MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8ca93adc4384dc66b6c8c6034ae5942d29d0aa5291f35d4b80189413d64f76c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	a8ca93adc4384dc66b6c8c6034ae5942d29d0aa5291f35d4b80189413d64f76c
SHA3-384 hash:	7a1c018257fa9240ea27a7c989ab2aa6458c5bd5ff13b5eaf1c9f60892b9a3274d6da20422c4e496b771c7d8aa348705
SHA1 hash:	ee6451654e2de568b80d4fb480978a2c481f640c
MD5 hash:	16448b008bef72f524b821b37de3bcca
humanhash:	comet-jig-earth-princess
File name:	16448b008bef72f524b821b37de3bcca.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	445'440 bytes
First seen:	2020-09-12 14:08:53 UTC
Last seen:	2020-09-12 14:33:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4a9b5dd0f694bd4c92476cc65ac6993e (1 x ArkeiStealer)
ssdeep	12288:XWaRPDO9WG+mGFiWDZu2EbWmLGUOCEKWz:XflVy2ufWmyUHEK
TLSH	7B9412103A91E072D9D746F85A35C7D46A7E39320635A9CB375537BA3F333E0A92A342
Reporter	abuse_ch
Tags:	ArkeiStealer exe

abuse_ch

ArkeiStealer C2:
http://oceanhome.co.ug/

Intelligence

File Origin

# of uploads :

# of downloads :

131

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/58769/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.70039.10642.14219.UNOFFICIAL

Win.Packed.Tofsee-9755212-0

Win.Packed.CrySIS-9755332-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Creating a file

Deleting a recently created file

Reading critical registry keys

Connection attempt

Creating a window

Delayed writing of the file

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Searching for the window

Stealing user critical data

Launching a tool to kill processes

Sending an HTTP GET request to an infection source

Forced shutdown of a browser

Result

Threat name:

Vidar

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/464728

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8ca93adc4384dc66b6c8c6034ae5942d29d0aa5291f35d4b80189413d64f76c/

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-09-12 11:50:52 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vdfjhloehbg4m23mrrqdjlsziljj2cvffeptlvfyageucple65wa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware discovery

Link:

https://tria.ge/reports/200912-ph8mh5kpyx/

Behaviour

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks installed software on the system

JavaScript code in executable

Looks up external IP address via web service

Checks installed software on the system

JavaScript code in executable

Looks up external IP address via web service

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a8ca93adc4384dc66b6c8c6034ae5942d29d0aa5291f35d4b80189413d64f76c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_vidar_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_vidar_g0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com