MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d
SHA3-384 hash: ccf62cd20d9f6bc66377987e5c72ae8d9fbdcc2741f006dffa1228329eac3add2f03d84c95046dde29441f861142d2f0
SHA1 hash: a939ee70f198a1ae0211d3928bcf03775e4ee0ac
MD5 hash: 97a67de6c513c817a96b65c3f5d48b29
humanhash: fillet-freddie-louisiana-jupiter
File name:97a67de6c513c817a96b65c3f5d48b29.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:669'184 bytes
First seen:2021-10-08 11:55:16 UTC
Last seen:2021-10-08 13:18:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0dd592f35b48076810a8314d458b6b4b (6 x RedLineStealer, 4 x Smoke Loader, 1 x OskiStealer)
ssdeep 12288:UsuwhGrbW9IEz6tFkL4kKBb6VVBdkfx2h/ODqvz6KUorRex6s8zuFJk6AiCmh:juwvZ8WV5w+Kez6KUAAQs8zuF26A
Threatray 3'622 similar samples on MalwareBazaar
TLSH T14FE40211F2928032E67F493C492197B55B3BF926DD31964B27F252FB6E352C28A69303
File icon (PE):PE icon
dhash icon 83bcdcac9cccb484 (2 x RedLineStealer, 2 x RaccoonStealer, 1 x ArkeiStealer)
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
97a67de6c513c817a96b65c3f5d48b29.exe
Verdict:
Malicious activity
Analysis date:
2021-10-08 12:04:42 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/bb7b2adb-b909-4665-bf6e-2c1f06dab952

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196147/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Vidar.10.12359.7231.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/867049
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Self deletion via cmd delete
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-10-08 11:56:08 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ys7lnl4nmpkb2eqvsgoozg6u42edvwnebu3crik56lazfm4j2v6q._file
Verdict:
malicious
Similar samples:
1f019e696ef61e628db0eade29c627a38f562ae95c135b9d79ae17e3c8e56149
ArkeiStealer
270069811dc8c6472a1b4213abefc46f5d0ebdfa1791624d072f28e3a9a25c98
ArkeiStealer
286b0ce53257e9ce376ceb4a6352392326f4ab868199553fac6b1f90d6a3ed33
ArkeiStealer
607494be65a2860e8a4a6d5c6fd82d54a6ff6dedf32d0017e92a6bfc3690d57e
ArkeiStealer
876dcdde9e27c0fbace05dade75d4babbaceb760de154945984ea4ba28b8a4a7
ArkeiStealer
91ae14cf4ca851bf987552f0493238f53645a3f221ac2ca6477123c598e68fe5
ArkeiStealer
97c4e1873b91faf541dfdabee7dd930d97e9d8781fc157f1d7ce6ec7ea561eb2
ArkeiStealer
c3bf9d72a7f69b7cb76260ef4de9f0033593e7756b8eb1e4e8ed166aa84a7cf9
ArkeiStealer
dcbccc78bc91546c6e988621d16fd27043dce977cc9fb00a67fef3938fc38053
ArkeiStealer
ea516db6800329002e1bf6146faf4bf845be216682ca52381624b3cdaf7fc487
ArkeiStealer
+ 3'612 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:1008 discovery spyware stealer
Link:
https://tria.ge/reports/211008-n316csebb6/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
Malware Config
C2 Extraction:
https://mas.to/@serg4325
Unpacked files
SH256 hash:
c6320d7467927e78c205fdca10484c14e53730bddd3958d93e11263e7871536e
MD5 hash:
ce26ceb3191ffa06f2d2879349b77140
SHA1 hash:
8d74d2b1ce1708c5bdcb8462b6c4f04ba2faefb4
Link:
https://www.unpac.me/results/f253ce2a-a178-4263-8738-a1bbe0d3333f/
SH256 hash:
c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d
MD5 hash:
97a67de6c513c817a96b65c3f5d48b29
SHA1 hash:
a939ee70f198a1ae0211d3928bcf03775e4ee0ac
Link:
https://www.unpac.me/results/f253ce2a-a178-4263-8738-a1bbe0d3333f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c4beb6af8d63/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe c4beb6af8d63d41d1215919cec9bd4e6883ad9a40d3628a15df2c192b389d57d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1584973/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1586513/
Cape
Cape
https://www.capesandbox.com/analysis/196147/

Comments