MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c2eb5790e7874950db0e51764ba68bb4a0fa5be68b659717c73363883da0db7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c2eb5790e7874950db0e51764ba68bb4a0fa5be68b659717c73363883da0db7
SHA3-384 hash: 253c2f953737f89049d4939c193c99f10e3db78f9a7547caec506c2839a625c958b10886e16b61b57fa94247de51af3a
SHA1 hash: c23b9135e50632598f1206af52ee513d596554d3
MD5 hash: c7afbfec3614cf13de8bd9e4a0f86c5e
humanhash: utah-fanta-oscar-twelve
File name:SecuriteInfo.com.Generic.mg.c7afbfec3614cf13.27230
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:268'288 bytes
First seen:2020-06-05 05:37:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9f4a7a8053c38f7b2b397f1ec1cd7a6d (1 x ArkeiStealer)
ssdeep 3072:q3g/mCH0ATdWhNmEeZsckaEeT5oHxixRZcF7G6XowYpGZnOwTqy9SgdR+1pQ9kUm:Mg+hATgBckJwjROk6LNZnOwTqZgPEeJ
Threatray 302 similar samples on MalwareBazaar
TLSH 6344BEB5C3856545E38938BE27548EE21841760BAFF85F7942A0215DFA2FBFCA036533
Reporter SecuriteInfoCom
Tags:ArkeiStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.c7afbfec3614cf13.27230.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Chapak
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 04:23:55 UTC
AV detection:
23 of 30 (76.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqxlk6iopb2jkdnq4ulwjotixnfa7jn6nc3fs4l4om3dra62bw3q._file
Verdict:
malicious
Similar samples:
1d1db9028a99d5ccfd2e898e61dd4c0fbd2b363934f0623aa9503280fa3229a9
ArkeiStealer
662df407f177b9d63dc16fe5c1068d65c8e1fbe602d05a7cae1db651179b746e
ArkeiStealer
69fe5bb4b975f9437b6c3bcf3f07dc807a8f2e848f1e0c5802012295b06a742c
ArkeiStealer
6f34fbbfbe526af81101fef3143797b2e5fddb2bb945c69e6ddd7dd7bf2cf7c7
ArkeiStealer
6fa66f7851bea577cc6adfda11d3225a69b7c6554f028851eddd4d23ea074a59
ArkeiStealer
7a7f8f5b41981d22a64654a713d5dfdfbe6cb5e0778364a594fbaee25efc5425
ArkeiStealer
7dd09a71615dc2a60ba9dd906aebcff010f8442f4db392e4feb88baa01f8c999
ArkeiStealer
8bbb8fe69100550248f4663e911a16bca03432bef9112dd0924d7a9c3dae8464
ArkeiStealer
b30f264fda73db6970c313776095289e5fc0ee77f6be19010e2f9e125205e845
ArkeiStealer
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
ArkeiStealer
+ 292 additional samples on MalwareBazaar
Result
Malware family:
oski
Create hunting rule
Score:
  10/10
Tags:
family:oski discovery infostealer spyware
Link:
https://tria.ge/reports/201109-9cl24r4mge/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Oski
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe 9c2eb5790e7874950db0e51764ba68bb4a0fa5be68b659717c73363883da0db7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/380816/
  
Delivery method
Distributed via web download

Comments