MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a5358e36a3bba6d050a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a5358e36a3bba6d050a1
SHA3-384 hash: ae9e55591a217c92f1ea14395689dffef50d51a8f350c7d7bf095c9ae878f053e889416184c28067ec1f9767b0fd2a0a
SHA1 hash: fabb8e8a29d92cf4dd676e4527316006fef41c3a
MD5 hash: 5b63b2a806501c72f90475bbabe93819
humanhash: indigo-crazy-maryland-coffee
File name:9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:690'688 bytes
First seen:2021-05-29 12:10:42 UTC
Last seen:2021-05-29 12:47:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 306d2c653e9f2457b44a38149955df00 (4 x Stop, 1 x DanaBot, 1 x ArkeiStealer)
ssdeep 12288:cdMPKT+0XYeptMt4yqGzaHxzYIfcVU14p/jUdZ1WKz8nd:cTT+FcyXzaZY7Vhp/jCId
Threatray 281 similar samples on MalwareBazaar
TLSH D8E4E130BA91C034E8F255BED979A96D9C3ABDE39B6440CB53C537EA16301E2AD30717
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://162.55.189.102/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://162.55.189.102/ https://threatfox.abuse.ch/ioc/65642/

Intelligence

File Origin
# of uploads :
2
# of downloads :
309
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a.exe
Verdict:
Malicious activity
Analysis date:
2021-05-29 12:15:52 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/bc97392a-f609-4549-84ba-e6c7224ba116

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/163170/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.30507.13836.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Replacing files
Reading critical registry keys
Creating a window
Delayed writing of the file
Changing the Zone.Identifier stream
Creating a process from a recently created file
Creating a process with a hidden window
Running batch commands
Creating a file in the %temp% subdirectories
Using the Windows Management Instrumentation requests
Searching for the window
Launching a process
Stealing user critical data
Launching a tool to kill processes
Forced shutdown of a browser
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/794236
Signature
Antivirus detection for URL or domain
Creates files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 426632 Sample: 9553d0dcdf7b666c65cb7d42c09... Startdate: 29/05/2021 Architecture: WINDOWS Score: 56 98 Found malware configuration 2->98 100 Antivirus detection for URL or domain 2->100 102 Yara detected Vidar stealer 2->102 104 2 other signatures 2->104 9 9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a.exe 95 2->9         started        14 FastVD.exe 2->14         started        16 FastVD.exe 2->16         started        18 FastVD.exe 2->18         started        process3 dnsIp4 80 ngfxshgf.space 83.220.174.101, 49729, 80 THEFIRST-ASRU Russian Federation 9->80 82 api.faceit.com 104.17.63.50, 443, 49726 CLOUDFLARENETUS United States 9->82 84 162.55.189.102, 49727, 80 ACPCA United States 9->84 54 C:\ProgramData\9QCXHIMJEZKC85GJ.exe, PE32 9->54 dropped 56 C:\...\9QCXHIMJEZKC85GJ.exe:Zone.Identifier, ASCII 9->56 dropped 58 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 9->58 dropped 60 12 other files (none is malicious) 9->60 dropped 106 Detected unpacking (changes PE section rights) 9->106 108 Detected unpacking (overwrites its own PE header) 9->108 110 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 9->110 112 5 other signatures 9->112 20 9QCXHIMJEZKC85GJ.exe 2 9->20         started        23 cmd.exe 1 9->23         started        86 172.67.132.5, 443, 49768 CLOUDFLARENETUS United States 14->86 88 fastytd.com 14->88 90 fastpctools.com 14->90 25 FastVD.exe 14->25         started        file5 signatures6 process7 file8 52 C:\Users\user\...\9QCXHIMJEZKC85GJ.tmp, PE32 20->52 dropped 27 9QCXHIMJEZKC85GJ.tmp 35 93 20->27         started        30 taskkill.exe 1 23->30         started        32 conhost.exe 23->32         started        34 timeout.exe 1 23->34         started        process9 file10 62 C:\Users\user\AppData\...\itdownload.dll, PE32 27->62 dropped 64 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 27->64 dropped 66 C:\Program Files (x86)\...\is-B2IHG.tmp, PE32 27->66 dropped 68 40 other files (none is malicious) 27->68 dropped 36 iexplore.exe 2 83 27->36         started        39 FastVD.exe 27->39         started        41 taskkill.exe 1 27->41         started        43 taskkill.exe 1 27->43         started        process11 dnsIp12 70 4.0.0.8 LEVEL3US United States 36->70 72 www.fastpctools.com 36->72 45 iexplore.exe 53 36->45         started        74 ic.tynt.com 208.100.17.184, 443, 49786 STEADFASTUS United States 39->74 76 de.tynt.com 208.100.17.186, 443, 49787, 49788 STEADFASTUS United States 39->76 78 11 other IPs or domains 39->78 48 conhost.exe 41->48         started        50 conhost.exe 43->50         started        process13 dnsIp14 92 rec.mouseflowaps.netdna-cdn.com 23.111.9.38, 443, 49747, 49748 HIGHWINDS2US United States 45->92 94 googleads.g.doubleclick.net 172.217.20.226, 443, 49755, 49756 GOOGLEUS United States 45->94 96 10 other IPs or domains 45->96
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a5358e36a3bba6d050a1/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-29 12:11:09 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=svj5bxg7pntgyzolpvbmbeuspsfovy2j54ykknmog2r3xjwqkcqq._file
Verdict:
malicious
Similar samples:
04db0b6b37fcd16563eaeb06996b2ab0c676f53cb1445d9b40eb46fa2c38c641
ArkeiStealer
3c2fa1d04daaea31991c29bb4118c3d146a50815a033ea5ae325c3171ebdf713
ArkeiStealer
7827054de38b851b5e28c8553d564eca5d1047d5756f7733250af348c689c8f1
ArkeiStealer
7c1648815aa70e879d1f6f542ae8c41ba912305fe8adc70f5970026adc2e46a6
ArkeiStealer
864ef1321215c0dad7c8677e3c18942b111468c63358475baa71fb1679c25096
ArkeiStealer
a28956c03af41c83a80a84889bd4b2528c3842f14ca44d7c2d3362cbaa036b8d
ArkeiStealer
cb3c387163302fbf8ddb4c13e9d786c1070a4185a74bdd3faebd1649d02b2b30
ArkeiStealer
d95e32a27fb48282c70ef999999d4892c2fbff18b43b68d632457f11261b2bfb
ArkeiStealer
f91c7c2e15b7343d97bc5c3961f43ebd659440102a4a9c3359d7a9e6e0aef9d3
ArkeiStealer
ff4a3e44fcd1cfbbf10ac318aca7559e0c20d0563e11e8a98e21e09e97ca68d3
ArkeiStealer
+ 271 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery spyware stealer
Link:
https://tria.ge/reports/210529-esyrpk4xc2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads local data of messenger clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9553d0dcdf7b666c65cb7d42c092927c8aeae349ef30a5358e36a3bba6d050a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163170/

Comments