MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6f8c819dea82e309907900229169ee7f81debb9685307f0805fdbe0f106b816. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6f8c819dea82e309907900229169ee7f81debb9685307f0805fdbe0f106b816
SHA3-384 hash: 7973751e3fa8334e273233022ea2b677f1172b688e943c04c39512a4af7eb3636cd0528034e86a076e94e2a789aaf70c
SHA1 hash: 81435282fe35a7f7438eb5769e3c6e669acae953
MD5 hash: 21e0716700cf415e87aebca5364ce066
humanhash: may-florida-lithium-rugby
File name:file
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:5'632 bytes
First seen:2022-08-25 19:33:04 UTC
Last seen:2022-08-26 00:05:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 48:6NmgOIqagN6a5MOlCtcC0heFNMO+yEP+96R5VnFaC39sib1G+sbcZsFtoAl3h3sh:fIKpUt0h2+yEpTLaS9siJSD/zNt
Threatray 4'631 similar samples on MalwareBazaar
TLSH T1CDC1A61293E483B7EBB24B31DCB3670046B9F650CD62DB9D39D4670F6D176048A62B62
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:ArkeiStealer exe


Avatar
andretavare5
Sample downloaded from https://vk.com/doc746114588_646371237?hash=zVBdjhzTYOZtTLWcFuNojzMzfHL3TZsBdKIo6BXM8UL&dl=G42DMMJRGQ2TQOA:1661455711:TIDULkWA9YsQFczzXIXQhTJp8zcBU1HqGZGXKBObBjP&api=1&no_preview=1#build

Intelligence

File Origin
# of uploads :
2
# of downloads :
396
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2022-08-25 19:34:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/65facddf-8107-4a84-8132-26aa8285bdc7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/301251/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the Windows subdirectories
Launching cmd.exe command interpreter
Creating a file
Creating a window
Creating a file in the system32 subdirectories
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd.exe greyware packed
Link:
https://www.filescan.io/uploads/6307cec805ef0c24e425f58a/reports/396a81d7-b265-4423-a092-0bdbfa2ad179/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/06a99b0a-77ed-4ff9-99a5-1f3700fabd6a
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1057948
Signature
Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 690461 Sample: file Startdate: 25/08/2022 Architecture: WINDOWS Score: 92 41 Malicious sample detected (through community Yara rule) 2->41 43 Yara detected Vidar stealer 2->43 45 Machine Learning detection for sample 2->45 9 file.exe 14 5 2->9         started        process3 dnsIp4 39 poupahotel.com.br 31.170.163.216, 443, 49718 AS-HOSTINGERLT United States 9->39 31 C:\Windows\Temp\bulik1.exe, PE32 9->31 dropped 33 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 9->33 dropped 13 cmd.exe 1 9->13         started        15 conhost.exe 9->15         started        file5 process6 process7 17 bulik1.exe 17 13->17         started        21 conhost.exe 13->21         started        dnsIp8 35 t.me 149.154.167.99, 443, 49723 TELEGRAMRU United Kingdom 17->35 37 159.69.100.194, 49724, 80 HETZNER-ASDE Germany 17->37 47 Antivirus detection for dropped file 17->47 49 Detected unpacking (creates a PE file in dynamic memory) 17->49 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->51 53 3 other signatures 17->53 23 cmd.exe 1 17->23         started        signatures9 process10 process11 25 taskkill.exe 1 23->25         started        27 conhost.exe 23->27         started        29 timeout.exe 1 23->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6f8c819dea82e309907900229169ee7f81debb9685307f0805fdbe0f106b816/
Threat name:
ByteCode-MSIL.Trojan.RealProtectPENGSD
Create hunting rule
Status:
Malicious
First seen:
2022-08-25 19:34:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y34mqgo6vaxdbgihsabcsfu6474b325znbjqp4eal7n6b4igxala._file
Verdict:
malicious
Similar samples:
12ee887170eb077553cfb8ab8952c4af4508bbaffcd60f0b84762399dda49878
ArkeiStealer
35e67bf049cb9c2d9c6af0f2f29fffef0279a0953732240b6cdc7c1b12121d23
ArkeiStealer
68652defc71770065997b7d60a64a3959446a114a2ee17a443a15ae8b767f150
ArkeiStealer
82a108c44defd4e43bf5bdee2bbadbf7f62870683557276b698d15845267c722
ArkeiStealer
a6bf3911b0e15a974b668c2a113b6c75825411213e4fa3bb5fc8b478cfce6535
ArkeiStealer
b1e62cecdf705a662dc9638e12d238378e2775d75b3aa63a01552dee8d5da346
ArkeiStealer
b7bf04a5d5d14c38358fb28f8e2453bf45926684769ad6a79a4bf110d8587af5
ArkeiStealer
d31417562046b5900d948f409bad174f8801b3ee9d4fd2644b3d36ac60a47cc5
ArkeiStealer
e9cd5b800c1af1c0759935e2cdf85a4f062da5a982957760295aaed1aa2e5c8c
ArkeiStealer
f8e0071b5a217e2caf3193ff532db9cdff04a9bb61090518204d46e05f8d3ec3
ArkeiStealer
+ 4'621 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/220825-x95xkaafe6/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
c6f8c819dea82e309907900229169ee7f81debb9685307f0805fdbe0f106b816
MD5 hash:
21e0716700cf415e87aebca5364ce066
SHA1 hash:
81435282fe35a7f7438eb5769e3c6e669acae953
Link:
https://www.unpac.me/results/45d78492-91b2-4510-86ec-15a51ee921d9/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c6f8c819dea8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6f8c819dea82e309907900229169ee7f81debb9685307f0805fdbe0f106b816

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/301251/

Comments