MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 10 File information Comments

SHA256 hash:	d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57
SHA3-384 hash:	8c5e5864f5431ec8bb6d74c2f4d216f8d9ae9cbb5fa2307efaae2c93067ec54d5ba8b6ff8a723d4face2a16d357e974c
SHA1 hash:	4200e6d839329ce2935aa53071021157ea0a07ca
MD5 hash:	7283347ba70004a56396caa0a2de7bb0
humanhash:	green-cardinal-robin-texas
File name:	7283347ba70004a56396caa0a2de7bb0
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	2'984'448 bytes
First seen:	2021-06-17 09:39:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	96778352d99ca84b52328b0725ee1935 (6 x ArkeiStealer)
ssdeep	49152:0pA6l5jszHjVcp5jKVK1CP9wnYEwMgb6eghQD5jKVKFOrnrgIYeghQ:kv5ozDVcp9KIQ4Ydb6DM9KIorsIYD
Threatray	2'911 similar samples on MalwareBazaar
TLSH	D7D5118049009D88E45A9FF364B624B3D76D1FFC6F64A81D3650FE324B762BD6344A2B
Reporter	zbetcheckin
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

165

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7283347ba70004a56396caa0a2de7bb0

Verdict:

Malicious activity

Analysis date:

2021-06-17 09:46:09 UTC

Tags:

trojan stealer vidar loader

Link:

https://app.any.run/tasks/94543c76-dc40-4b5c-b096-648b32c8dbe9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/166540/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46503008.6900.7353.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9abaff0b-277d-4dba-8eac-06d41eb33b7a

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/803619

Signature

Detected unpacking (changes PE section rights)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57/

Threat name:

Win32.Trojan.Caynamer

Status:

Malicious

First seen:

2021-06-16 17:18:02 UTC

AV detection:

16 of 29 (55.17%)

Threat level:

5/5

Verdict:

unknown

ArkeiStealer

0f0eb4a8a538f339214f86a8b084d685a4fb51d54f258f5718393003ab1ff35b

ArkeiStealer

327085587961067c31d10bc55deeecce6613b012fb2d13780480161e406667c2

ArkeiStealer

3ec3b418b0e06128ef80ff02866d30c8071ba54066411760b6f71cab0f4c24f9

ArkeiStealer

5a4f75c16948eb90210b50a2af901dad431a231d5a4406ce55dad0cd943d5cd0

ArkeiStealer

8b1c960881fc789460b5b274abd43baddb1c92e1a942d3a1080a4adb1f545e50

ArkeiStealer

a8fb61732f9696d24e02dda47d2f12abe0d8968e130f05d2381bb7b5a93f3ec0

ArkeiStealer

a9b0a14beac57ba149a978c8f0996a4f4e70e003b80c67e631947c9dc3590154

ArkeiStealer

d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

ArkeiStealer

f82ef04e370d0a646120bb980da33aa6d6d688300a7c6ea727da9ed6f702462c

ArkeiStealer

+ 2'901 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar discovery evasion spyware stealer trojan

Link:

https://tria.ge/reports/210617-xeqz5jnfz2/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar

Unpacked files

SH256 hash:

3010fa216592b5ceda621908e8569bb25628c2ddae9e28df8538c5a713dc7abc

MD5 hash:

47b50cfb29a31d7e173e6556207634ff

SHA1 hash:

a9c8b23837720203d12f329df2c7036d14fb5f53

Link:

https://www.unpac.me/results/22891fe7-aaf7-4d6c-be1e-47620c9d7022/

SH256 hash:

d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57

MD5 hash:

7283347ba70004a56396caa0a2de7bb0

SHA1 hash:

4200e6d839329ce2935aa53071021157ea0a07ca

Link:

https://www.unpac.me/results/22891fe7-aaf7-4d6c-be1e-47620c9d7022/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICOIUS_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	Vidar Create hunting rule
Author:	kevoreilly
Description:	Vidar Payload

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com