autoit evasion trojan rat redline stealer raccoon
Link:
https://app.any.run/tasks/52a01106-e6c5-4ed4-a46d-cd63f9df776d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186378/
Detection(s):
Win.Packed.Generic-9891348-0
Create hunting rule

Win.Packed.Generic-9891355-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Replacing files
Reading critical registry keys
Creating a window
Delayed writing of the file
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Launching a process
Query of malicious DNS domain
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Forced shutdown of a browser
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0010668f-6675-4cf0-ba90-a52445444666
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/847451
Signature
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-09-08 13:45:19 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rgvvsueseqjn7ssf5akxsj2his3t3df65fj32w7r4w2m2qv4jl2a._file
Verdict:
malicious
Similar samples:
11adb6fd4fbcb8fe68033ff2bc3b8cc45b980c573f7c58be291383d5b95d6e41
ArkeiStealer
1a7791d5b04285493cd09bcffbcde55a71a3049e493bbe535d9e0b80966a7a61
ArkeiStealer
2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324
ArkeiStealer
4138442b73cdafa8f00d78734836ef77dffe605631277f562c9ae06f1d8d7b3c
ArkeiStealer
9abec502e3a5167e3851de29c80c681de2c6ab879a0c49646f92761018c7987b
ArkeiStealer
aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e
ArkeiStealer
b3748a0976c91a7310d0d38d42c91b1d7ba37364d58c5bed902cc6641d31cadc
ArkeiStealer
e671deac46898cd1ce138deb64f63c2a7d09f40b593213e2337b0ffa08aab8e7
ArkeiStealer
fd0883f748efb5fdce5e83245d3bb5bf94d6c7875fd5147a2c87eb9a0c54b56f
ArkeiStealer
+ 3'255 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:1012 discovery spyware stealer suricata
Link:
https://tria.ge/reports/210908-q2el3shgcm/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
https://gheorghip.tumblr.com/
Unpacked files
SH256 hash:
3a09ed9b68d718ba468b394510a956ac9e9957f515cc0caaf81dbb994227efd4
MD5 hash:
936f9e200cb9d07dcfea674a31ec8d44
SHA1 hash:
716fc4b8464d1021d680c4b70120143c6f05a9f0
Link:
https://www.unpac.me/results/9fd24e3d-2d0d-4d2c-a71f-3e7e93f022f5/
SH256 hash:
89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4
MD5 hash:
3d35e52d9430297bb0e2e59acece074e
SHA1 hash:
8df7fa396847aac6da5cf39d79d2cb02e86fbce2
Link:
https://www.unpac.me/results/9fd24e3d-2d0d-4d2c-a71f-3e7e93f022f5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/89ab59509224/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/186378/
  
URLhaus
https://urlhaus.abuse.ch/url/1549210/
  
Delivery method
Distributed via web download

Comments