MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454
SHA3-384 hash: bfec9bfcf8c348318c94072f7cef1750f13f956ace99c49105dfe5ab21729a1543be1ba3e1d24d3aaa19d1e8dafc49ea
SHA1 hash: 6353a9f6b1e32913a1cafd0b53d95006e693a991
MD5 hash: 2d6d77d56d45d751d13bf0483a21cf6d
humanhash: quiet-charlie-cup-moon
File name:2d6d77d56d45d751d13bf0483a21cf6d
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'077'248 bytes
First seen:2021-10-05 18:47:07 UTC
Last seen:2021-10-05 19:47:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31fdddb41123508749dd6c9468f73e6f (2 x RaccoonStealer, 2 x ArkeiStealer, 1 x AZORult)
ssdeep 24576:IlE2q8MnAWRpnwU9QtTJaur6Syt4VhkFha1OIgImZk3xk5npFhkF96x5hkFYelc:2EeKTqtN7r7VV0VIm0yRpF0I0u
Threatray 9'522 similar samples on MalwareBazaar
TLSH T1763512276E271563F01409B14AF051F64F3EAC27B8826E5FEB46F91D0DB2706B8D127A
Reporter zbetcheckin
Tags:32 ArkeiStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
561
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195186/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.15766.16432.4090.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Creating a file
Reading critical registry keys
Launching the default Windows debugger (dwwin.exe)
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Query of malicious DNS domain
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware obfuscated packed
Link:
https://www.filescan.io/uploads/615c9de4e3d213d202b7bd8d/reports/0f144194-480c-45a4-a41b-68296972f702/overview
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3519b1bf-f4f2-48dc-aa75-22db77912223
Result
Threat name:
Azorult Clipboard Hijacker DBatLoader IP
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/865058
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Self deletion via cmd delete
Sigma detected: Bypass UAC via Fodhelper.exe
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Clipboard Hijacker
Yara detected Costura Assembly Loader
Yara detected DBatLoader
Yara detected IPack Miner
Yara detected Raccoon Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 497486 Sample: DwssKedtup Startdate: 05/10/2021 Architecture: WINDOWS Score: 100 139 82.102.27.195, 46017, 49809 M247GB United Kingdom 2->139 141 162.159.135.233, 443, 49808 CLOUDFLARENETUS United States 2->141 143 cdn.discordapp.com 2->143 157 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->157 159 Malicious sample detected (through community Yara rule) 2->159 161 Antivirus detection for URL or domain 2->161 163 15 other signatures 2->163 12 DwssKedtup.exe 16 2->12         started        16 fodhelper.exe 2->16         started        signatures3 process4 dnsIp5 107 C:\Users\user\AppData\Local\Temp\ssme.exe, PE32 12->107 dropped 109 C:\Users\user\AppData\Local\Temp\faame.exe, PE32 12->109 dropped 187 Self deletion via cmd delete 12->187 189 Maps a DLL or memory area into another process 12->189 19 ssme.exe 4 12->19         started        22 DwssKedtup.exe 85 12->22         started        26 faame.exe 4 12->26         started        133 162.159.129.233, 443, 49799 CLOUDFLARENETUS United States 16->133 135 192.168.2.1 unknown unknown 16->135 137 cdn.discordapp.com 16->137 191 Injects a PE file into a foreign processes 16->191 file6 signatures7 process8 dnsIp9 165 Maps a DLL or memory area into another process 19->165 28 ssme.exe 69 19->28         started        145 91.219.236.243, 49783, 49794, 80 SERVERASTRA-ASHU Hungary 22->145 147 t.me 149.154.167.99, 443, 49782 TELEGRAMRU United Kingdom 22->147 99 C:\Users\user\AppData\...\WPr4OhBWDp.exe, PE32+ 22->99 dropped 101 C:\Users\user\AppData\...\SgsQWZYaZl.exe, PE32 22->101 dropped 103 C:\Users\user\AppData\...\vcruntime140.dll, PE32 22->103 dropped 105 58 other files (none is malicious) 22->105 dropped 167 Tries to steal Mail credentials (via file access) 22->167 169 Self deletion via cmd delete 22->169 171 Tries to harvest and steal browser information (history, passwords, etc) 22->171 33 WPr4OhBWDp.exe 22->33         started        35 SgsQWZYaZl.exe 22->35         started        37 cmd.exe 22->37         started        39 faame.exe 191 26->39         started        file10 signatures11 process12 dnsIp13 151 ailsom.ac.ug 185.215.113.77, 49781, 49784, 49793 WHOLESALECONNECTIONSNL Portugal 28->151 113 C:\Users\user\AppData\Local\Temp\pm.exe, PE32+ 28->113 dropped 115 C:\Users\user\AppData\Local\Temp\cc.exe, PE32 28->115 dropped 117 C:\Users\user\AppData\...\vcruntime140.dll, PE32 28->117 dropped 125 47 other files (none is malicious) 28->125 dropped 193 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 28->193 195 Tries to steal Instant Messenger accounts or passwords 28->195 197 Tries to steal Mail credentials (via file access) 28->197 215 2 other signatures 28->215 41 cc.exe 28->41         started        45 pm.exe 28->45         started        48 cmd.exe 28->48         started        199 Writes to foreign memory regions 33->199 201 Allocates memory in foreign processes 33->201 203 Modifies the context of a thread in another process (thread injection) 33->203 50 powershell.exe 33->50         started        153 cdn.discordapp.com 35->153 205 Detected unpacking (changes PE section rights) 35->205 207 Detected unpacking (overwrites its own PE header) 35->207 209 Injects a PE file into a foreign processes 35->209 52 SgsQWZYaZl.exe 35->52         started        54 conhost.exe 37->54         started        56 timeout.exe 37->56         started        155 milsom.ug 39->155 119 C:\ProgramData\vcruntime140.dll, PE32 39->119 dropped 121 C:\ProgramData\sqlite3.dll, PE32 39->121 dropped 123 C:\ProgramData\softokn3.dll, PE32 39->123 dropped 127 4 other files (none is malicious) 39->127 dropped 211 Tries to harvest and steal browser information (history, passwords, etc) 39->211 213 Tries to steal Crypto Currency Wallets 39->213 58 cmd.exe 39->58         started        file14 signatures15 process16 dnsIp17 149 cdn.discordapp.com 162.159.134.233, 443, 49796, 49797 CLOUDFLARENETUS United States 41->149 173 Detected unpacking (changes PE section rights) 41->173 175 Detected unpacking (overwrites its own PE header) 41->175 177 Uses schtasks.exe or at.exe to add and modify task schedules 41->177 179 Injects a PE file into a foreign processes 41->179 60 cc.exe 41->60         started        63 cmd.exe 41->63         started        65 cmd.exe 41->65         started        129 C:\Users\user\AppData\...\aspnet_compiler.exe, PE32+ 45->129 dropped 131 C:\Users\user\AppData\Roaming\winda.exe, PE32+ 45->131 dropped 181 Writes to foreign memory regions 45->181 183 Allocates memory in foreign processes 45->183 185 Modifies the context of a thread in another process (thread injection) 45->185 67 powershell.exe 45->67         started        69 powershell.exe 45->69         started        77 2 other processes 48->77 71 conhost.exe 50->71         started        73 conhost.exe 58->73         started        75 taskkill.exe 58->75         started        file18 signatures19 process20 file21 111 C:\Users\user\AppData\...\fodhelper.exe, PE32 60->111 dropped 79 schtasks.exe 60->79         started        81 cmd.exe 63->81         started        83 conhost.exe 63->83         started        85 reg.exe 65->85         started        87 conhost.exe 65->87         started        89 conhost.exe 67->89         started        91 conhost.exe 69->91         started        process22 process23 93 conhost.exe 79->93         started        95 conhost.exe 81->95         started        97 conhost.exe 85->97         started       
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454/
Threat name:
Win32.Trojan.Chapak
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 12:36:17 UTC
AV detection:
24 of 45 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yz3ergs34dj32zu5swj27dgkgf6ncd75i6fgvvr5xnnbrrwbarka._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
raccoon
Create hunting rule
Similar samples:
14a0d25b4d33216e9110c9588fa3168105efdad28827e772c4798337544eb708
ArkeiStealer
1b9339d0a70cdef37f4827a81100f9e8158a5633dc8b7a2c3b616f070ce49b5d
ArkeiStealer
1eb39c14abcac667ca35cf294bfda8ac6282b93028d830f1665afa2a87cff4ef
ArkeiStealer
314afbf4a221c8ce6f8d2674277a3c2fb119c34222b5c3ed83afd79005e352f4
ArkeiStealer
547bf6d6ed5ae181513ed653109514c73e5f50c3ea3a094bcd382fbd3c4b4bb0
ArkeiStealer
7982b6446285ca06d96a1bc1e0ac8a2618123664173bff105d02e22bf617c757
ArkeiStealer
a60bebe1f77523c999022885b6d6ba4c2e96e930d21b26f2254f113e179c48cc
ArkeiStealer
d3d844bca757cfac2bc5cd8cc9bd9d806358eb3af100fdecddb5d0848cd706af
ArkeiStealer
fa40dc2c8055f953099d7d354ba97fbf3a5f3aa501ce95cb8cefa810b80ea5d4
ArkeiStealer
+ 9'512 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:azorult family:oski family:raccoon botnet:e16d9c3413a8d3bc552d87560e5a14148908608d discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/211005-xfsedaacb6/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Azorult
Oski
Raccoon
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://195.245.112.115/index.php
milsom.ug
Unpacked files
SH256 hash:
b02b7a3ec7c484bf3fdd397aa74e7b0d06558567ee49d3e33990b610f85c6db1
MD5 hash:
4faa3664947052e1d7aff5462ddae6ce
SHA1 hash:
825716099dd7aad782586e65a39ae0d2b3aafade
Detections:
win_raccoon_auto
Create hunting rule
Link:
https://www.unpac.me/results/38689f4f-8fa4-4c4a-a611-ffa88a59bf2a/
Parent samples :
d3d844bca757cfac2bc5cd8cc9bd9d806358eb3af100fdecddb5d0848cd706af
314afbf4a221c8ce6f8d2674277a3c2fb119c34222b5c3ed83afd79005e352f4
c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454
SH256 hash:
663101d4228a95a6f587c367d26018797b7995501eda91aee1f1bfedd04551d5
MD5 hash:
a6eaec1d48ce63b1985f8ae1d2e31cc4
SHA1 hash:
088c87d09d925380c4e667e070b85aa5f21546de
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/38689f4f-8fa4-4c4a-a611-ffa88a59bf2a/
SH256 hash:
1ef85805e96c8ed28b3aa6824071a751543a3fb02ecd84dc30069d532d29cd58
MD5 hash:
eaa47340a223302af456f649b0213997
SHA1 hash:
2d91a77a75c2b5afd7476a69d6cebd06812e8d17
Detections:
win_oski_g0
Create hunting rule
win_oski_auto
Create hunting rule
Link:
https://www.unpac.me/results/38689f4f-8fa4-4c4a-a611-ffa88a59bf2a/
SH256 hash:
c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454
MD5 hash:
2d6d77d56d45d751d13bf0483a21cf6d
SHA1 hash:
6353a9f6b1e32913a1cafd0b53d95006e693a991
Link:
https://www.unpac.me/results/38689f4f-8fa4-4c4a-a611-ffa88a59bf2a/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c676489a5be0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
vidar
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_oski_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.oski.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/446434/
  
URLhaus
https://urlhaus.abuse.ch/url/399075/
  
URLhaus
https://urlhaus.abuse.ch/url/437013/
  
URLhaus
https://urlhaus.abuse.ch/url/265919/
Cape
Cape
https://www.capesandbox.com/analysis/195186/

Comments


Avatar
zbet commented on 2021-10-05 18:47:08 UTC

url : hxxp://jamshed.pk/zxcv.EXE