MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1b06231624dd9cd446357211a63f8d27f2a7781123c0dff89f277f95e408192. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	c1b06231624dd9cd446357211a63f8d27f2a7781123c0dff89f277f95e408192
SHA3-384 hash:	6eac402e2d73092e773977abcd4046afc8f78bb3194a6b4a628912cdc874fd89d6f62900fd94d2f300e18a278438aa9b
SHA1 hash:	4539af9c81777398506df847b2f1d15edcd6afb0
MD5 hash:	c09d0dbc6105cca95edc7be8e986bda0
humanhash:	bluebird-alanine-magazine-wisconsin
File name:	c09d0dbc6105cca95edc7be8e986bda0.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	493'568 bytes
First seen:	2020-06-29 06:00:29 UTC
Last seen:	2020-06-29 06:45:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b8cb85de74e75572e3ac5647e3f617fa (2 x ArkeiStealer)
ssdeep	12288:7u2f3YeICNyl1pp6x2Sim8HpoaXkaLqUTnd14:7dYFC4X76x2SuoaXknUTv4
Threatray	374 similar samples on MalwareBazaar
TLSH	54A4022631F1E072F3A275708064B7B15A792931AA2055CB37D86B3F7F72741522FB8A
Reporter	abuse_ch
Tags:	ArkeiStealer exe

abuse_ch

ArkeiStealer C2:
http://bystinkasjhpop.com/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/15332/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c1b06231624dd9cd446357211a63f8d27f2a7781123c0dff89f277f95e408192/

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-06-28 20:11:05 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ygygemlcjxm42rddk4qruy7y2j7su54bci6a374j6j37sxsaqgja._file

Verdict:

malicious

ArkeiStealer

2d2d3d7c27bfec647b6a9db28df14308827a652a184886c166a1d128a5f890d8

ArkeiStealer

341847d9c11face1487ab04072d6ddc5065a379011c6684e56e1f4fa8d8ab3f3

ArkeiStealer

3d8567fb3b55c792b8ba70e2172726ae80805f1a1c858db29e13a5cd02d8634a

ArkeiStealer

70ccb52e4c78d8b68d562fb7088d143577ad35a4b0bd01581a383c41580f1b2d

ArkeiStealer

8598147a91005830b94021bf5bf401e1b10d55ff940244394e8fb3bb8f494539

ArkeiStealer

cd2fb19598084681b5fe849bf1cdbabb07325de447d8150463d189440e10932d

ArkeiStealer

eaf272ccebdce006c18793bdbcd0b4729d6ac2eefa2ef900cee811d74d953825

ArkeiStealer

ecb89e9f66cd7f37efefec4cb211770200ccb17c810ad741cb3ec141e41c361c

ArkeiStealer

f4221efa93b3ce5d8c92ba911661c246111653dd178bc239349cdfde8b39f7f0

ArkeiStealer

+ 364 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware

Link:

https://tria.ge/reports/200629-tjfa27maea/

Behaviour

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks for installed software on the system

Looks up external IP address via web service

Loads dropped DLL

Deletes itself

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_vidar_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_vidar_g0 Create hunting rule
Author:	Slavo Greminger, SWITCH-CERT

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com