MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8d2d5095e10c9f0c52a6eeb3ecf6ff52858bdb21037749943a8f38d0da36724. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8d2d5095e10c9f0c52a6eeb3ecf6ff52858bdb21037749943a8f38d0da36724
SHA3-384 hash: cc742c5b5b6f3739138ab687976aa331a12671a26d1cf6b35c12730817aa2e0773f1b8b958cd58208f422ffb6a7ae9cb
SHA1 hash: 620b20a9debb96649f692c57697cb138761c0699
MD5 hash: a395af3db4f82f425bba5f5c27ef6a8e
humanhash: september-alabama-quebec-leopard
File name:a395af3db4f82f425bba5f5c27ef6a8e
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:80'384 bytes
First seen:2021-10-20 08:27:57 UTC
Last seen:2021-10-20 09:37:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:vQLoaz+HjUBzVvMQGIl7Q+DLBLaoUETTlzDI0soq2ZiGVGHGQG/4GmGhG/GN1KrL:vQZz+DUBzGI17LBVpU0sh4BGaL3u
Threatray 566 similar samples on MalwareBazaar
TLSH T19F73B7D2A5CD84AFC970D5B206C593D305FEADE499324603267BBE581B36C0F6A63F48
File icon (PE):PE icon
dhash icon 0090929498d0e2f0 (3 x ArkeiStealer, 1 x AsyncRAT, 1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 ArkeiStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198780/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.47658.28035.21057.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Query of malicious DNS domain
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/616fd316a9d585e6d52e8e53/reports/8ca1ac03-e9b5-487c-ae7d-6f21dda9cc1b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
BluStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d78574e1-916e-458e-9da2-ffde8ff35fc8
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873694
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 506121 Sample: s78fLkv2Pe Startdate: 20/10/2021 Architecture: WINDOWS Score: 100 46 Multi AV Scanner detection for domain / URL 2->46 48 Found malware configuration 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 4 other signatures 2->52 8 s78fLkv2Pe.exe 15 5 2->8         started        process3 dnsIp4 40 store2.gofile.io 31.14.69.10, 443, 49780 LINKER-ASFR Virgin Islands (BRITISH) 8->40 42 192.168.2.1 unknown unknown 8->42 30 C:\Users\user\AppData\...\s78fLkv2Pe.exe, PE32 8->30 dropped 32 C:\Users\...\s78fLkv2Pe.exe:Zone.Identifier, ASCII 8->32 dropped 34 C:\Users\user\AppData\...\s78fLkv2Pe.exe.log, ASCII 8->34 dropped 54 Writes to foreign memory regions 8->54 56 Allocates memory in foreign processes 8->56 58 Injects a PE file into a foreign processes 8->58 13 s78fLkv2Pe.exe 127 8->13         started        18 s78fLkv2Pe.exe 8->18         started        20 s78fLkv2Pe.exe 8->20         started        22 s78fLkv2Pe.exe 8->22         started        file5 signatures6 process7 dnsIp8 44 136.144.41.229, 49792, 80 WORLDSTREAMNL Netherlands 13->44 36 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 13->36 dropped 38 C:\ProgramData\sqlite3.dll, PE32 13->38 dropped 60 Self deletion via cmd delete 13->60 62 Tries to harvest and steal browser information (history, passwords, etc) 13->62 64 Tries to steal Crypto Currency Wallets 13->64 24 cmd.exe 1 13->24         started        66 Machine Learning detection for dropped file 18->66 file9 signatures10 process11 process12 26 conhost.exe 24->26         started        28 timeout.exe 1 24->28         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8d2d5095e10c9f0c52a6eeb3ecf6ff52858bdb21037749943a8f38d0da36724/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-10-20 08:27:49 UTC
AV detection:
11 of 44 (25.00%)
Threat level:
  3/5
Verdict:
malicious
Similar samples:
2e14b592904e292539d9fc9d57a06df31676d5645ebaa49ebe129044d2d3baa3
ArkeiStealer
551c79b204f49811c9cc3a44b886d076feec99871aedb0d771860de61b6f8059
ArkeiStealer
5a2eff9610a0bdc09557cd54e9ad7e5b93b930359a8e322fb479ab7b1e20cf7d
ArkeiStealer
5ea70d1ccacc9fde5a0f1cf02273de35c8db3fdcf6ec8d5da788fed041a742ac
ArkeiStealer
66a4ad6ad86ac5cc502368cdd94be1164da5fb4da4b2c2048a09c1c37b175f40
ArkeiStealer
70d2439d21209fcc393ca4989fbe1d5966c651345ad9b38bab512dbe9861e2bb
ArkeiStealer
b3c5e8250ec320fd546df876a5be7ca4e9a70696dc2373ce5ff670def95d5238
ArkeiStealer
b944023d535bc8e5980173e203cee0d2fc2df9e865b4a06fc0694436ce5b6541
ArkeiStealer
ccbded51600db440d54831ff724cf0e988220da4cd069244ade361c959b8c852
ArkeiStealer
edf6beb88780fb3085332f843b73418f52bbf095265dad631cf8e187644cb565
ArkeiStealer
+ 556 additional samples on MalwareBazaar
Result
Malware family:
arkei
Create hunting rule
Score:
  10/10
Tags:
family:arkei botnet:default spyware stealer
Link:
https://tria.ge/reports/211020-kc1kcsggd3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Arkei Stealer Payload
Arkei
Malware Config
C2 Extraction:
http://136.144.41.229/gJCbU1V9y2.php
Unpacked files
SH256 hash:
b8d2d5095e10c9f0c52a6eeb3ecf6ff52858bdb21037749943a8f38d0da36724
MD5 hash:
a395af3db4f82f425bba5f5c27ef6a8e
SHA1 hash:
620b20a9debb96649f692c57697cb138761c0699
Link:
https://www.unpac.me/results/22dd2212-08e5-4fd2-8721-d630638a3d31/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b8d2d5095e10/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b8d2d5095e10c9f0c52a6eeb3ecf6ff52858bdb21037749943a8f38d0da36724

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe b8d2d5095e10c9f0c52a6eeb3ecf6ff52858bdb21037749943a8f38d0da36724

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1698708/
Cape
Cape
https://www.capesandbox.com/analysis/198780/

Comments


Avatar
zbet commented on 2021-10-20 08:27:58 UTC

url : hxxps://mailer34.zzux.com/a/leApp14.exe