MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ab7cd42f6b90e250f69f4c96efb32d36135bb1479acfec28344a4910a3a329b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ab7cd42f6b90e250f69f4c96efb32d36135bb1479acfec28344a4910a3a329b
SHA3-384 hash: 04fc6a2101926a98bc14f49a03eed39a7e0bfcb6857e4af40a3ab0f6b1e92599fb45e487eb3f4e344127cc95d05c0644
SHA1 hash: 99076253840698cfce2a7763ea7b2ddd3808e41e
MD5 hash: 18e5cd2ae346c068e188d1b28e4fd62c
humanhash: summer-dakota-batman-johnny
File name:18e5cd2ae346c068e188d1b28e4fd62c.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:379'392 bytes
First seen:2022-02-13 16:50:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 810e5fec95bbb1ba435e4f98882fffc1 (2 x ArkeiStealer)
ssdeep 6144:aOdA4xuJa63Fn14Jtv3HVB+cZe/U4yY0RweNOn89io:PdLuJFV14JFn+cZe+XVM
Threatray 840 similar samples on MalwareBazaar
TLSH T10D849F00BBA0D03DF1B712F8797593A96A2E7EB15B2150CB62D52AEE16356D0DCF130B
File icon (PE):PE icon
dhash icon e8e8e8e8aa66a499 (51 x RaccoonStealer, 27 x ArkeiStealer, 22 x RedLineStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241190/
Detection(s):
Win.Malware.Generic-9936539-0
Create hunting rule

Win.Dropper.Zenpak-9938419-0
Create hunting rule

Win.Packed.Filerepmalware-9938531-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Creating a window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/37ebca62-6e74-40e1-a559-9f287053fb61
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/938975
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ab7cd42f6b90e250f69f4c96efb32d36135bb1479acfec28344a4910a3a329b/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2022-02-13 15:42:42 UTC
File Type:
PE (Exe)
Extracted files:
34
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3133fa158ceed84616d846bee91ef670425cc5568b5a96c34b48a9c8bcfe52ea
ArkeiStealer
368840602d84502f7c1588c828266ea6e0990e4506048f5c85339042e2d7e706
ArkeiStealer
61b00eaf8df198caa3cbc58ca74b748538c88f55cbe7c7a702a7d4fb29879e9b
ArkeiStealer
6ffeae0bcdb13bc7aeb7bc57ead60db4c88d40aca6596c0f309031e8109b6be0
ArkeiStealer
89667f582fc57b39ad83e402d591e07c33203a687a606a551a4894ccee03398f
ArkeiStealer
969056d8fd647fa92a67a740c4bd4b76cad0e51ec670b281e04acc590a1ba4fd
ArkeiStealer
b0fc7a2a5bc24543f56dc08e65950baec2b3d28bd900309321b912bb09a37e90
ArkeiStealer
c9513adf4fa12a4f707667571b5ca11aef6ba70d5896eea4854b185d417925fa
ArkeiStealer
f938a7c0ebc32402cc6d0a2535eaac499468a2eadab4d38337fe6ddcce5eb7d2
ArkeiStealer
+ 830 additional samples on MalwareBazaar
Result
Malware family:
arkei
Create hunting rule
Score:
  10/10
Tags:
family:arkei botnet:default discovery spyware stealer
Link:
https://tria.ge/reports/220213-vct3padddk/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Arkei
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://woou.link/548152.php
Unpacked files
SH256 hash:
8b8961730ab6a6c133500dcceaad64ccfe50c4cc8813f849fe29b2ed6b77ec32
MD5 hash:
820b09373435c143c910d40f338a59dd
SHA1 hash:
40cdf5bee9485a44bd8a137ae067b6bf6a96d4db
Link:
https://www.unpac.me/results/d7860647-0b18-4953-a6ed-d1c13c9ba25d/
SH256 hash:
8ab7cd42f6b90e250f69f4c96efb32d36135bb1479acfec28344a4910a3a329b
MD5 hash:
18e5cd2ae346c068e188d1b28e4fd62c
SHA1 hash:
99076253840698cfce2a7763ea7b2ddd3808e41e
Link:
https://www.unpac.me/results/d7860647-0b18-4953-a6ed-d1c13c9ba25d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 8ab7cd42f6b90e250f69f4c96efb32d36135bb1479acfec28344a4910a3a329b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2041783/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/241190/

Comments