MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 4 File information Comments

SHA256 hash:	c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904
SHA3-384 hash:	d5e6f1d4cc7ba3102c2c05a98a6e9a3f7af00a55e360d6c6b7ae1238c05d758ea9430c16b3d848e512111926150dcf06
SHA1 hash:	4f2f196a89ae3796ed5ea601ab858e0c4d2ac9d1
MD5 hash:	7f82288cda32f1f5e20d28cb07486c5a
humanhash:	princess-july-carolina-idaho
File name:	7f82288cda32f1f5e20d28cb07486c5a.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	683'008 bytes
First seen:	2021-09-19 15:02:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0a50d73f84b858f7a49d0d60fc59dfef (1 x RaccoonStealer, 1 x ArkeiStealer)
ssdeep	12288:5ZCwq2oDPUxeoXKcPW8///DLxRzPCLRmZt4onKMDRQV4FCV:5UwqDsK0/vxcFmf4onKYOy4
Threatray	148 similar samples on MalwareBazaar
TLSH	T196E401207790C036F5FB12F449B993A8A83D79716B3455CB62D66BFA22343E88D30797
File icon (PE):
dhash icon	ead8ac9cc6a68ee0 (93 x RedLineStealer, 50 x RaccoonStealer, 15 x Smoke Loader)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7f82288cda32f1f5e20d28cb07486c5a.exe

Verdict:

Malicious activity

Analysis date:

2021-09-19 15:05:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/41f22c0d-d4eb-48ad-80b7-4406dc943b6a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/189078/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.22696.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Sending a TCP request to an infection source

Launching the default Windows debugger (dwwin.exe)

Query of malicious DNS domain

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f0f988d9-8227-4763-823a-8dfe626202e3

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/853525

Signature

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-09-19 15:03:19 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yrlp4bhokdsicybyzjkw4axmflnocf3glwmhjwwjfvsl2gez3eca._file

Verdict:

malicious

ArkeiStealer

461a8adf2ceed23fc21c2d8b0a45d9dd91d2d9f0af62b3f8850f8d2920d8b7f9

ArkeiStealer

7b603dd82cb87eca59e93b2cd9c0eb8e613339097b23ac07daa9220a2eb4a7b4

ArkeiStealer

8470a13ce50314b24f998a31289fb7cd0a9c8e281c14b5f05ae4027554cfec2b

ArkeiStealer

a006253231c891173381536ca790861d19c89525a6c5e94cde71e447a41a8a04

ArkeiStealer

aa662c457cac9785e96f334d19a1eb5517b2ff1630aaadc81a7d62de8cbddabb

ArkeiStealer

bb5a82d435e5b35379d83d69c5c9ff7881b1963a8480b9b15193245927fd55f8

ArkeiStealer

c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a

ArkeiStealer

d677f8738307640320bd09f609d9203e0d3bb924db4746a895829b253edcbead

ArkeiStealer

f1bb2d91c7594b776d0674a778c3208b73ef8caaf63427fb33c97481d783903b

ArkeiStealer

+ 138 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:1008 stealer

Link:

https://tria.ge/reports/210919-se18nsegcq/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Vidar Stealer

Suspicious use of NtCreateProcessExOtherParentProcess

Vidar

Malware Config

C2 Extraction:

https://dimonbk83.tumblr.com/

Unpacked files

SH256 hash:

d18386db720fdaa063eaa4d93d89d245e7af36ba6b4532319ca6c3656b950319

MD5 hash:

0da0d71d642d0b427fa0dfbbcc798529

SHA1 hash:

785abc95a0475b3670bdcd2a995b8ccdbcfb18a2

Link:

https://www.unpac.me/results/7b559a77-2d2c-4bc7-b9ca-1d8861b6523e/

SH256 hash:

c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904

MD5 hash:

7f82288cda32f1f5e20d28cb07486c5a

SHA1 hash:

4f2f196a89ae3796ed5ea601ab858e0c4d2ac9d1

Link:

https://www.unpac.me/results/7b559a77-2d2c-4bc7-b9ca-1d8861b6523e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks