MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f82ef04e370d0a646120bb980da33aa6d6d688300a7c6ea727da9ed6f702462c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	f82ef04e370d0a646120bb980da33aa6d6d688300a7c6ea727da9ed6f702462c
SHA3-384 hash:	4f88784590ee020bc71702c803eb6bcc0478138ae2660e7ca74a05b78a1694809eb49835ea0bf56c4875d58d9dc939a9
SHA1 hash:	34d32f06f5b82265363088477dfabccb87348800
MD5 hash:	c59367eeb624c383bdb66ab6b5eeb467
humanhash:	eighteen-friend-april-colorado
File name:	c59367eeb624c383bdb66ab6b5eeb467.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	1'534'464 bytes
First seen:	2021-05-30 06:21:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	425f1b6477ecc31f517424188db5c5dc (2 x ArkeiStealer)
ssdeep	24576:/Y3tQvSwdMCV9Cceqw0mZfXkcrhLf1NiUNg94HUU+bS8M4eAgReO/1OwBHzn5Ty/:/Y0dGCvBFwhf0crptNZNgUUS8MBAcA2E
Threatray	2'439 similar samples on MalwareBazaar
TLSH	246523B9BE56D943C8532939592CB72034E12FFC55D8C68BC90E39A2F572F810865BAC
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Loader.exe

Verdict:

Malicious activity

Analysis date:

2021-05-29 16:03:26 UTC

Tags:

evasion opendir loader trojan stealer raccoon rat redline vidar phishing

Link:

https://app.any.run/tasks/18f2e9e9-aeef-4528-8a1c-73c340275eb1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/163238/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.36994168.4654.10497.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Replacing files

Reading critical registry keys

Creating a window

Delayed writing of the file

Sending a UDP request

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Launching a process

Connection attempt to an infection source

Stealing user critical data

Launching a tool to kill processes

Sending an HTTP GET request to an infection source

Forced shutdown of a browser

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Vidar

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/794334

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found Tor onion address

Hides threads from debuggers

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f82ef04e370d0a646120bb980da33aa6d6d688300a7c6ea727da9ed6f702462c/

Threat name:

Win32.Trojan.Chapak

Status:

Malicious

First seen:

2021-05-29 16:53:10 UTC

AV detection:

10 of 47 (21.28%)

Threat level:

5/5

Verdict:

unknown

ArkeiStealer

0c55cd5be063f194a58e7357c5b08f3e3b2700eb5d8e89cf92120dbc120a0064

ArkeiStealer

0f0eb4a8a538f339214f86a8b084d685a4fb51d54f258f5718393003ab1ff35b

ArkeiStealer

6e29b950d675a5cf30bfd81326279d3310b1c26658b9d09091e6d8871354320b

ArkeiStealer

6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787

ArkeiStealer

7f588ecbff9405b87fa5b809b52d0b667f19a09e47bafc2cf1f5f9d5f19f16c1

ArkeiStealer

8b1c960881fc789460b5b274abd43baddb1c92e1a942d3a1080a4adb1f545e50

ArkeiStealer

a8fb61732f9696d24e02dda47d2f12abe0d8968e130f05d2381bb7b5a93f3ec0

ArkeiStealer

a9b0a14beac57ba149a978c8f0996a4f4e70e003b80c67e631947c9dc3590154

ArkeiStealer

d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

ArkeiStealer

+ 2'429 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar discovery evasion spyware stealer trojan

Link:

https://tria.ge/reports/210530-j94lngkshn/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/f82ef04e370d0a646120bb980da33aa6d6d688300a7c6ea727da9ed6f702462c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	INDICATOR_SUSPICOIUS_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	Vidar Create hunting rule
Author:	kevoreilly
Description:	Vidar Payload

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com