MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f72c375f5e423f5213174a9e4a7676e34d2cab593802c75d6dc27719d8e7eb00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	f72c375f5e423f5213174a9e4a7676e34d2cab593802c75d6dc27719d8e7eb00
SHA3-384 hash:	b1c19e44de3cc451b64661ea284571e771128466aeb66ea2d065d14d6d23727f9acc331fe4203fdcf6903123fb2e7f22
SHA1 hash:	47bf81ee2e9afe8290006502c1744b8cae7439e4
MD5 hash:	b0f851f45811cdd64d8dc692d97903da
humanhash:	seven-lima-diet-beryllium
File name:	b0f851f45811cdd64d8dc692d97903da.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	1'519'896 bytes
First seen:	2021-06-30 17:54:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	96778352d99ca84b52328b0725ee1935 (6 x ArkeiStealer)
ssdeep	24576:s2ANDTYcEbLkP+8UF7syGP/sU8XHThFhSpTXK2Gatg1quyy:MxTSLkPa7syGHslXHdFwuatg1qu
Threatray	3'243 similar samples on MalwareBazaar
TLSH	A765E13151FD683AE431F37E9ADF453BCBA29FD6B11200AD676139598EB2300DE63162
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

setup_x86_x64_install.exe

Verdict:

Malicious activity

Analysis date:

2021-06-30 12:46:00 UTC

Tags:

evasion trojan stealer vidar loader rat redline opendir phishing

Link:

https://app.any.run/tasks/abba0451-5633-448e-8851-eb9d6b80cc5c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/168954/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader40.19474.19928.24213.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/61ac18e2-d551-40c4-aafc-fd78ac5bdee5

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/810138

Signature

Detected unpacking (changes PE section rights)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f72c375f5e423f5213174a9e4a7676e34d2cab593802c75d6dc27719d8e7eb00/

Threat name:

Win32.Trojan.GenCBL

Status:

Malicious

First seen:

2021-06-30 07:28:28 UTC

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Verdict:

unknown

ArkeiStealer

3ec3b418b0e06128ef80ff02866d30c8071ba54066411760b6f71cab0f4c24f9

ArkeiStealer

5a4f75c16948eb90210b50a2af901dad431a231d5a4406ce55dad0cd943d5cd0

ArkeiStealer

69e75e57bc4a09c9a3d7726b28423d10df5b0224177ebfa43930668efd0af5da

ArkeiStealer

8b1c960881fc789460b5b274abd43baddb1c92e1a942d3a1080a4adb1f545e50

ArkeiStealer

a8fb61732f9696d24e02dda47d2f12abe0d8968e130f05d2381bb7b5a93f3ec0

ArkeiStealer

d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb

ArkeiStealer

d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

ArkeiStealer

d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57

ArkeiStealer

f82ef04e370d0a646120bb980da33aa6d6d688300a7c6ea727da9ed6f702462c

ArkeiStealer

+ 3'233 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar discovery evasion spyware stealer trojan

Link:

https://tria.ge/reports/210630-hgrdbqdbds/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar

Unpacked files

SH256 hash:

280a8b393c32267314449d09a2c3d899b1ee0fb14862775238ba0097a98d9a82

MD5 hash:

13534c3ec64601a98022b549caf71241

SHA1 hash:

c89836512496935f0f6ac9d2e37c6caa14f7e8cd

Link:

https://www.unpac.me/results/aea66550-412c-45fb-964a-9dc7333c86ef/

SH256 hash:

f72c375f5e423f5213174a9e4a7676e34d2cab593802c75d6dc27719d8e7eb00

MD5 hash:

b0f851f45811cdd64d8dc692d97903da

SHA1 hash:

47bf81ee2e9afe8290006502c1744b8cae7439e4

Link:

https://www.unpac.me/results/aea66550-412c-45fb-964a-9dc7333c86ef/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f72c375f5e423f5213174a9e4a7676e34d2cab593802c75d6dc27719d8e7eb00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICOIUS_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	Vidar Create hunting rule
Author:	kevoreilly
Description:	Vidar Payload

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com