MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b86da55b00429d3a757c64bc0489af5d2641bfa7aab9910eddec173af09c55b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	b86da55b00429d3a757c64bc0489af5d2641bfa7aab9910eddec173af09c55b4
SHA3-384 hash:	525d96be14fa68391c1841a8547fdbbf36aef27c838fb9cbc7f700cb6d799fb4d6460f2c4318fbeec87dd52be9db58e0
SHA1 hash:	d05a9812ceb8d1df306af03ce660780885bc0bb6
MD5 hash:	7466cf0d531c61aaf889bab7f31e2879
humanhash:	solar-pennsylvania-whiskey-monkey
File name:	7466cf0d531c61aaf889bab7f31e2879.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	289'280 bytes
First seen:	2022-02-07 14:44:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	28911b7dfd0ff100490fad1ec843b3c6 (1 x ArkeiStealer)
ssdeep	6144:mY73EKaYL3y/LRE/ykpinaQyU/Pwgba4fVXuUeXyL/5:mDKTTYtAZpiDyU/PwH4t5R
TLSH	T1AC548D00BBA0D035F1B752F859B9D3ADA93E7AB15B3060CB52D52AEE16356E1DC3130B
File icon (PE):
dhash icon	b6dacabecee6baa2 (18 x RedLineStealer, 12 x Stop, 9 x ArkeiStealer)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/235862/

Detection(s):

Win.Malware.Generic-9936539-0

Win.Packed.Filerepmalware-9938531-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Sending a custom TCP request

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/6248/overview

Behaviour

MalwareBazaar

SystemUptime

CPUID_Instruction

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6201306f845a69d77349ad51/reports/b1127e40-d192-4482-8d97-b7a328b4c9a1/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/24117b13-2e1c-4861-a9c7-d11d8e2f19e1

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/935424

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b86da55b00429d3a757c64bc0489af5d2641bfa7aab9910eddec173af09c55b4/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-02-07 14:45:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Verdict:

malicious

Result

Malware family:

arkei

Score:

10/10

Tags:

family:arkei botnet:dafault discovery spyware stealer

Link:

https://tria.ge/reports/220207-r4q9bsdbgj/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Arkei Stealer Payload

Arkei

Suspicious use of NtCreateProcessExOtherParentProcess

Malware Config

C2 Extraction:

http://googe.link/gate1.php

Unpacked files

SH256 hash:

98f0827fee8802f8437c3fe659d873073506bedd373a44340f2e789878533bbb

MD5 hash:

21251e0932a38b35814157a08c9179a2

SHA1 hash:

b34fbab1948ad6259f84ba6af836dfd09812b6b7

Link:

https://www.unpac.me/results/6e0c9d58-8633-4907-9333-9b6d2862adb7/

SH256 hash:

b86da55b00429d3a757c64bc0489af5d2641bfa7aab9910eddec173af09c55b4

MD5 hash:

7466cf0d531c61aaf889bab7f31e2879

SHA1 hash:

d05a9812ceb8d1df306af03ce660780885bc0bb6

Link:

https://www.unpac.me/results/6e0c9d58-8633-4907-9333-9b6d2862adb7/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/b86da55b0042/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.