MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b92e4e813f779135b6c1f0a78e945efb9f14d015e9ae7b4e810d5bdc69299593. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	b92e4e813f779135b6c1f0a78e945efb9f14d015e9ae7b4e810d5bdc69299593
SHA3-384 hash:	0451307704fc2420458f8efee35aa3b42693951850cb7dbf3cebf8e53cc19a5b415b1344f9a741c42fcfe70a5230e71e
SHA1 hash:	577ce5a738ffdec0b28650e7e4d52a96690a20f0
MD5 hash:	d25e65e5d92f02c31bce7a29e9440992
humanhash:	purple-november-eighteen-fourteen
File name:	d25e65e5d92f02c31bce7a29e9440992.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	673'280 bytes
First seen:	2021-09-21 19:26:02 UTC
Last seen:	2021-09-21 20:09:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	98349bc8fa025f57a9d49df3092c15be (10 x RedLineStealer, 2 x ArkeiStealer, 1 x RaccoonStealer)
ssdeep	12288:f5ILlHd+0kxGbPp2tWb8dk4BzSCO/ON5uF4EtBEVi64GjAyvpBai:f5w+0kxGbPp2wb8m4BzpO/ON5+Bmi6KI
Threatray	170 similar samples on MalwareBazaar
TLSH	T1D6E40112B569C331C6F75071472CBFE12AB7B82259B483876B5A23BEEF642D07B11349
File icon (PE):
dhash icon	327a7c7d767e6e76 (4 x RedLineStealer, 1 x ArkeiStealer, 1 x DanaBot)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

272

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d25e65e5d92f02c31bce7a29e9440992.exe

Verdict:

Malicious activity

Analysis date:

2021-09-21 19:27:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f8de3ec4-da01-450c-b8b7-301a525ecf8c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/189975/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.24084.23219.11989.UNOFFICIAL

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/794499ca-b50a-405d-99a3-d0a38dff8d45

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/855186

Signature

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b92e4e813f779135b6c1f0a78e945efb9f14d015e9ae7b4e810d5bdc69299593/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-09-21 16:42:34 UTC

AV detection:

21 of 45 (46.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xexe5aj7o6itlnwb6cty5fc67oprjuav5gxhwtubbvn5y2jjswjq._file

Verdict:

malicious

ArkeiStealer

461a8adf2ceed23fc21c2d8b0a45d9dd91d2d9f0af62b3f8850f8d2920d8b7f9

ArkeiStealer

6937035e02b301f6959cb85c974d4956f2e7880e1d6faebe261b21ec0f200a4a

ArkeiStealer

7b0409caebe92c8b64a6f3b3f071bf7829eb98e4904d077b291695e2b2619413

ArkeiStealer

8470a13ce50314b24f998a31289fb7cd0a9c8e281c14b5f05ae4027554cfec2b

ArkeiStealer

a006253231c891173381536ca790861d19c89525a6c5e94cde71e447a41a8a04

ArkeiStealer

aa662c457cac9785e96f334d19a1eb5517b2ff1630aaadc81a7d62de8cbddabb

ArkeiStealer

b83c933c2216e6b6251fec84fdcce2f341f20f52934977355331cf3a140b83c5

ArkeiStealer

ebf487d463e3e54459f57c250c9ad14b571d1b1d08979f9ef3039bde9e491f58

ArkeiStealer

f1bb2d91c7594b776d0674a778c3208b73ef8caaf63427fb33c97481d783903b

ArkeiStealer

+ 160 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:1008 stealer

Link:

https://tria.ge/reports/210921-x5jtjaade3/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Vidar Stealer

Suspicious use of NtCreateProcessExOtherParentProcess

Vidar

Malware Config

C2 Extraction:

https://petrenko96.tumblr.com/

Unpacked files

SH256 hash:

afbced77762d814a12d80286c5744519541c4836a0c7464c6b4f9e166d474990

MD5 hash:

5cecd28e592ff348a9ac717a1e557a4f

SHA1 hash:

a82750b90b40eb6b583cb6bf97b8a02b8219f730

Link:

https://www.unpac.me/results/ed1d67b3-de4a-406f-a46d-16b877091639/

SH256 hash:

b92e4e813f779135b6c1f0a78e945efb9f14d015e9ae7b4e810d5bdc69299593

MD5 hash:

d25e65e5d92f02c31bce7a29e9440992

SHA1 hash:

577ce5a738ffdec0b28650e7e4d52a96690a20f0

Link:

https://www.unpac.me/results/ed1d67b3-de4a-406f-a46d-16b877091639/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b92e4e813f779135b6c1f0a78e945efb9f14d015e9ae7b4e810d5bdc69299593

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks