MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 16 File information Comments

SHA256 hash:	99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1
SHA3-384 hash:	2625eb61f42b9849c0ffb563862b925f2b8c04ed6a996a98615635dff55c3dc039adb849bc136678098d7971076c9c8b
SHA1 hash:	a515c1aaffa631af4b6a361568fc304bda06b51e
MD5 hash:	dc7da4098bb13485b2eb13162e572acb
humanhash:	wisconsin-arkansas-video-beryllium
File name:	file
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	3'373'056 bytes
First seen:	2026-01-19 14:28:15 UTC
Last seen:	2026-01-19 17:59:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c25f27d433e84e004eba6eba6c3cb034 (4 x ArkeiStealer)
ssdeep	98304:0d2eR/Frq3RLV85GuhnEE/4plEBQXint6:0d76BJ85fE6Ul0hnt6
TLSH	T155F53350D83350EEF90B09BD115493BBA8E3FA265335CEF85AC0DEA2E975601439B61F
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	ArkeiStealer dropped-by-amadey exe fbf543

Bitsight

url: http://130.12.180.43/files/7103746036/sOtWKnM.exe

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

teamviewer

ID:

File name:

_99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1.exe

Verdict:

Malicious activity

Analysis date:

2026-01-19 14:30:27 UTC

Tags:

stealer santastealer teamviewer rmm-tool tightvnc

Link:

https://app.any.run/tasks/05724738-c2d8-43ad-bcd9-383eaa23c727

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49332/

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.51346482.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=696e3f94bcad3327ec0664a7

Tags:

phishing emotet lien

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug crypt crypto packed

Link:

https://www.filescan.io/uploads/696e3f8ff3c1b7b1fbd77e6f/reports/622281de-ed79-48d8-9fdf-63e30ff06c12/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-01-19T11:39:00Z UTC

Last seen:

2026-01-19T13:38:00Z UTC

Hits:

~10

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1/results?tab=lookup

Malware family:

Santastealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a58c9e80-09fb-4df8-ae95-7929c12a5394

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/dc7da4098bb13485b2eb13162e572acb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1/

Verdict:

Malicious

Threat:

Family.SANTASTEALER

Link:

https://tip.neiki.dev/file/99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-01-19 14:28:47 UTC

File Type:

PE+ (Exe)

AV detection:

7 of 36 (19.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=th2kdywyfdrmjyzaqtcrwjv5borcvduye53fg4qe4emwkprofwyq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access discovery spyware stealer

Link:

https://tria.ge/reports/260119-rs9arscz3b/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Browser Information Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Enumerates connected drives

Checks computer location settings

Credentials from Password Stores: Windows Credential Manager

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1c30b7db-3fc8-4299-9768-b0606ade40b7

Unpacked files

SH256 hash:

99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1

MD5 hash:

dc7da4098bb13485b2eb13162e572acb

SHA1 hash:

a515c1aaffa631af4b6a361568fc304bda06b51e

Link:

https://www.unpac.me/results/60f41a7e-6790-4364-8e4a-b50202247dee/

Malware family:

SteamExfiltrator

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/99f4a1e2d828/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/99f4a1e2d828e2c4e32084c51b26bd0ba22a8e982776537204e119653e2e2db1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	Heuristics_ChromeABE Create hunting rule
Author:	Still
Description:	attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research