MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee
SHA3-384 hash: fd71e93863c78c3132999b080a4e5fe45a87a5f071d493889c13e908a369a5a2c792dc136f90e741be3fb84d1492604c
SHA1 hash: 363e201e6e7f43839f62b67ab7cce1e7f528db2d
MD5 hash: 6a685b5aa7f1fe94b05137e90ac7837f
humanhash: lemon-pip-pizza-september
File name:payload.bin
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'033'728 bytes
First seen:2026-07-08 07:32:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:cxmEXICq1zcLgURH1lcVQyNvKhT0xNhbPl5NUD7:cxNswLgURH1eN92
Threatray 24 similar samples on MalwareBazaar
TLSH T18925508ED9C213B5B396EBB3835EE2265DF535058072CA31CF8569358F02FA86418EDD
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter techjoe
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
payload.bin.exe
Verdict:
Malicious activity
Analysis date:
2026-07-08 07:36:17 UTC
Tags:
stealer stealc vidar
Link:
https://app.any.run/tasks/a0879c24-4afe-40d4-b093-1aa26f8a0e72

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73915/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Vidar.509.2694.24150.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4dfd22a900f0e9eb6a88dd
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt
DNS request
Behavior that indicates a threat
Sending a custom TCP request
Verdict:
Malicious
Labled as:
Vidar.Generic
Link:
https://www.hybrid-analysis.com/sample/dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-08T04:41:00Z UTC
Last seen:
2026-07-08T21:38:00Z UTC
Hits:
~100
Detections:
Trojan.Win32.Agent.xceooc Trojan-PSW.Vidar.HTTP.C&C Trojan-PSW.Stealerc.TCP.C&C Trojan-PSW.Stealerc.HTTP.C&C Trojan-PSW.Lumma.TCP.C&C Trojan-Banker.Bandra.TCP.C&C PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2c75f87f-7c3a-41f9-ae4d-7dab080ee64c
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee
Threat name:
Win64.Spyware.Vidar
Create hunting rule
Status:
Malicious
First seen:
2026-07-08 07:33:47 UTC
File Type:
PE+ (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3u5rthjfljptlwqc4fypqqbap3a3bttaijndgrf3utnepp65z7xa._file
Verdict:
malicious
Label(s):
vidar
Create hunting rule
Similar samples:
1c35c9ed37898f27c598828a4216100ac2676583c745fd380f32b0a8c27e7ed2
ArkeiStealer
27e3c9b676e96ef69a0043ebf547748ac7189207dc2100cc188ea024be596266
ArkeiStealer
5c38822c4c7a09ff1507b5371b954133968963852a2b81934a563389b2556b01
ArkeiStealer
79a00dc593777f03f4de27e234f44908a91d600766f34b40f59aa2100000dd09
ArkeiStealer
bc8e94b58309136cc8569823a8628906efec30c832c78a4cbf2e746264b92204
ArkeiStealer
ce76501a32a9144a8bec1336e3796e9ccc48ba648244c79f868f60cc605fdecd
ArkeiStealer
e438003e81399afda1a4801bdd3d347a757c2068c4dbbaa99d4f554972c546f0
ArkeiStealer
error
ArkeiStealer
f263db0d36dca341a8a77b2a081b29e537f8df6258f92b895df5d6f9f7791ecc
ArkeiStealer
f8c56b8a1ecfa06186f0d1dc3e566223aba52e282dcce895d493cbe78d9db512
ArkeiStealer
+ 14 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
credential_access discovery spyware stealer
Link:
https://tria.ge/reports/260708-jdtmrsdw6m/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee
MD5 hash:
6a685b5aa7f1fe94b05137e90ac7837f
SHA1 hash:
363e201e6e7f43839f62b67ab7cce1e7f528db2d
Link:
https://www.unpac.me/results/631cd13c-fa30-485a-84af-0479f28217c2/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dd3b199d255a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:Windows_Trojan_Vidar_57ae970e
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73915/

Comments