MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3
SHA3-384 hash: 50c029f871e863208f1c061609e2b3bff7d1f31696efec96b93f1031c78665db44ff292aa982fb1345b7d3e34c074f12
SHA1 hash: de7cd7efac313d9048113bac57983e043a7a1dff
MD5 hash: 8bf9e821346338a234f5c16f80ba12b5
humanhash: uranus-mockingbird-july-texas
File name:8bf9e821346338a234f5c16f80ba12b5.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:583'680 bytes
First seen:2021-02-02 08:22:36 UTC
Last seen:2021-02-02 09:31:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e0f78ec20353f62d287931ae5f1c3dc4 (1 x ArkeiStealer, 1 x RedLineStealer)
ssdeep 12288:EMDQompkMP/LBKDx3oGNieIeVr32+RiB6Lv+c6cpuA9Lmrc6vpy:EqDCky/LI3BVRRf7uA9Lmrc6v
Threatray 465 similar samples on MalwareBazaar
TLSH 2EC4D000A791C035F5B736B45ABA4378A529FEA2672990CF12C5EAFE17356F0AD30313
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://customkitchaid.com/

Intelligence

File Origin
# of uploads :
2
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8bf9e821346338a234f5c16f80ba12b5.exe
Verdict:
Malicious activity
Analysis date:
2021-02-02 08:24:42 UTC
Tags:
trojan stealer vidar loader evasion opendir
Link:
https://app.any.run/tasks/5f3586be-d5b3-4992-acee-f7d53cecb05b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115079/
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.60986.20386.17635.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Replacing files
Reading critical registry keys
Creating a window
Delayed writing of the file
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Stealing user critical data
Launching a tool to kill processes
Forced shutdown of a browser
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/596266
Signature
Creates files in alternative data streams (ADS)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 347172 Sample: 9e5EzvVm19.exe Startdate: 02/02/2021 Architecture: WINDOWS Score: 100 60 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->60 62 Multi AV Scanner detection for domain / URL 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 8 other signatures 2->66 7 9e5EzvVm19.exe 71 2->7         started        12 Chrome Updater.exe 3 2->12         started        14 DNS Client.exe 2->14         started        process3 dnsIp4 46 pandemic-info.com 176.123.0.55, 49729, 80 ALEXHOSTMD Moldova Republic of 7->46 48 customkitchaid.com 103.155.92.113, 49721, 80 TWIDC-AS-APTWIDCLimitedHK unknown 7->48 50 ip-api.com 208.95.112.1, 49726, 80 TUT-ASUS United States 7->50 34 C:\Users\user\AppData\Local\...\1[1].exe, PE32 7->34 dropped 36 C:\ProgramData\0GX45POX4U.exe, PE32 7->36 dropped 38 C:\...\0GX45POX4U.exe:Zone.Identifier, ASCII 7->38 dropped 44 12 other files (none is malicious) 7->44 dropped 68 Detected unpacking (changes PE section rights) 7->68 70 Detected unpacking (overwrites its own PE header) 7->70 72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 7->72 74 5 other signatures 7->74 16 0GX45POX4U.exe 9 7->16         started        20 cmd.exe 1 7->20         started        40 C:\Users\user\AppData\...\Microsoft WIM.exe, PE32 12->40 dropped 42 C:\...\Microsoft WIM.exe:Zone.Identifier, ASCII 12->42 dropped file5 signatures6 process7 file8 28 C:\Users\user\AppData\...\DNS Client.exe, PE32 16->28 dropped 30 C:\Users\user\AppData\...\Chrome Updater.exe, PE32 16->30 dropped 32 C:\...\Chrome Updater.exe:Zone.Identifier, ASCII 16->32 dropped 52 Multi AV Scanner detection for dropped file 16->52 54 Detected unpacking (overwrites its own PE header) 16->54 56 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->56 58 2 other signatures 16->58 22 DNS Client.exe 16->22         started        24 taskkill.exe 1 20->24         started        26 conhost.exe 20->26         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-02 01:06:32 UTC
AV detection:
14 of 45 (31.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3jpe3eizntt4b5gzcan3fdbkfmeuik7hwuzqdllct52fua6y3zq._file
Verdict:
malicious
Similar samples:
029d5475be7bd26b516f1f3338ba112314816504629fcfa4d3e7b23a6014657d
ArkeiStealer
1e8fb015e391b8d76c738a2b315ce646c4dc607914b3e2c081c6b939e8ac21d8
ArkeiStealer
23f4966e3c93da6d35899085b52cf25905d4986b1699d6165c1e3df898ef3838
ArkeiStealer
2c9538aaf6058783ac6e7c6676769ba3904a584b0bbc8c475852b11096c3c368
ArkeiStealer
4d2d011803469bd4f6e1714aae78a247008cc9018de1eb27ddea0f21d6bca132
ArkeiStealer
5275eb92b2b285585e26a85d14c9415e42fc4eac7c8b482e22910effb85536c5
ArkeiStealer
53aa433c101f4bf08e503a323146bb67665931a9cf89915d238e80018dcc7d1e
ArkeiStealer
99fae1fe1739052540a8a99cb4377fb9c0a575a3b880d96940f6c06b12d50edf
ArkeiStealer
a8ca93adc4384dc66b6c8c6034ae5942d29d0aa5291f35d4b80189413d64f76c
ArkeiStealer
b912cef6a6c9d7e8f49a06d9178cc7c6d8b68a0e7f8948c3d6892f8e5fd11c74
ArkeiStealer
+ 455 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery ransomware spyware stealer
Link:
https://tria.ge/reports/210202-wkpcgby4s2/
Behaviour
Checks processor information in registry
Kills process with taskkill
NTFS ADS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
JavaScript code in executable
Looks up external IP address via web service
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Vidar
Unpacked files
SH256 hash:
ace8fd7ce6987c4728870a508f74842c07c5d9cd0bf850637e4d5d9a5c45efe5
MD5 hash:
a933a0793f656a6c3bf5725e84a67ced
SHA1 hash:
66a6986681c0648bd63bf375fd9fc4781f8a604f
Detections:
win_vidar_g0
Create hunting rule
Link:
https://www.unpac.me/results/febc7cca-f49d-4061-8fb2-370df0369681/
Parent samples :
bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3
fc96c80feb56e4d65f40682bb63a88e52682d05b760e13b1df8a7d454d16538c
SH256 hash:
bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3
MD5 hash:
8bf9e821346338a234f5c16f80ba12b5
SHA1 hash:
de7cd7efac313d9048113bac57983e043a7a1dff
Link:
https://www.unpac.me/results/febc7cca-f49d-4061-8fb2-370df0369681/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar infostealer variants
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_vidar_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe bed2f26c88cb673e07a6c880dd946151584a215f3da9980d6b14fba2d01ec6f3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/983674/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/983727/
Cape
Cape
https://www.capesandbox.com/analysis/115079/

Comments