MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aa1689d6acacf9f2eb2603db52dc5908e1ec5d80000deec13e2e038c2883413. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 10


Intelligence 10 IOCs 2 YARA 22 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8aa1689d6acacf9f2eb2603db52dc5908e1ec5d80000deec13e2e038c2883413
SHA3-384 hash: 33fce759ce03dfab4dc518d9176acc79fb0be592486feb25250d6d0233b096705195e0e2cdc342f97a35c5bf0892bbe9
SHA1 hash: b88ba20c317e1ca600d918d63ae218b2a96ea6ad
MD5 hash: 98a4eb2d84f8cf5ef10a8a8af478aff8
humanhash: cup-aspen-salami-fillet
File name:98A4EB2D84F8CF5EF10A8A8AF478AFF8.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:7'228'719 bytes
First seen:2021-05-10 22:15:45 UTC
Last seen:2021-05-10 23:01:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c9adc83b45e363b21cd6b11b5da0501f (82 x ArkeiStealer, 60 x RecordBreaker, 46 x RedLineStealer)
ssdeep 196608:it4c/en7NN/0TbxqyEgmhr+JBxtLwCULB04Y:JsTbxOgmhr+J7TQZY
Threatray 686 similar samples on MalwareBazaar
TLSH 3A76333ED1958075E2360134CA87D3B3F578B940BF9E548F0BDBAE2A4EA9344276417B
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://195.201.94.135/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://195.201.94.135/ https://threatfox.abuse.ch/ioc/34548/
94.103.86.101:80 https://threatfox.abuse.ch/ioc/34973/

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/154551/
Detection(s):
Win.Malware.Fabookie-9797757-0
Create hunting rule

Win.Malware.Generic-9849070-0
Create hunting rule

SecuriteInfo.com.PSW.Generic8.ISF.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Delayed reading of the file
Creating a file in the %temp% subdirectories
Creating a file in the Program Files subdirectories
Deleting a recently created file
Creating a process from a recently created file
Creating a process with a hidden window
Sending a UDP request
Creating a file
Creating a file in the Program Files directory
Launching a process
Creating a file in the Windows subdirectories
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Reading critical registry keys
Enabling the 'hidden' option for recently created files
Running batch commands
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Launching the process to create tasks for the scheduler
Sending an HTTP GET request to an infection source
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cookie Stealer Cyberduck RedLine Socelar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/777870
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Drops PE files to the document folder of the user
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sets debug register (to hijack the execution of another thread)
Sigma detected: Suspicious Svchost Process
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Cookie Stealer
Yara detected Cyberduck
Yara detected RedLine Stealer
Yara detected Socelars
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 410266 Sample: iIoO9qC8yj.exe Startdate: 11/05/2021 Architecture: WINDOWS Score: 100 101 212.86.114.14 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 2->101 103 104.21.40.195 CLOUDFLARENETUS United States 2->103 105 2 other IPs or domains 2->105 121 Found malware configuration 2->121 123 Malicious sample detected (through community Yara rule) 2->123 125 Antivirus detection for dropped file 2->125 127 18 other signatures 2->127 9 iIoO9qC8yj.exe 14 18 2->9         started        signatures3 process4 file5 61 C:\Program Files (x86)\...\lighting.exe, PE32 9->61 dropped 63 C:\Program Files (x86)\...\jg7_7wjg.exe, PE32 9->63 dropped 65 C:\Program Files (x86)\...\hjjgaa.exe, PE32 9->65 dropped 67 9 other files (6 malicious) 9->67 dropped 12 guihuali-game.exe 4 9->12         started        15 LabPicV3.exe 2 9->15         started        17 lylal220.exe 2 9->17         started        19 7 other processes 9->19 process6 dnsIp7 85 C:\Program Files\install.dll, PE32 12->85 dropped 87 C:\Program Files\libEGL.dll, PE32+ 12->87 dropped 23 rundll32.exe 3 12->23         started        89 C:\Users\user\AppData\Local\...\LabPicV3.tmp, PE32 15->89 dropped 26 LabPicV3.tmp 15->26         started        91 C:\Users\user\AppData\Local\...\lylal220.tmp, PE32 17->91 dropped 29 lylal220.tmp 17->29         started        107 101.36.107.74 UHGL-AS-APUCloudHKHoldingsGroupLimitedHK China 19->107 109 208.95.112.1 TUT-ASUS United States 19->109 111 12 other IPs or domains 19->111 93 C:\Users\user\Documents\...\jg7_7wjg.exe, PE32 19->93 dropped 95 C:\Users\...\rnaJcrDqBOz7v2hpGDYwuIOK.exe, PE32 19->95 dropped 97 C:\Users\...\8is69b1iL5QmC4Ie5m4AZ3rc.exe, PE32 19->97 dropped 99 23 other files (2 malicious) 19->99 dropped 129 Injects a PE file into a foreign processes 19->129 32 jfiag3g_gg.exe 1 19->32         started        34 jfiag3g_gg.exe 19->34         started        file8 signatures9 process10 dnsIp11 137 Writes to foreign memory regions 23->137 139 Allocates memory in foreign processes 23->139 141 Creates a thread in another existing process (thread injection) 23->141 36 svchost.exe 23->36 injected 69 C:\Users\user\AppData\Local\...\3316505.exe, PE32 26->69 dropped 71 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 26->71 dropped 73 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 26->73 dropped 75 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 26->75 dropped 39 3316505.exe 26->39         started        119 199.188.201.83 NAMECHEAP-NETUS United States 29->119 77 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 29->77 dropped 79 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 29->79 dropped 81 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 29->81 dropped 83 C:\Users\user\AppData\Local\...\4_177039.exe, PE32 29->83 dropped 43 4_177039.exe 29->43         started        143 Tries to harvest and steal browser information (history, passwords, etc) 32->143 file12 signatures13 process14 dnsIp15 131 Sets debug register (to hijack the execution of another thread) 36->131 133 Modifies the context of a thread in another process (thread injection) 36->133 113 198.54.126.101 NAMECHEAP-NETUS United States 39->113 115 13.107.4.50 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 39->115 117 2 other IPs or domains 39->117 45 C:\Users\user\AppData\...\Pywaeqetuhe.exe, PE32 39->45 dropped 47 C:\Program Files (x86)\...\Kejaebirody.exe, PE32 39->47 dropped 49 C:\Users\user\...\Pywaeqetuhe.exe.config, XML 39->49 dropped 57 3 other files (1 malicious) 39->57 dropped 135 Detected unpacking (overwrites its own PE header) 39->135 51 C:\Users\user\AppData\...\Jaenakipihe.exe, PE32 43->51 dropped 53 C:\Program Files (x86)\...\Libucasone.exe, PE32 43->53 dropped 55 C:\Users\user\...\Jaenakipihe.exe.config, XML 43->55 dropped 59 3 other files (1 malicious) 43->59 dropped file16 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8aa1689d6acacf9f2eb2603db52dc5908e1ec5d80000deec13e2e038c2883413/
Threat name:
Win32.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2021-05-07 03:14:49 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rkqwrhlkzlhz6lvsma63klofschb5royaaan53at4lqdrquigqjq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
328c5eb8908b83c474ab4ab892ac1c2cae066f1f55dbcd15d850b54cc0f4c3cc
ArkeiStealer
362911dc126bfc3bf0edde07ab4dcf66e79830f1da312942b1731b6f45ac9da5
ArkeiStealer
55d33f116ca5cbd1e8bbf9151c2f457f7f045c8b00b7980cada01d20e9bd29c6
ArkeiStealer
5f3507cbeaeda2b6fa6b1144782f45f17c274d30fba40fa1ee9b302496242265
ArkeiStealer
630a85d082105029c1f4962acea125d2dd7da277c060ee51544f748a58d0daaf
ArkeiStealer
757e7c2569cc52c9e1639fbca06e957cb40f775d5cb1a8aafa670131b62b0824
ArkeiStealer
7c7cff0a48bcfe565fb02e3a39087ce2ad56d5b1c57b229f2d0142f41b7ab191
ArkeiStealer
9a048c8436c448e99a3a7047781ddc5d14a323660bd69f9fd7432c316083e3b6
ArkeiStealer
a034705c6ed17fa615435d02d6419e18ffe9a7f16f1f1c712a657aa1a0d90193
ArkeiStealer
d4e27b8e7e1fd965522468bdc3eaf06513dd3a3e7402d9b441ab002dfc892adc
ArkeiStealer
+ 676 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:fickerstealer family:raccoon family:redline family:smokeloader family:xmrig botnet:9619e19f8c44d64b389c83b7650d225862cc0ce9 backdoor discovery infostealer miner persistence spyware stealer trojan upx vmprotect
Link:
https://tria.ge/reports/210510-mv8nevtaee/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
VMProtect packed file
XMRig Miner Payload
Process spawned unexpected child process
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
fickerstealer
xmrig
Malware Config
C2 Extraction:
truzen.best:80
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Dropper Extraction:
http://miranore.top/ASHASHAShOWIWWWQQQ/img/bss.png
http://miranore.top/ASHASHAShOWIWWWQQQ/img/ass.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8aa1689d6acacf9f2eb2603db52dc5908e1ec5d80000deec13e2e038c2883413

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_Fabookie
Create hunting rule
Author:ditekSHen
Description:Detects Fabookie / ElysiumStealer
Rule name:MALWARE_Win_HyperPro03
Create hunting rule
Author:ditekSHen
Description:Hunt HyperPro IronTiger / LuckyMouse / APT27 malware
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/154551/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-10 23:02:31 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [F0002.002] Collection::Polling
3) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
4) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
5) [C0032.001] Data Micro-objective::CRC32::Checksum
6) [C0060] Data Micro-objective::Compression Library
7) [C0026.002] Data Micro-objective::XOR::Encode Data
9) [C0046] File System Micro-objective::Create Directory
10) [C0048] File System Micro-objective::Delete Directory
11) [C0047] File System Micro-objective::Delete File
12) [C0049] File System Micro-objective::Get File Attributes
13) [C0051] File System Micro-objective::Read File
14) [C0050] File System Micro-objective::Set File Attributes
15) [C0052] File System Micro-objective::Writes File
16) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
17) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
18) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
19) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
20) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
21) [C0017] Process Micro-objective::Create Process
22) [C0041] Process Micro-objective::Set Thread Local Storage Value
23) [C0018] Process Micro-objective::Terminate Process