MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd56aa044bfb8c5acdc0a475b724252ea9e9d760d4bdf510e304c58aabd33e41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd56aa044bfb8c5acdc0a475b724252ea9e9d760d4bdf510e304c58aabd33e41
SHA3-384 hash: 830926f039c66d23b6ae0f857fb3f889508d3c31a4386eb892bceb8e02179fd6e965985e0f8a4a68e514750b5eea88f7
SHA1 hash: 5ba3082d9be1cb0a2cf8a963949781c3abff0343
MD5 hash: 6b7cae784fddad93c0771b813581e6e9
humanhash: fifteen-fillet-lithium-pip
File name:library
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:337'920 bytes
First seen:2022-10-25 11:44:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9277faa69a3b2f155b9e8565ccbc8235 (7 x RedLineStealer, 4 x Tofsee, 4 x ArkeiStealer)
ssdeep 6144:ijHvphT4LjV4EiE+8QrJQm3uztMyfl3qZL4m8btX6tMMk:ijPph0nKEJQrJQmLAkZPUQi
Threatray 760 similar samples on MalwareBazaar
TLSH T1C974E12236D1C472D76B01359D60DAB65BBBB8710B72469B7BC8036D8F342A2DF35706
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9a9acadecee6eaee (98 x Smoke Loader, 33 x RedLineStealer, 24 x ArkeiStealer)
Reporter JAMESWT_WT
Tags:ArkeiStealer exe

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://64.44.61.136/ https://threatfox.abuse.ch/ioc/945400/

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
socelars
Create hunting rule
ID:
1
File name:
644ECDD263538E3F6DA1689A78B77101DD86451AFB376.exe
Verdict:
Malicious activity
Analysis date:
2022-10-25 01:41:27 UTC
Tags:
evasion opendir trojan socelars stealer loader redline rat tofsee ficker miner vidar
Link:
https://app.any.run/tasks/6359d4aa-9881-485e-ac38-989983ca7c15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/323994/
Detection(s):
Win.Packed.Tofsee-9975828-0
Create hunting rule

Win.Packed.Tofsee-9975830-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/204f08ed-0fbc-40a9-b12d-9fe624d1ed92
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097507
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 730158 Sample: library.exe Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 59 Multi AV Scanner detection for domain / URL 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 Antivirus detection for URL or domain 2->63 65 5 other signatures 2->65 7 library.exe 21 2->7         started        12 punpun.exe 2 2->12         started        14 punpun.exe 1 2->14         started        process3 dnsIp4 41 45.15.156.60, 49701, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 7->41 43 t.me 149.154.167.99, 443, 49698 TELEGRAMRU United Kingdom 7->43 45 64.44.61.136, 49700, 80 NEXEONUS United States 7->45 33 C:\Users\user\AppData\...\qwe22zdlAq[1].exe, PE32 7->33 dropped 35 C:\ProgramData\sqlite3.dll, PE32 7->35 dropped 37 C:\ProgramData\29828562130380514284.exe, PE32 7->37 dropped 67 Detected unpacking (changes PE section rights) 7->67 69 Detected unpacking (overwrites its own PE header) 7->69 71 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 7->71 73 3 other signatures 7->73 16 29828562130380514284.exe 7->16         started        19 cmd.exe 1 7->19         started        21 conhost.exe 12->21         started        23 conhost.exe 14->23         started        file5 signatures6 process7 signatures8 51 Multi AV Scanner detection for dropped file 16->51 53 Writes to foreign memory regions 16->53 55 Allocates memory in foreign processes 16->55 57 Injects a PE file into a foreign processes 16->57 25 RegSvcs.exe 1 14 16->25         started        29 conhost.exe 19->29         started        31 timeout.exe 1 19->31         started        process9 dnsIp10 47 nanoplow.space 25->47 49 79.137.196.121, 1488, 49702 PSKSET-ASRU Russian Federation 25->49 39 C:\Users\user\AppData\Roaming\...\punpun.exe, PE32 25->39 dropped file11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd56aa044bfb8c5acdc0a475b724252ea9e9d760d4bdf510e304c58aabd33e41/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-10-25 02:29:33 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vlkubcl7ogfvtoaur23ojbff2u6tv3a2s67kehdatcyvk6thzaq._file
Verdict:
malicious
Similar samples:
11a3fde6fbce94c261cc8785856d132eccd5239e95a9129c2ba404cad58bbd96
ArkeiStealer
1adc68849d784b9530292b7187f492aa1d798d89a099a9eb8105fdfc9edaf2a0
ArkeiStealer
1d9dd4ae9d1ba20dbf36549110c16150525122f3aa7fdd390c66b7a6bfb752e4
ArkeiStealer
2a929266c1c731452ab4171a4c6cb980d6c84a6cc81e2bec5b1dacec075113bf
ArkeiStealer
334fb1c3def58d304673a7be8b63399d481bc45a8c33567003c09784efd16ebd
ArkeiStealer
50b4e60ae4821dc249f2a2c2477818f0736a23a8f8968f34bb5bfb3c64a00722
ArkeiStealer
6c56b6a178c64adef96a65fab45b58a7378b17262420a31addd0ec239e12e7c7
ArkeiStealer
a334fa92fab1199f16a272b0f2f63465750f98bed946d23f8f7ae498206ca553
ArkeiStealer
+ 750 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:1636 discovery persistence spyware stealer
Link:
https://tria.ge/reports/221025-nwqfaacegk/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Vidar
Malware Config
C2 Extraction:
https://t.me/dghzq
https://t.me/zjsqpz
https://t.me/fqwexzq
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b13ad374-ec23-4e23-a797-5d1d72c99df0
Unpacked files
SH256 hash:
1db3706dde0c91b11dd5e98f9902da57814f513236bef1a4c5ee5e8f1f9d20c2
MD5 hash:
306db7e74d10f1e0f92808fccff7cf7a
SHA1 hash:
6c127cfebcb20805cc585437fb2df5ead3a88853
Link:
https://www.unpac.me/results/da60f334-8193-406f-aa4d-425cb40f6ae3/
SH256 hash:
dd56aa044bfb8c5acdc0a475b724252ea9e9d760d4bdf510e304c58aabd33e41
MD5 hash:
6b7cae784fddad93c0771b813581e6e9
SHA1 hash:
5ba3082d9be1cb0a2cf8a963949781c3abff0343
Link:
https://www.unpac.me/results/da60f334-8193-406f-aa4d-425cb40f6ae3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd56aa044bfb8c5acdc0a475b724252ea9e9d760d4bdf510e304c58aabd33e41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Vidar
Create hunting rule
Author:kevoreilly,rony
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323994/

Comments