MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03
SHA3-384 hash: b14afbc6cd50443aac3a73d3f35ff2fe55d052517a5722c78780f282d55907c96da6f4d79cb8f1b998edf8367bc8f011
SHA1 hash: 55fbb82a4bf044658277c1df4ebfe3289375f365
MD5 hash: e01c0ac433f42d0f71d8853c51b6fbf2
humanhash: utah-nine-bacon-coffee
File name:SecuriteInfo.com.Variant.Lazy.238286.30914.26483
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'162'144 bytes
First seen:2022-08-29 08:49:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 48c28d9f3783f0e32815b0b4c57a60a9 (73 x RecordBreaker, 23 x RedLineStealer, 21 x ArkeiStealer)
ssdeep 24576:YR3W9N48ErPBE0daojszqWQ2aNedJ64ut7M:CrPBE0d+pjawsht7M
Threatray 4'666 similar samples on MalwareBazaar
TLSH T189359E203CD58072EFE210F626ECB675C2EDE4B007354AD756D447EED6632D16E32A8A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:ArkeiStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
arkei
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Variant.Lazy.238286.30914.26483
Verdict:
Malicious activity
Analysis date:
2022-08-29 08:57:52 UTC
Tags:
arkei trojan stealer
Link:
https://app.any.run/tasks/7acd1ee5-cbe0-4f70-8057-1537ad117d44

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/302133/
Detection(s):
SecuriteInfo.com.Variant.Lazy.238286.30914.26483.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/30696/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckNumberOfProcessor
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/630c7e225b45ec20ccd55c94/reports/2246f019-e321-4181-8e13-58cad6a71e5e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bf671874-75cf-465f-9fac-9d380498bcc5
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1059654
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 692174 Sample: SecuriteInfo.com.Variant.La... Startdate: 29/08/2022 Architecture: WINDOWS Score: 100 61 ultra-cheat.ru.net 2->61 75 Malicious sample detected (through community Yara rule) 2->75 77 Antivirus detection for URL or domain 2->77 79 Yara detected Vidar stealer 2->79 81 2 other signatures 2->81 10 SecuriteInfo.com.Variant.Lazy.238286.30914.26483.exe 2->10         started        signatures3 process4 process5 12 WerFault.exe 23 9 10->12         started        14 AppLaunch.exe 18 10->14         started        dnsIp6 19 FfNFFEnRje.exe 5 12->19         started        63 t.me 149.154.167.99, 443, 49718 TELEGRAMRU United Kingdom 14->63 65 transfer.sh 144.76.136.153, 443, 49726 HETZNER-ASDE Germany 14->65 67 2 other IPs or domains 14->67 59 C:\ProgramData\75153329786030032183.exe, PE32 14->59 dropped 69 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->69 71 Tries to harvest and steal browser information (history, passwords, etc) 14->71 73 Tries to steal Crypto Currency Wallets 14->73 23 75153329786030032183.exe 10 14->23         started        25 cmd.exe 1 14->25         started        file7 signatures8 process9 file10 55 C:\ProgramData\appdata64\JXOHU.exe, PE32+ 19->55 dropped 83 Antivirus detection for dropped file 19->83 85 Multi AV Scanner detection for dropped file 19->85 87 Detected unpacking (changes PE section rights) 19->87 89 2 other signatures 19->89 27 cmd.exe 19->27         started        29 powershell.exe 19->29         started        57 C:\Users\user\AppData\Local\Temp\...\work.exe, PE32 23->57 dropped 31 cmd.exe 1 23->31         started        33 taskkill.exe 1 25->33         started        35 conhost.exe 25->35         started        37 timeout.exe 1 25->37         started        signatures11 process12 process13 39 JXOHU.exe 27->39         started        42 conhost.exe 27->42         started        44 timeout.exe 27->44         started        46 conhost.exe 29->46         started        48 work.exe 9 31->48         started        51 conhost.exe 31->51         started        file14 91 Antivirus detection for dropped file 39->91 93 Multi AV Scanner detection for dropped file 39->93 95 Detected unpacking (changes PE section rights) 39->95 97 Machine Learning detection for dropped file 39->97 53 C:\Users\user\AppData\...\FfNFFEnRje.exe, PE32+ 48->53 dropped signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03/
Threat name:
Win32.Backdoor.Mokes
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 08:50:30 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=47x6ws3pu3xgnwahoofwzfakjz2yrynw2chhhf53ixhn7kdobubq._file
Verdict:
malicious
Similar samples:
3b7c41820030dd3392cd3be48b358d2f819418f6e26dccfb2caea57a9c9f4f57
ArkeiStealer
47946a569cf9ff9cd521b5c5d212678f58639542be9e03cc96b6b04174b7463c
ArkeiStealer
5561ed70e598b689bb0c13eb6d90dfde664d5f4c73baf0b7d9ccf7716d407a21
ArkeiStealer
b238622028e1c8056e42ffd70ce536e15dcf72de6e5ee4d931a3d2f84dcb085f
ArkeiStealer
bfd72713a43de4b27c8ba70b09faca3e9185ed89a0e567029413c5d0b0b8b3ad
ArkeiStealer
c54933cdb27353101ae6bb6a30099de037a4f78b546e859b2d9b94cab19d66e5
ArkeiStealer
d27953e7a1c041251f57bf1c29760eb5bcc1e3ab7095172880aba5cccc8f82ad
ArkeiStealer
d58abdd58558c413dd9698a9fb32608fede76d2a416fc5964a73ab358990134f
ArkeiStealer
d7ee06bc91ed02d92fbdbe70d935ef43018de0761a9d9965372b50c71e9b15de
ArkeiStealer
dfaf2f93303fe52caa66f107d5305053640f22333bedb22748a091b85105a5ac
ArkeiStealer
+ 4'656 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220829-krmbaaeehn/
Unpacked files
SH256 hash:
387bfda5646410f1bf193a2323bad8db0bd8ad603694091deb6631b794bc2cae
MD5 hash:
1f0b3eb4bc0028f423d1cbf8554145e2
SHA1 hash:
f6c23415fd43b5775778be4f73cc06660390975b
Detections:
win_vidar_auto
Create hunting rule
Link:
https://www.unpac.me/results/b8ffa3ae-d2c3-48a7-b2d7-1f1ddc079862/
Parent samples :
f1bd6af3d34634d4479097ec644a492a75bb53629f6f8a0956fb596491808899
ccfe14df961e512e8caea0159172066b46ca4b9ce4a791d938a9e68a6ab4e0e4
d9f280c1e9c66325c5d26ec4cb2e31e2f77d4a8e4fe806844c78806ec9eaf070
a6260a202c91161af5663fbf6b92e6bea949d6c4057fc1c50bed6d5eef648414
c0635c60971625cb8df933bb09192980edb41477c7ae57c622967ef4959bc1ae
3033615c656623c5cb1c3c8ed9955a010cdead860289fbd30e5ab3cc19551890
3819206572678f720748a6e68edd46ad3f5f780fc751009f1816f3aa78fe2eeb
c2948a53bbb65d4767a4175ed3974d7f855cefe118d737b3842ddf2bb597c32d
a3335686ef4e796c597c885d6531a639a9f1b16e4535147fc00d6015b60a8403
dfaf2f93303fe52caa66f107d5305053640f22333bedb22748a091b85105a5ac
d27953e7a1c041251f57bf1c29760eb5bcc1e3ab7095172880aba5cccc8f82ad
b238622028e1c8056e42ffd70ce536e15dcf72de6e5ee4d931a3d2f84dcb085f
d7ee06bc91ed02d92fbdbe70d935ef43018de0761a9d9965372b50c71e9b15de
d58abdd58558c413dd9698a9fb32608fede76d2a416fc5964a73ab358990134f
c54933cdb27353101ae6bb6a30099de037a4f78b546e859b2d9b94cab19d66e5
a9a694304e9e3e7503c87826281a47fd0e8748fbeca633dd5751fd5b548e6169
ed97b4c0be7debddeab70a60c2aa28e5fb13259ef8bda90afc3ef0c5c652fb79
bfd72713a43de4b27c8ba70b09faca3e9185ed89a0e567029413c5d0b0b8b3ad
4ed0a2a70201af95d1ad425d7eeaf17e324724d84470a1f43ebd73e057cee96b
bd38c373624823ee9b3283ac21e1b6261928db18dec120e9e7625979c3437f77
035476e090a9b48358022a1f621bc66080cadc63bac16d6c21a6adc2335277b9
70b00b4093a144ca7b98c76a932cdba660468064b06dd2e7c865d4f296965d94
e1aa53eda6281824c1c0f43f4ea7aee326a06f6fb67f6570f4db6cc1e5726096
3b7c41820030dd3392cd3be48b358d2f819418f6e26dccfb2caea57a9c9f4f57
47946a569cf9ff9cd521b5c5d212678f58639542be9e03cc96b6b04174b7463c
5561ed70e598b689bb0c13eb6d90dfde664d5f4c73baf0b7d9ccf7716d407a21
e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03
5dae34b720991515d59f5441bd310493c7c1b57540ea7df38963475b642a248e
SH256 hash:
e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03
MD5 hash:
e01c0ac433f42d0f71d8853c51b6fbf2
SHA1 hash:
55fbb82a4bf044658277c1df4ebfe3289375f365
Link:
https://www.unpac.me/results/b8ffa3ae-d2c3-48a7-b2d7-1f1ddc079862/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

Executable exe e7efeb4b6fa6ee66d807738b6c940a4e7588e1b6d08e7397bb45cedfa86e0d03

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/302133/
  
URLhaus
https://urlhaus.abuse.ch/url/2283045/
  
Delivery method
Distributed via web download

Comments