MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40
SHA3-384 hash: 18f6dba497afdeb37b54e8896d9bce5f479aafcc577aca8816632a523810fdda06dcf5f2fe6e2de948a860b8a8f42cf2
SHA1 hash: a2dea715e33a860dc09d09b219db18831e6bb1a5
MD5 hash: 7434b42e11380272961c92e061072e78
humanhash: minnesota-crazy-butter-two
File name:7434b42e11380272961c92e061072e78
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:7'387'352 bytes
First seen:2022-12-09 09:36:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f27ebcbe4049b07f90dd3733790155ae (1 x ArkeiStealer)
ssdeep 196608:xhWCcb/OtOBzdC0yo7R5aZPPrf4e0dNL4IkPZFsSM:xhWtb/OtOm0yo3alDfzUNPGZFM
TLSH T1AB76236317255189F4E1CC385637FEE572F3075A8B41BCBED4EAACC128275A4E223A53
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 82030303338393b2 (1 x ArkeiStealer)
Reporter zbetcheckin
Tags:32 ArkeiStealer exe signed

Code Signing Certificate

Organisation:uncommon company
Issuer:uncommon company
Algorithm:sha256WithRSAEncryption
Valid from:2022-12-08T01:06:50Z
Valid to:2023-12-08T01:26:50Z
Serial number: 1dfd1a0bd6ce1085439899f76e6c0329
Thumbprint Algorithm:SHA256
Thumbprint: 2567e5a6a91e9cd4ef79cb21d4caef2034b5a0fee7b2ef0b5144a213dddeaeea
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344650/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.18418.32135.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Creating a window
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Launching cmd.exe command interpreter
Stealing user critical data
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
arkei overlay packed
Link:
https://www.filescan.io/uploads/639301c004e0e79bdf41c287/reports/9525856f-6e94-468e-8292-be63638edc8a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/689101b3-f451-4c3d-99a9-0a9b1162edbb
Result
Threat name:
Amadey, Laplas Clipper, RedLine, SystemB
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1131309
Signature
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Found hidden mapped module (file has been removed from disk)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with function prologues
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd or bat file
System process connects to network (likely due to code injection or exploit)
Tries to detect debuggers (CloseHandle check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Amadeys stealer DLL
Yara detected Generic Downloader
Yara detected Laplas Clipper
Yara detected RedLine Stealer
Yara detected SystemBC
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 764033 Sample: DQxttu2Qrr.exe Startdate: 09/12/2022 Architecture: WINDOWS Score: 100 113 Malicious sample detected (through community Yara rule) 2->113 115 Antivirus detection for URL or domain 2->115 117 Antivirus detection for dropped file 2->117 119 13 other signatures 2->119 10 DQxttu2Qrr.exe 22 2->10         started        15 cmd.exe 2->15         started        17 gntuud.exe 2->17         started        19 cmd.exe 2->19         started        process3 dnsIp4 107 65.21.119.56 CP-ASDE United States 10->107 109 88.119.169.157 IST-ASLT Lithuania 10->109 111 8.8.8.8 GOOGLEUS United States 10->111 91 C:\Users\user\AppData\...\nppshell[1].exe, PE32 10->91 dropped 93 C:\ProgramData\61312899942613011832.exe, PE32 10->93 dropped 163 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->163 165 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->165 167 Query firmware table information (likely to detect VMs) 10->167 177 5 other signatures 10->177 21 61312899942613011832.exe 3 10->21         started        25 cmd.exe 1 10->25         started        169 Uses cmd line tools excessively to alter registry or file data 15->169 171 Uses powercfg.exe to modify the power settings 15->171 173 Modifies power options to not sleep / hibernate 15->173 27 conhost.exe 15->27         started        29 sc.exe 15->29         started        31 sc.exe 15->31         started        37 8 other processes 15->37 175 Hides threads from debuggers 17->175 33 conhost.exe 19->33         started        35 powercfg.exe 19->35         started        39 3 other processes 19->39 file5 signatures6 process7 file8 81 C:\Users\user\AppData\Local\...\gntuud.exe, PE32 21->81 dropped 147 Multi AV Scanner detection for dropped file 21->147 149 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 21->149 151 Tries to evade analysis by execution special instruction (VM detection) 21->151 153 2 other signatures 21->153 41 gntuud.exe 3 35 21->41         started        46 conhost.exe 25->46         started        48 timeout.exe 1 25->48         started        signatures9 process10 dnsIp11 105 85.209.135.109 CMCSUS Germany 41->105 83 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32 41->83 dropped 85 C:\Users\user\AppData\...\umciavi32.exe, PE32 41->85 dropped 87 C:\Users\user\AppData\...\umciavi64.exe, PE32 41->87 dropped 89 9 other malicious files 41->89 dropped 155 Multi AV Scanner detection for dropped file 41->155 157 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 41->157 159 Creates an undocumented autostart registry key 41->159 161 5 other signatures 41->161 50 Emit64.exe 41->50         started        54 rundll32.exe 41->54         started        57 umciavi64.exe 41->57         started        59 4 other processes 41->59 file12 signatures13 process14 dnsIp15 73 C:\Users\user\Locktime\RtkAudUService64.exe, PE32+ 50->73 dropped 75 C:\Users\user\AppData\Local\...\jekppnay.tmp, PE32+ 50->75 dropped 77 C:\Windows\System32\drivers\etc\hosts, ASCII 50->77 dropped 121 Multi AV Scanner detection for dropped file 50->121 123 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 50->123 125 Query firmware table information (likely to detect VMs) 50->125 141 6 other signatures 50->141 61 powershell.exe 50->61         started        95 192.168.2.3 unknown unknown 54->95 127 System process connects to network (likely due to code injection or exploit) 54->127 129 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 54->129 131 Tries to steal Instant Messenger accounts or passwords 54->131 143 3 other signatures 54->143 97 104.192.141.1 AMAZON-02US United States 57->97 99 54.231.164.65 AMAZON-02US United States 57->99 79 C:\Users\user\AppData\Local\...\advapi32.dll, PE32 57->79 dropped 133 Machine Learning detection for dropped file 57->133 135 Writes to foreign memory regions 57->135 137 Allocates memory in foreign processes 57->137 139 Injects a PE file into a foreign processes 57->139 101 89.22.236.225 INETLTDTR Russian Federation 59->101 103 45.159.188.118 HOSTING-SOLUTIONSUS Netherlands 59->103 145 2 other signatures 59->145 63 conhost.exe 59->63         started        65 conhost.exe 59->65         started        67 cmd.exe 1 59->67         started        69 5 other processes 59->69 file16 signatures17 process18 process19 71 conhost.exe 61->71         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40/
Threat name:
Win32.Infostealer.Bandra
Create hunting rule
Status:
Malicious
First seen:
2022-12-08 08:07:55 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=teregk72o5ul363ormdzzedujspt2m5fujmks6v4qum7qgtibzaa._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:systembc family:vidar botnet:1760 discovery persistence spyware stealer trojan
Link:
https://tria.ge/reports/221209-llgpaacg98/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Amadey
SystemBC
Vidar
Malware Config
C2 Extraction:
https://t.me/vmt001
85.209.135.109/jg94cVd30f/index.php
89.22.236.225:4193
176.124.205.5:4193
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/116ceb4b-54e0-49d1-a424-2094d66a1efb
Unpacked files
SH256 hash:
6e2d9c1079b3c81509a02a32fba5d20c08b04802994d70798574b9a648b0b7f9
MD5 hash:
7f5d1d19a22d0aa871cb8cfa0bcec78b
SHA1 hash:
891f8a17f38472a2ad0fc06157e219c4e659f4e4
Link:
https://www.unpac.me/results/2cb3bddd-fbdd-406a-84ae-43d30ded842b/
SH256 hash:
9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40
MD5 hash:
7434b42e11380272961c92e061072e78
SHA1 hash:
a2dea715e33a860dc09d09b219db18831e6bb1a5
Link:
https://www.unpac.me/results/2cb3bddd-fbdd-406a-84ae-43d30ded842b/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9922432bfa77/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 9922432bfa7768bdfb6e8b079c90744c9f3d33a5a258a97abc8519f81a680e40

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2452290/
Cape
Cape
https://www.capesandbox.com/analysis/344650/

Comments


Avatar
zbet commented on 2022-12-09 09:37:02 UTC

url : hxxp://ripple-wells-2022.net/yzoyoebw6fqrey/nppshell32.exe