MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c49ad6368c7e29dac6636a93ac96634dd701c46cf181ef1ecb22ae18feb5299a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c49ad6368c7e29dac6636a93ac96634dd701c46cf181ef1ecb22ae18feb5299a
SHA3-384 hash: b648e1f576bd3fce511d04cbcf4c8652f578bc50a114e40edcb60307cfffaf5e174b295c00f3f6b9b73ecc800b04e014
SHA1 hash: 1b0460d280f6af14cca66140679cf65ee52361f1
MD5 hash: a8f90069787bfda95043e6ec7117fd02
humanhash: salami-fix-zulu-oregon
File name:a8f90069787bfda95043e6ec7117fd02.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'648'640 bytes
First seen:2021-09-27 12:28:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0d4dbb56c32c47336294683fc02fb7e2 (22 x ArkeiStealer)
ssdeep 24576:QJ6EBIZYYdVXB1EX9uOJwQ5No04Hoawhb5BJnXvxWmmq0LBPdchd:QooW9/XzvgwQ5C04Ibb5BJXIVqMBPdY
Threatray 2'998 similar samples on MalwareBazaar
TLSH T1F975E12292A1F437D063FA7CDE5A977F5E2D7E103810580BAFE42D682B39381B529357
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a8f90069787bfda95043e6ec7117fd02.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-27 12:29:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b57ba716-3b98-4636-9e92-239234b8020d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192075/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.24414.8565.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Query of malicious DNS domain
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7470fe30-d461-4599-9b42-7d070f580ae6
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/858951
Signature
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 491380 Sample: nxW9yUgdYM.exe Startdate: 27/09/2021 Architecture: WINDOWS Score: 92 46 Found malware configuration 2->46 48 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->48 50 Yara detected Vidar 2->50 52 3 other signatures 2->52 6 nxW9yUgdYM.exe 75 2->6         started        process3 dnsIp4 42 mas.to 88.99.75.82, 443, 49750 HETZNER-ASDE Germany 6->42 44 23.88.105.196, 49776, 49797, 80 ENZUINC-US United States 6->44 20 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 6->20 dropped 22 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 6->22 dropped 24 C:\Users\user\AppData\...\mozglue[1].dll, PE32 6->24 dropped 26 9 other files (none is malicious) 6->26 dropped 54 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 6->54 56 Tries to harvest and steal browser information (history, passwords, etc) 6->56 58 Tries to steal Crypto Currency Wallets 6->58 11 WerFault.exe 9 6->11         started        14 WerFault.exe 9 6->14         started        16 WerFault.exe 9 6->16         started        18 5 other processes 6->18 file5 signatures6 process7 file8 28 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 11->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 14->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->38 dropped 40 2 other malicious files 18->40 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c49ad6368c7e29dac6636a93ac96634dd701c46cf181ef1ecb22ae18feb5299a/
Threat name:
Win32.Trojan.Chapak
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 13:02:44 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysnnmnumpyu5vrtdnkj2zftdjxlqdrdm6ga66hwlekxbr7vvfgna._file
Verdict:
malicious
Similar samples:
0f0da1d14f83ff61c448df9161c01d1ee11cf4dccbbc48df79fff89f2fd18454
ArkeiStealer
1524b3b62f11e24632fad12be7015963b3758784ce501e61c1189af8ff0f32a1
ArkeiStealer
293b50566b89dd7d4d4ab983e6f64320c9ee73f4b1e44a82d1e7bac4178eb6de
ArkeiStealer
3645dc682a44ecd1848b5cb1b8367a2fd98886dc03cefa6fc3ffd98d66182500
ArkeiStealer
a30652e56f30468e942474a7fc74fd07ee5f298a3156cde5a54c3ced630f7159
ArkeiStealer
bb4b0e00987e39145275f9a620f4a431acb8a45381151e39f88af91becab453c
ArkeiStealer
bd950aed117a0a017095762333fd12cefc232482f3ebf35683e1523e599328e7
ArkeiStealer
ed2ca82131cad5380e978d4c2d489e09f247463021b80cda9241bff82c10fb86
ArkeiStealer
f2962bc483f62e359dca3b911e2b422bf057dec9a14c4863992ea063d5d960da
ArkeiStealer
f35bc946ea6919fa86ef778e39ee36e8b6c2c4e335cd82394ed9a29211779ce8
ArkeiStealer
+ 2'988 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery spyware stealer suricata
Link:
https://tria.ge/reports/210927-pnw4jaghfr/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Suspicious use of NtCreateProcessExOtherParentProcess
Vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Unpacked files
SH256 hash:
c49ad6368c7e29dac6636a93ac96634dd701c46cf181ef1ecb22ae18feb5299a
MD5 hash:
a8f90069787bfda95043e6ec7117fd02
SHA1 hash:
1b0460d280f6af14cca66140679cf65ee52361f1
Link:
https://www.unpac.me/results/42d909ca-82b9-4d39-bb9c-eeecc2ae595d/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c49ad6368c7e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/c49ad6368c7e29dac6636a93ac96634dd701c46cf181ef1ecb22ae18feb5299a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe c49ad6368c7e29dac6636a93ac96634dd701c46cf181ef1ecb22ae18feb5299a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1627241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192075/

Comments