MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a
SHA3-384 hash:	b0cb578a4aef33999b99987d902eb28f9daa3a98f772d94b89b33cbb9d3162f9f713cc41b0c3a835b1e1a141a2b2af92
SHA1 hash:	536eb9efb2bcd5e7f1e974fcecc97f39284e9479
MD5 hash:	9fd273017b910af156cd5913a66906f3
humanhash:	pasta-don-lemon-magazine
File name:	9fd273017b910af156cd5913a66906f3.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	683'520 bytes
First seen:	2021-09-18 16:44:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	90edc546938f77c6811e626812a78363 (3 x RedLineStealer, 1 x ArkeiStealer)
ssdeep	12288:4ZNuGpNGO8U+VXqqb0R86CExU+kFFuoDgCntqS9K/gkvD/ZcBdc:4vrpSjbr5EdkFhntp9PihcBd
Threatray	141 similar samples on MalwareBazaar
TLSH	T16FE402205B90C035F4B711F455B993BCA93C3DB16B2891CB22EA6BF956347E89D30787
dhash icon	aad8ac9cc6e68ee0 (12 x RedLineStealer, 6 x RaccoonStealer, 3 x Smoke Loader)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

228

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9fd273017b910af156cd5913a66906f3.exe

Verdict:

Malicious activity

Analysis date:

2021-09-18 16:47:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/69e59fa8-f32a-4f30-90e9-c5eab53936a0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/188949/

Detection(s):

SecuriteInfo.com.Ransom.Stop.Z5.17917.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Sending a TCP request to an infection source

Launching the default Windows debugger (dwwin.exe)

Query of malicious DNS domain

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6e14d1d9-8393-42aa-874f-013c10f149fa

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/853261

Signature

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-09-18 16:45:06 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yjmbqsc2h7som4unwar4kuliuskica3e76quegmvuhqtgcngdqva._file

Verdict:

malicious

ArkeiStealer

3437d8f8ed86ab2de3080df6d63d794fb38dc52ebd157f078a93f491b1e01066

ArkeiStealer

383c15ad8c0fea4c65d4c6bd06f47f355fbaa65c24d3bf3ea3d77be2e74a8fff

ArkeiStealer

7b603dd82cb87eca59e93b2cd9c0eb8e613339097b23ac07daa9220a2eb4a7b4

ArkeiStealer

8470a13ce50314b24f998a31289fb7cd0a9c8e281c14b5f05ae4027554cfec2b

ArkeiStealer

a006253231c891173381536ca790861d19c89525a6c5e94cde71e447a41a8a04

ArkeiStealer

a6a4ea6a622b43f7f7b866d147b70db495c7595ce85895c55e5a2b9fbf4291a2

ArkeiStealer

aa662c457cac9785e96f334d19a1eb5517b2ff1630aaadc81a7d62de8cbddabb

ArkeiStealer

d677f8738307640320bd09f609d9203e0d3bb924db4746a895829b253edcbead

ArkeiStealer

f1bb2d91c7594b776d0674a778c3208b73ef8caaf63427fb33c97481d783903b

ArkeiStealer

+ 131 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:1008 stealer

Link:

https://tria.ge/reports/210918-t9dxascdaj/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Vidar Stealer

Suspicious use of NtCreateProcessExOtherParentProcess

Vidar

Malware Config

C2 Extraction:

https://dimonbk83.tumblr.com/

Unpacked files

SH256 hash:

d18386db720fdaa063eaa4d93d89d245e7af36ba6b4532319ca6c3656b950319

MD5 hash:

0da0d71d642d0b427fa0dfbbcc798529

SHA1 hash:

785abc95a0475b3670bdcd2a995b8ccdbcfb18a2

Link:

https://www.unpac.me/results/5f840b13-9554-4d85-869b-410c3a3e71d7/

SH256 hash:

c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a

MD5 hash:

9fd273017b910af156cd5913a66906f3

SHA1 hash:

536eb9efb2bcd5e7f1e974fcecc97f39284e9479

Link:

https://www.unpac.me/results/5f840b13-9554-4d85-869b-410c3a3e71d7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks