MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4564966c74ea17badd252d6c1b3a052f869e69d0c7cbbcb776af245135e9917. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4564966c74ea17badd252d6c1b3a052f869e69d0c7cbbcb776af245135e9917
SHA3-384 hash: 3f3be7ca365907ceba2698d3b92a1ac5a9f3a476cd19f06dffd5e2ab4f4197d27a87b11cb1b2006e92f2d1b2ce3c464d
SHA1 hash: 0c2e809f3ff80704a8174f0a16c0e925e32307a6
MD5 hash: 456bd48a041f684d76dcfc3d6bc90308
humanhash: north-lithium-vegan-jersey
File name:456bd48a041f684d76dcfc3d6bc90308.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:280'064 bytes
First seen:2022-02-07 18:22:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 63f9a18a26e146489d4459889103d05c (2 x ArkeiStealer, 2 x RedLineStealer, 1 x RaccoonStealer)
ssdeep 6144:SoZuI2az4+6ulMLS2IoSG0Rdqq5dXMSxU7d:STI2Q1xKe2IomRdqqb8
TLSH T19B547D10BBA0C035F5B752F849B993ACAA3E7EB15B3464CB62D416EE56352E0EC31317
File icon (PE):PE icon
dhash icon b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/236328/
Detection(s):
Win.Packed.Filerepmalware-9938531-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file
Reading critical registry keys
Sending a custom TCP request
Changing a file
Creating a file in the %AppData% subdirectories
Creating a window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Query of malicious DNS domain
Stealing user critical data
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/6278/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/620163894077c8b9a01c753c/reports/a7eb31b1-4a32-42c9-ab82-28f6fe5efcbb/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0cb47a71-22a0-4c28-b824-4e823465adc2
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/935457
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4564966c74ea17badd252d6c1b3a052f869e69d0c7cbbcb776af245135e9917/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2022-02-07 18:23:10 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wrleszwhj2qxxloskllmdm5akl4gtzu5br6lxs3xnlzeke26telq._file
Verdict:
malicious
Result
Malware family:
arkei
Create hunting rule
Score:
  10/10
Tags:
family:arkei botnet:default discovery spyware stealer
Link:
https://tria.ge/reports/220207-w1gmyafcdk/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Arkei Stealer Payload
Arkei
Malware Config
C2 Extraction:
http://coin-file-file-19.com/tratata.php
Unpacked files
SH256 hash:
69ba4e2995d6b11bb319d7373d150560ea295c02773fe5aa9c729bfd2c334e1e
MD5 hash:
58922177676773ec3324c33734ae9ef9
SHA1 hash:
ce0a3cae8ee18c6d1f22361224b3692d61d5d7a2
Link:
https://www.unpac.me/results/80bc0bf1-fc8e-4362-ac7f-2c941bc7b082/
SH256 hash:
b4564966c74ea17badd252d6c1b3a052f869e69d0c7cbbcb776af245135e9917
MD5 hash:
456bd48a041f684d76dcfc3d6bc90308
SHA1 hash:
0c2e809f3ff80704a8174f0a16c0e925e32307a6
Link:
https://www.unpac.me/results/80bc0bf1-fc8e-4362-ac7f-2c941bc7b082/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe b4564966c74ea17badd252d6c1b3a052f869e69d0c7cbbcb776af245135e9917

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1988764/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/236328/

Comments