MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 5 File information Comments 1

SHA256 hash:	ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c
SHA3-384 hash:	c92d8eb781d57e1230527c02506dcce49ba7f8c9deefae794fd18a04f6d945a43ea1373a1e3606e7d956b6342d7467f8
SHA1 hash:	6c1895e481cc9b1c133ee1eb4f6c43b7cbc145bd
MD5 hash:	44e201b2d45298ed6a3947b5ceef42d4
humanhash:	skylark-autumn-fish-undress
File name:	44e201b2d45298ed6a3947b5ceef42d4.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	676'864 bytes
First seen:	2021-04-26 13:26:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a33149bde7821b9e9e3ba1d12a115144 (2 x ArkeiStealer, 1 x RaccoonStealer)
ssdeep	12288:/lQZRHEt6j+Coab7veAHVsu7HPRelLsHCNu41MImShS9IJXsDVGw3nHpa:NIHEA6CV+UFjPRTiIWvPhkIJXsBGw3Ja
Threatray	708 similar samples on MalwareBazaar
TLSH	93E4F111B1C1C032D9B220728865CBB54A6AFC65971556CBAB887F7DAF34FE16B3420F
Reporter	abuse_ch
Tags:	ArkeiStealer exe

abuse_ch

ArkeiStealer C2:
http://78.47.81.226/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://78.47.81.226/	https://threatfox.abuse.ch/ioc/10151/

Intelligence

File Origin

# of uploads :

# of downloads :

231

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

44e201b2d45298ed6a3947b5ceef42d4.exe

Verdict:

Malicious activity

Analysis date:

2021-04-26 13:30:50 UTC

Tags:

trojan stealer vidar loader

Link:

https://app.any.run/tasks/0d9a8296-74fd-4a39-bd89-39a3b7f381ea

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/144377/

Detection(s):

SecuriteInfo.com.Malware.PDB-11.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending a custom TCP request

Creating a file

Connection attempt

Sending an HTTP GET request

Deleting a recently created file

Replacing files

Reading critical registry keys

Delayed writing of the file

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Searching for the window

Launching a process

Stealing user critical data

Launching a tool to kill processes

Forced shutdown of a browser

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Vidar

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/698012

Signature

Country aware sample found (crashes after keyboard check)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c/

Threat name:

Win32.Infostealer.Racealer

Status:

Malicious

First seen:

2021-04-26 13:27:08 UTC

AV detection:

15 of 47 (31.91%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5swed2uftsn2gsz7np53nzesflv7oyoamvocbyxjvfs565rhiega._file

Verdict:

malicious

ArkeiStealer

3aecc29c243a0781768603d0a25b331963aaa1ef6a56f0677eb760a34bf2ea2c

ArkeiStealer

5ec867a0bdc659c8266dd9000d873495170cdd9e9b4687749966260bab4a55f0

ArkeiStealer

75353832f53e2cb6fa45f6480ef70fa5ef8a37c5797baa4aacc65e37bf4087b9

ArkeiStealer

942f4661c17b49061467e305b9d5fe5be2a061f1def29bec379c7588149dc6e1

ArkeiStealer

aac55c1eebf403b1c8db9eed2812e6a84d95f4321738bd09bb4fd6630db94b96

ArkeiStealer

b8a1b4a3338480556ea537f577d27f4506280f77eb0834f92568ae412f66cd7a

ArkeiStealer

b9152b30240e7f0a2a14276fdacc79e6e106419d118423d48287df3c35cad766

ArkeiStealer

da7c1a29438b2c219e7ef8d84b198604d663de649d4f8fca71a3f46b895eaf1c

ArkeiStealer

e42427d6531ff454ec019e117544fcf44d2c88b7bb5485bf76f93013ca91181a

ArkeiStealer

+ 698 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar discovery spyware stealer

Link:

https://tria.ge/reports/210426-gvjhgah8en/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Vidar

Unpacked files

SH256 hash:

06a04e44b4c7375a1ba0c559e6a2007a7f7771dcbf65782782b27673e676b681

MD5 hash:

51cf0ac0333f926dade7890159d172a0

SHA1 hash:

3ba2a0b36960235aeabddcf36a9b4b76b2e9b230

Detections:

win_vidar_auto

Link:

https://www.unpac.me/results/0b036ab2-c012-480b-9ffe-27ab1e529568/

Parent samples :

efdb5e9fdd74b02096b66c5fa2a68de20af19f069f1f18d4cad5ddd06c0776b3
05489477d2152d2c6854707d7eb96ef2178b0d7c83321f42a03588ffe2dfb21d
a0f86b221315031395511a0f54f29a14af07426c325a17c655bdca52e446e61c
31c36ff08b6dc2e3c953f933c80f8035214ad8b9bee4870109cb1aacebdb475c
c885cbcd6ec66d984d6137a5cd9b60474760719bad20bf2593e4db3cb3f29244
031def4c4a5777dfdf5a789590e26cc840ca75db0e51f02cc45b954a407b1ecc
0cda6c7a003ac1c8c7a84a6776bac14cbc4cf55e18b54a9bae9b403b92085fd6
92feae56c4764721e536746cbb504b5a3adacaafc98c3788a7a33861a87a8a27
ab22b4ae9279d479a74f4a931d5e2365eca8da376a2309dd01311d97b5590f1b
76830262ca43f5e3122b76ac05bffb6bc92e65fd90a00a1703ffff01e5483ec3
352bbcd8b2bbf4a422befb73314b8d477191d48caa369f982d2559fe4a0df3e1
6984fa0cd801ff8c108ff3b8f033b92acd22210b4a787d86447176d0b4b8a092
82b25d9187d61c122110398d28cd3730b0a64e4a1882616d79ebde796cb44cfe
2b34da8a8450f03c6401808a4699509737169c381cc2ce9b26ce8558f982fabe
89ffc3261c5c8c77931ea6fee5b7202da6c6f4d6ea27fec331265373df86d37a
d3e59ffe1442a383a9f784f12bfdda7370b3b7b21c06397f90acb889da45c152
f9d5060e2244643c2d30731cc3941f9eff2d17350fd1499b586cabf6d35fa464
dad775c0ee1ea4da926ed680e6883d41b68cbac40d81eea92506a1ff0574a23c
5287a2fea8db1b23b8e6dffa18229dbabaa2c9458f8f04aad907968edefa836e
f86a60efa370e34c5f0ba6b700ca433ae7df04fa8a6f0d8a0d84a45fd93430d7
2484d40bb7e1ee95471fd715dc6a3c498ee4c1c994cf14faf2670b02039b5a95
c396edfaa97ce171116e0c5dc6f522b18174e89a2ad82f7115b4582b9603c29e
da75542a383e884d1c8e508a0bdc1494182742a8d1bc70baf6b8f626f754c0cc
b066d298ed06f2f02095c36a0e7dc79261a1e8817d55f98ee8ff97226d945c41
725ab6533c6441a180fa96b407f341738162214752c254695f59dc8ed00eea4d
a5071abd1503be96588c904a90ce51995a3a6150da258907d3c0bc861bb2565c
1febc420a5c1e788a1c7157033ea9a246a6e2cdd05b5c4d868915d0ac7727c12
bb83dd531378703a7c9ba960a32f88b8f5ef84eab00a10c5be5b0d2ab92c6674
43e869f2af7cf8ab9997069647086f199e85703c5b3e9a8feef7b2b5c33f9002
6baff0d57ec43676b6a41d4894e687b69d51195f3597c5b3272d0e21a5f511a5
e0fa22ba5192a6b6844ec4665f8c5f6e33e36ae7bb77d16f05a578c445f3df46
226c5a97c0f1493f1f05fb404c2201446f4d4e3df0876eafe9e56abe5524eeea
b9152b30240e7f0a2a14276fdacc79e6e106419d118423d48287df3c35cad766
ed035775e8b0a19885bf7edf064fc6715f3aada3b539348aa66e06f355b5ce0b
bbecfebaa558979217a7ed84079b30cf54502af5e90a90c4ed370d46df2a3b5b
e42427d6531ff454ec019e117544fcf44d2c88b7bb5485bf76f93013ca91181a
2437ef42a6f12ad15f66318236b5e8079d40f171fcc8a4d5065f18b0cfecb466
0dc81d0391c74a3eef17e8b25dd7733883eca6b9dffdbee81ee85497b5262de6
da7c1a29438b2c219e7ef8d84b198604d663de649d4f8fca71a3f46b895eaf1c
14daec5258539d3a3ad5ff1bd6ba45d0015dcf9e5ef6c5181aa0cf7b0932c8f5
75353832f53e2cb6fa45f6480ef70fa5ef8a37c5797baa4aacc65e37bf4087b9
ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c

SH256 hash:

ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c

MD5 hash:

44e201b2d45298ed6a3947b5ceef42d4

SHA1 hash:

6c1895e481cc9b1c133ee1eb4f6c43b7cbc145bd

Link:

https://www.unpac.me/results/0b036ab2-c012-480b-9ffe-27ab1e529568/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	Ping_Del_method_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	cmd ping IP nul del

Rule name:	win_vidar_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

exe ecac41ea859c9ba34b3f6bfbb6e4922aebf761c0655c20e2e9a965df7627410c

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1157104/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/144377/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-26 14:02:24 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0003.002] Communication Micro-objective::Connect Pipe::Interprocess Communication
1) [C0003.001] Communication Micro-objective::Create Pipe::Interprocess Communication
2) [C0003.003] Communication Micro-objective::Read Pipe::Interprocess Communication
3) [C0003.004] Communication Micro-objective::Write Pipe::Interprocess Communication
4) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
5) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
6) [C0047] File System Micro-objective::Delete File
7) [C0049] File System Micro-objective::Get File Attributes
8) [C0052] File System Micro-objective::Writes File
9) [C0007] Memory Micro-objective::Allocate Memory
10) [C0033] Operating System Micro-objective::Console
11) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
12) [C0040] Process Micro-objective::Allocate Thread Local Storage
13) [C0043] Process Micro-objective::Check Mutex
14) [C0042] Process Micro-objective::Create Mutex
15) [C0041] Process Micro-objective::Set Thread Local Storage Value
16) [C0018] Process Micro-objective::Terminate Process
17) [C0039] Process Micro-objective::Terminate Thread