MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9017bf55c92b9f08174c0f52bdb90099a8122cf1052ea1f0f2b2781c574749a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9017bf55c92b9f08174c0f52bdb90099a8122cf1052ea1f0f2b2781c574749a4
SHA3-384 hash: 752cbd850bdf4e5a9357bfddd2872f21bb481a963bd774c3ba3908f100a64d4062ba8e2bc707f7331de0912715fdeb56
SHA1 hash: 5dd39a687a02ed02dace8431250381f8b44b3064
MD5 hash: 2b3b0a6709865edeef03c358e6b5d453
humanhash: blue-nine-butter-tango
File name:SecuriteInfo.com.W32.AIDetect.malware1.2368.1926
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:757'248 bytes
First seen:2021-09-09 17:38:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a07e2478ced6ea4bff168cbb215d0722 (4 x ArkeiStealer, 3 x Stop, 1 x CryptBot)
ssdeep 12288:2aB0CTOSeDC/YVWqPJGHFLnevlBqwUB6ZXgu7SzhZrdDuy1GKm2Jf65sYbOwzdPE:d0CTeTkqPIH4v7TUB2gu7StZrRuyM2Ji
Threatray 3'293 similar samples on MalwareBazaar
TLSH T1FBF4F120B6A0C035F0B756F449BA93B9A93DBEB16B3050CB12D127FA56356E8DC30797
dhash icon e0e8e8e8aa62a499 (12 x RaccoonStealer, 9 x RedLineStealer, 7 x ArkeiStealer)
Reporter SecuriteInfoCom
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.2368.1926
Verdict:
Malicious activity
Analysis date:
2021-09-09 17:40:30 UTC
Tags:
trojan stealer vidar
Link:
https://app.any.run/tasks/c511bbab-dba6-4dd8-9aba-7fc0008ca0f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/186724/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.2368.1926.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Replacing files
Reading critical registry keys
Sending a UDP request
Creating a window
Delayed writing of the file
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Launching a process
Query of malicious DNS domain
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Forced shutdown of a browser
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/09d4e022-c1ac-4bda-8e8d-35d15f11f89d
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/848336
Signature
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9017bf55c92b9f08174c0f52bdb90099a8122cf1052ea1f0f2b2781c574749a4/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-09 17:39:06 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sal36vojfopqqf2mb5jl3oiatgubelhrauxkd4hswj4byv2hjgsa._file
Verdict:
malicious
Similar samples:
1a7791d5b04285493cd09bcffbcde55a71a3049e493bbe535d9e0b80966a7a61
ArkeiStealer
4138442b73cdafa8f00d78734836ef77dffe605631277f562c9ae06f1d8d7b3c
ArkeiStealer
89ab5950922412dfca45e81579274744b73d8cbee953bd5bf1e5b4cd42bc4af4
ArkeiStealer
8c98a7c9446f00b61acdccc30d9e50f3ee651530a4131cfc3956c1949526fbb4
ArkeiStealer
aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e
ArkeiStealer
bda50305ae45fef3bd35d1c178ccd0087ca6a39e8657f69fdab4c080203c7a04
ArkeiStealer
bf533a96d61a84c9ad9e3087059b8d37088f135d0a30006a106deaaa34d8550a
ArkeiStealer
c9371cc485825207fe107e6600c14cfd9049c34f74c8c7332f16a20afea88164
ArkeiStealer
e0a10b9883175aaf59200cd47395e8cc9e40972cb235622e2dd699563938aec3
ArkeiStealer
e91557046e000b4f2947659394d496971e507002f721bdc65a03b9637900bbe9
ArkeiStealer
+ 3'283 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:916 discovery spyware stealer suricata
Link:
https://tria.ge/reports/210909-v8ac6abfhp/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
https://gheorghip.tumblr.com/
Unpacked files
SH256 hash:
bfdfb788f645cece2059fd418a3af9ac6a89eaa231a81eae1eecd4c65f4fa5c2
MD5 hash:
f18884a29ec3f786bf64076e89325af4
SHA1 hash:
a67d0fca3775857ab25e3b5082de102dc4901a97
Link:
https://www.unpac.me/results/957045cd-c6e4-44b9-9263-26792b21106c/
SH256 hash:
9017bf55c92b9f08174c0f52bdb90099a8122cf1052ea1f0f2b2781c574749a4
MD5 hash:
2b3b0a6709865edeef03c358e6b5d453
SHA1 hash:
5dd39a687a02ed02dace8431250381f8b44b3064
Link:
https://www.unpac.me/results/957045cd-c6e4-44b9-9263-26792b21106c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9017bf55c92b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9017bf55c92b9f08174c0f52bdb90099a8122cf1052ea1f0f2b2781c574749a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/186724/

Comments