MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ff42d08999e01de0a69872bc8b53e2b037f9d3ba7ddb8b210b3c04bfdcd2c71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs 7 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ff42d08999e01de0a69872bc8b53e2b037f9d3ba7ddb8b210b3c04bfdcd2c71
SHA3-384 hash: c8ca7f7bc46fae8991b75f9b033e9139590d4dd4e3bc600698d6516f1ebc4796fe4385c20d3cd582900c365bb6e249de
SHA1 hash: 70eb8d86ab3e128c452b5674ab0597b9183e5ad5
MD5 hash: c59409eadfc776ab486cde93cdf70a93
humanhash: massachusetts-oregon-oxygen-finch
File name:c59409eadfc776ab486cde93cdf70a93.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:398'063 bytes
First seen:2022-03-13 18:20:55 UTC
Last seen:2022-03-13 19:43:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:TGi6yxDMlOYYIXFjOaT/4dRkMS/5WJ28WQp+95A4klgt:uyxDsbFjL47kJ/z8Ws+LAnlA
Threatray 4'356 similar samples on MalwareBazaar
TLSH T1FA84011F4CA0B822D9454733366A6B2D532F6E8D7DE9E2470B5CBBA9C7331C2401A9C2
File icon (PE):PE icon
dhash icon 4c33d8d4d4d8324c (40 x AgentTesla, 23 x RedLineStealer, 15 x RemcosRAT)
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://basig5.xyz/6.jpg

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://basig5.xyz/6.jpg https://threatfox.abuse.ch/ioc/395024/
http://basig5.xyz/1.jpg https://threatfox.abuse.ch/ioc/395025/
http://basig5.xyz/2.jpg https://threatfox.abuse.ch/ioc/395026/
http://basig5.xyz/3.jpg https://threatfox.abuse.ch/ioc/395027/
http://basig5.xyz/4.jpg https://threatfox.abuse.ch/ioc/395028/
http://basig5.xyz/5.jpg https://threatfox.abuse.ch/ioc/395029/
http://basig5.xyz/7.jpg https://threatfox.abuse.ch/ioc/395030/

Intelligence

File Origin
# of uploads :
2
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/249908/
Detection(s):
SecuriteInfo.com.Dropped.Trojan.GenericKDZ.84857.17047.31221.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/622e3611b94fb38cb472c661/reports/cc62adc8-dc43-4f03-b784-67724845c11e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb632a35-4ae6-4d00-b121-8dee30ef83c1
Result
Threat name:
Oski Stealer Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/955658
Signature
C2 URLs / IPs found in malware configuration
Downloads files with wrong headers with respect to MIME Content-Type
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Posts data to a JPG file (protocol mismatch)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Oski Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 588139 Sample: znwg6eS0T7.exe Startdate: 13/03/2022 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 7 other signatures 2->50 9 znwg6eS0T7.exe 18 2->9         started        process3 file4 36 C:\Users\user\AppData\Local\Temp\owhtw.exe, PE32 9->36 dropped 12 owhtw.exe 9->12         started        process5 signatures6 52 Multi AV Scanner detection for dropped file 12->52 54 Performs DNS queries to domains with low reputation 12->54 56 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 12->56 58 Injects a PE file into a foreign processes 12->58 15 owhtw.exe 196 12->15         started        20 backgroundTaskHost.exe 12->20         started        process7 dnsIp8 38 basig5.xyz 104.21.7.130, 49753, 80 CLOUDFLARENETUS United States 15->38 28 C:\ProgramData\vcruntime140.dll, PE32 15->28 dropped 30 C:\ProgramData\sqlite3.dll, PE32 15->30 dropped 32 C:\ProgramData\softokn3.dll, PE32 15->32 dropped 34 4 other files (none is malicious) 15->34 dropped 40 Tries to harvest and steal browser information (history, passwords, etc) 15->40 42 Tries to steal Crypto Currency Wallets 15->42 22 cmd.exe 1 15->22         started        file9 signatures10 process11 process12 24 taskkill.exe 1 22->24         started        26 conhost.exe 22->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ff42d08999e01de0a69872bc8b53e2b037f9d3ba7ddb8b210b3c04bfdcd2c71/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-10 18:55:46 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r72c2ceztya54ctjq4v4rnj6fmbx7hj3u7o3rmqqwpaex7onfryq._file
Verdict:
malicious
Similar samples:
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9
ArkeiStealer
6849e65e9ac20880fa99583b202ae710e0a3885cd72692a0c1b4d72aae109adf
ArkeiStealer
b61bba8ff91848c1f2b60dd8c98de6979f14c3366826e4d5c18c130758d5f050
ArkeiStealer
b8868eb87c7cb945704e2d0b8ec2ebdc890cd6df12f9ef0a7295582c7fd0cf1f
ArkeiStealer
be52ba286982ecb2bda4033824ce2fb1147300af2c5106cfed27cf3fb6022b1f
ArkeiStealer
d8454e6022d16c264f078c2a0b925dc70d08edd251dc6e86f1af4b24afd46bde
ArkeiStealer
+ 4'346 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware stealer suricata
Link:
https://tria.ge/reports/220313-w1fqmsbcek/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Oski
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
Malware Config
C2 Extraction:
http://basig5.xyz
Unpacked files
SH256 hash:
8ff42d08999e01de0a69872bc8b53e2b037f9d3ba7ddb8b210b3c04bfdcd2c71
MD5 hash:
c59409eadfc776ab486cde93cdf70a93
SHA1 hash:
70eb8d86ab3e128c452b5674ab0597b9183e5ad5
Link:
https://www.unpac.me/results/0099e65d-3af8-4f89-b735-85bcb9d3ea16/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
Link:
https://yomi.yoroi.company/submissions/8ff42d08999e01de0a69872bc8b53e2b037f9d3ba7ddb8b210b3c04bfdcd2c71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249908/

Comments