MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96a543fb6b3113991070d4f7253570d8db02edd53b431ad5c64f7490d25525c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	96a543fb6b3113991070d4f7253570d8db02edd53b431ad5c64f7490d25525c6
SHA3-384 hash:	26f03661e84f7662af424310d43ada036aeb4a38d83fb795a326cc268ea48c68ceee2d0e70a2df2618c330a38756413b
SHA1 hash:	b19cbdf3a410856e975dce7f082df533c3193ec3
MD5 hash:	d361b389cc0257d39599bc8cebf4c998
humanhash:	hawaii-xray-green-arkansas
File name:	d361b389cc0257d39599bc8cebf4c998.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	257'536 bytes
First seen:	2021-12-11 06:53:19 UTC
Last seen:	2021-12-11 08:31:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fe609548539ae8502df3cf294274ad9f (1 x RedLineStealer, 1 x ArkeiStealer)
ssdeep	6144:zd3L/Nez0AlQygZySOgK72eSD0D1puzbgwu6Qiga0:zd3XAKya3K7RC8punn5
TLSH	T15444AD32B9F9C471C5A30D3058A09AE4497BB8316F20510BE66C7B9E6F72E9C55F231E
File icon (PE):
dhash icon	fcfcb4d4d4d4d8c0 (70 x RedLineStealer, 59 x RaccoonStealer, 24 x Smoke Loader)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d361b389cc0257d39599bc8cebf4c998.exe

Verdict:

Malicious activity

Analysis date:

2021-12-11 06:58:32 UTC

Tags:

loader stealer trojan

Link:

https://app.any.run/tasks/21ae1f90-a93b-492e-8436-e358a6ac396a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/213284/

Detection(s):

SecuriteInfo.com.Trojan.Siggen16.3709.14406.887.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creating a file

Reading critical registry keys

Query of malicious DNS domain

Stealing user critical data

Sending an HTTP GET request to an infection source

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1612/overview

Behaviour

MeasuringTime

SystemUptime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61b44b0dfa72c81b5b17e66f/reports/5738cc44-74e9-4e1d-89e2-d25923eeb4a0/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c5d6f398-609b-462f-802a-57d117228e13

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/905652

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd delete

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96a543fb6b3113991070d4f7253570d8db02edd53b431ad5c64f7490d25525c6/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-12-10 16:10:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s2suh63lgejzsedq2t3sknlq3dnqf3ovhnbrvvogj52jbusvexda._file

Result

Malware family:

arkei

Score:

10/10

Tags:

family:arkei discovery spyware stealer suricata

Link:

https://tria.ge/reports/211211-hn8c8scbgm/

Behaviour

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Arkei Stealer Payload

Arkei

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

Unpacked files

SH256 hash:

ae2678f29b35f4b86d8547a27ed8b9aef386afd03596c79f72dcb6945a356129

MD5 hash:

068b9c18778c7bcc4dcde3879d8c50a3

SHA1 hash:

05c4a8a893e84077c0eca2adeb03f832cb82df06

Link:

https://www.unpac.me/results/5a80705d-1c52-42d5-8684-2056f089a884/

SH256 hash:

96a543fb6b3113991070d4f7253570d8db02edd53b431ad5c64f7490d25525c6

MD5 hash:

d361b389cc0257d39599bc8cebf4c998

SHA1 hash:

b19cbdf3a410856e975dce7f082df533c3193ec3

Link:

https://www.unpac.me/results/5a80705d-1c52-42d5-8684-2056f089a884/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/96a543fb6b3113991070d4f7253570d8db02edd53b431ad5c64f7490d25525c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks