MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369
SHA3-384 hash: 29cdbf8d2a3cd95b459b8d279b73d986a94aa33011b3583384e04894516da6c4b7f04c8d77fad61a4b7b34b5ce6a162b
SHA1 hash: 3c8c0c522190599d70a56ab4e2286a7e75f71a57
MD5 hash: 945c83b2f80e0d932e4ce8976a56b8e0
humanhash: mountain-fillet-mountain-muppet
File name:945c83b2f80e0d932e4ce8976a56b8e0.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:728'576 bytes
First seen:2021-07-06 16:20:10 UTC
Last seen:2021-07-06 17:17:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:sXpFlW8AIl1OxY4an2IRCOh15EX5Lazoziu4n6j+YseYQNHaWW0KMn+:SlW8ipan2Ik81kwozioj+Ys9cHaWlJ
Threatray 1'690 similar samples on MalwareBazaar
TLSH 06F4125F6EE941A4E19186B2EC66F4008DB2796E2454D6CCB8CCE70B1F777C1CA42E27
Reporter abuse_ch
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
945c83b2f80e0d932e4ce8976a56b8e0.exe
Verdict:
Malicious activity
Analysis date:
2021-07-06 16:33:41 UTC
Tags:
trojan stealer vidar loader
Link:
https://app.any.run/tasks/3e75c628-430f-41a3-8ed5-f310a1a79441

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170045/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.9931.27892.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbda925d-e927-47fc-a8cd-c843459276ba
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/812437
Signature
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 444850 Sample: VMaXo6ZfgW.exe Startdate: 06/07/2021 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected Vidar 2->49 51 4 other signatures 2->51 8 VMaXo6ZfgW.exe 5 2->8         started        process3 file4 27 C:\Users\user\AppData\...\VMaXo6ZfgW.exe, PE32 8->27 dropped 29 C:\Users\...\VMaXo6ZfgW.exe:Zone.Identifier, ASCII 8->29 dropped 31 C:\Users\user\AppData\...\VMaXo6ZfgW.exe.log, ASCII 8->31 dropped 53 Writes to foreign memory regions 8->53 55 Injects a PE file into a foreign processes 8->55 12 VMaXo6ZfgW.exe 91 8->12         started        17 VMaXo6ZfgW.exe 8->17         started        signatures5 process6 dnsIp7 41 sergeevih43.tumblr.com 74.114.154.18, 443, 49720 AUTOMATTICUS Canada 12->41 43 162.55.223.232, 49721, 80 ACPCA United States 12->43 33 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 12->33 dropped 35 C:\Users\user\AppData\...\mozglue[1].dll, PE32 12->35 dropped 37 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 12->37 dropped 39 9 other files (none is malicious) 12->39 dropped 57 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->57 59 Tries to harvest and steal browser information (history, passwords, etc) 12->59 61 Tries to steal Crypto Currency Wallets 12->61 19 cmd.exe 1 12->19         started        63 Machine Learning detection for dropped file 17->63 file8 signatures9 process10 process11 21 taskkill.exe 1 19->21         started        23 conhost.exe 19->23         started        25 timeout.exe 1 19->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369/
Threat name:
ByteCode-MSIL.Trojan.Chapak
Create hunting rule
Status:
Malicious
First seen:
2021-07-06 16:20:24 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3uhhdw4rkfjhuzrhlidngfuk3jz6wwkvsxtk7sfqb4e4rljenuq._file
Verdict:
malicious
Similar samples:
096e8c1a31c8f8f0238c812422b4298e0c77b5e77ae93250e4fae24758e7c574
ArkeiStealer
1caf2367b85edbe5a5330d1edee51ac80aaacb99529d98a22cf847381db56edf
ArkeiStealer
3012b7a51af86d42beaaf6488f7166002226cbaee3ccb92e1c2a2d4b107c3930
ArkeiStealer
60c47c555c49428dd6623e73049c936e7a42687ce6506ee1e6b614585b52714f
ArkeiStealer
83b3a04479c4310f0ac695041b3c1d60c144be650d4b8838a395ca5a46e722e2
ArkeiStealer
8be9cec521fca3b82e924f94f7d13b253a9259c0ead8cabc4a71cd26d2ca8b7b
ArkeiStealer
b55dd061a60905c3a2208917883d326b08a3a7d1f8fdb94f78e6675375fc8219
ArkeiStealer
d4272fe57997732ba267f52ef06d823f9b186f91cf637a9795b6f161a5e79ef8
ArkeiStealer
d6ff71f4320761a9d08e753f0fe917ff018df8000405f1e789ce2f20dd22bc76
ArkeiStealer
eed5d4d5f2526cef97edf23ca6e02dc2579d3ac443b7a9f0b663119a90f1cf13
ArkeiStealer
+ 1'680 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery spyware stealer
Link:
https://tria.ge/reports/210706-ppmgfbr9kj/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Vidar Stealer
Vidar
Unpacked files
SH256 hash:
c479afa5916cf0483cbe819d20058d45d47becda7f04d55050dce71f17eaf2b4
MD5 hash:
ebcb9e3b9ce908f5626d9629b9c0f199
SHA1 hash:
aa27a0f1c3ede41806b1c4db6cc0bd08738c56b0
Link:
https://www.unpac.me/results/30489229-9cc1-4f49-85b9-3ec4c218efcf/
SH256 hash:
9533c800ccc358970a998e4a7c8a2e79abcab181361ba5b52afd2a7be0f12aa8
MD5 hash:
14e7b49d75096b1bff9061190b6727c5
SHA1 hash:
a2c98e7fed68ef32040122604c6423b9cf907567
Link:
https://www.unpac.me/results/30489229-9cc1-4f49-85b9-3ec4c218efcf/
SH256 hash:
ae737e04b30c894ca99e13161be33c2fa59331d61bdc07772e2423e054f791c5
MD5 hash:
de903d396c865f7efaee07822bf100c3
SHA1 hash:
39c437606d7ff3acefafb4114f1baebad5109e72
Link:
https://www.unpac.me/results/30489229-9cc1-4f49-85b9-3ec4c218efcf/
SH256 hash:
cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369
MD5 hash:
945c83b2f80e0d932e4ce8976a56b8e0
SHA1 hash:
3c8c0c522190599d70a56ab4e2286a7e75f71a57
Link:
https://www.unpac.me/results/30489229-9cc1-4f49-85b9-3ec4c218efcf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICOIUS_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe cee8738edc8a8a93d3313ad03698b456d39f5acaacaf357e4580784e45692369

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1427014/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/170045/

Comments