MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f
SHA3-384 hash: d48414db2276ec1ca6993c57dfb93c6e342e1908a2617f12413ae478c9cb6e288221ac2ddc240d0e9948bfdf6e0689ac
SHA1 hash: 68051bc40a163c189ec963c1d830dd88a4d62795
MD5 hash: 495cc873782d89bbda1d58b8146643d2
humanhash: blue-montana-beer-kitten
File name:495cc873782d89bbda1d58b8146643d2.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:788'480 bytes
First seen:2021-10-11 08:16:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d8470aebc2200bafc1ff60318f406103 (4 x Smoke Loader, 2 x ArkeiStealer, 1 x RedLineStealer)
ssdeep 12288:u73FbGr8iOMzi396CTd1bnX2Nt8UsvLkHXp0hcLFAUy1YRYgtm:oGAszi3X1LX2Nt8U9HXShcqUbR
Threatray 3'272 similar samples on MalwareBazaar
TLSH T18FF4E0107690C038F7F356B869BD9268A82E7AA19B2554FF52C41AEE5774EF0EC30317
File icon (PE):PE icon
dhash icon 9824e7d0c4e72158 (35 x RedLineStealer, 23 x Smoke Loader, 14 x ArkeiStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
495cc873782d89bbda1d58b8146643d2.exe
Verdict:
Malicious activity
Analysis date:
2021-10-11 12:24:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39f9d846-9b77-48be-8f89-8fc91ae68370

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196521/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47150242.18292.7566.UNOFFICIAL
Create hunting rule

Win.Packed.Generic-9901320-0
Create hunting rule

Win.Packed.Generic-9901358-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6163f2c81c2d58ba74016aea/reports/7540d42c-467f-4d33-b9e7-2464a6e9e8dc/overview
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/868102
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f/
Threat name:
Win32.Trojan.ArkeiStealer
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 02:05:44 UTC
AV detection:
24 of 45 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcqkc2c4foptcj6kl5ujwcsurxwtfzpiro2vjk4g7swzz3uehvxq._file
Verdict:
malicious
Similar samples:
039319cf3944c2873517912d91bd02c48a634c36ef69acab04e54d1ce07685c1
ArkeiStealer
0793806881cb1dbedfef2915436b24ce78e91bc43652e8f7267835d2d63bdfbd
ArkeiStealer
3959a10d715c4da846fb6b56b80270bfdefe57552adb43d229e0e78ee051e5ea
ArkeiStealer
6cdbb76978e0dcbb39bc84b8726616b7e5034e93e3fb52bd1f190d352ac4c561
ArkeiStealer
91ae14cf4ca851bf987552f0493238f53645a3f221ac2ca6477123c598e68fe5
ArkeiStealer
97c4e1873b91faf541dfdabee7dd930d97e9d8781fc157f1d7ce6ec7ea561eb2
ArkeiStealer
9f7ec3f3f79487db03b9051d9b8fad8a199c2a53905c5cf19d0fd9ad90f58ec2
ArkeiStealer
a03a82def98db18ed5401f6c597dd0693c9f90b1a9a3fee5f99efc6d5327ac73
ArkeiStealer
a2872c8f6a4e0bf3538f83c8b7660d5c2b0cacf643a847faf0695b2a717ab317
ArkeiStealer
fa7f51831c97c16b3e83e13c22e5c899a67c795347225a6713ef3fac7e300174
ArkeiStealer
+ 3'262 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:1008 discovery spyware stealer
Link:
https://tria.ge/reports/211011-j56reagfb2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
Malware Config
C2 Extraction:
https://mas.to/@serg4325
Unpacked files
SH256 hash:
c6320d7467927e78c205fdca10484c14e53730bddd3958d93e11263e7871536e
MD5 hash:
ce26ceb3191ffa06f2d2879349b77140
SHA1 hash:
8d74d2b1ce1708c5bdcb8462b6c4f04ba2faefb4
Link:
https://www.unpac.me/results/2bc8afea-b424-4c98-a041-8f8e7e230960/
SH256 hash:
a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f
MD5 hash:
495cc873782d89bbda1d58b8146643d2
SHA1 hash:
68051bc40a163c189ec963c1d830dd88a4d62795
Link:
https://www.unpac.me/results/2bc8afea-b424-4c98-a041-8f8e7e230960/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a8a0a1685c2b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe a8a0a1685c2b9f3127ca5f689b0a548ded32e5e88bb554ab86fcad9cee843d6f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1586513/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
Cape
Cape
https://www.capesandbox.com/analysis/196521/

Comments