MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9f072e9e6d366d1ccb933632b54130ab28c38f2004c23cdbc03fcd57f8118c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9f072e9e6d366d1ccb933632b54130ab28c38f2004c23cdbc03fcd57f8118c7
SHA3-384 hash: df91145485fa745f9f2409869a596e1c49d7c24e39d2ee8340b26a7788d093f17727e72c643206aff4ab89c065600436
SHA1 hash: 5185285da23dcdf057cc88de9ceca2c9111f1223
MD5 hash: 88d89420e36809fd2203fd4cea534241
humanhash: bacon-fifteen-green-quiet
File name:88d89420e36809fd2203fd4cea534241.exe
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:606'208 bytes
First seen:2020-12-28 07:31:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (233 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 12288:U0WJ0PHYMYNbMNaE1NQINrJbpfDg93j+WqfL3uL8SX5Ae:pPHqWXTNdlfDg8/jMye
Threatray 628 similar samples on MalwareBazaar
TLSH 10D4239BC48E26A3C1E95D310A3CEDDE9F642492C492BA340FDAC8D53BBD6C1B053756
Reporter abuse_ch
Tags:ArkeiStealer exe


Avatar
abuse_ch
ArkeiStealer C2:
http://okeyshoot.com/

Intelligence

File Origin
# of uploads :
1
# of downloads :
526
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
88d89420e36809fd2203fd4cea534241.exe
Verdict:
Malicious activity
Analysis date:
2020-12-28 07:34:43 UTC
Tags:
trojan stealer vidar loader evasion
Link:
https://app.any.run/tasks/4dced434-c3a0-49d0-bfe9-82da90f11565

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file
Deleting a recently created file
Replacing files
Reading critical registry keys
Sending a UDP request
Delayed writing of the file
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
Stealing user critical data
Launching a tool to kill processes
Forced shutdown of a browser
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Vidar
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/570539
Signature
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9f072e9e6d366d1ccb933632b54130ab28c38f2004c23cdbc03fcd57f8118c7/
Threat name:
Win32.Trojan.Zenpack
Create hunting rule
Status:
Malicious
First seen:
2020-12-24 21:39:43 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7hyhf2pg2ntndtfzgnrswvatbkziyohsabgchtn4ap6nk74bdddq._file
Verdict:
malicious
Similar samples:
0d312b3478e5297f0e968640766a0e7aa9c972c9be08907fb60789f346578f40
ArkeiStealer
12401b4dc0090bd1d61b0253eef90ea395ac98f7d40d458822277c5bf4dc3efe
ArkeiStealer
2b6114a62abacb1a8db1fdb29f9855bca78d8e77dfdb3db07d4a0f59cfb4d9a2
ArkeiStealer
341fecc8089d07c5ddfdfb4925b3243681723294dc9fb211c5d5f14441ccee85
ArkeiStealer
3788e7d35a79cd3fb4b7022ca3e0ba8f7730418a78bc13d6a8311a0ef8b92893
ArkeiStealer
4d2d011803469bd4f6e1714aae78a247008cc9018de1eb27ddea0f21d6bca132
ArkeiStealer
a8ca93adc4384dc66b6c8c6034ae5942d29d0aa5291f35d4b80189413d64f76c
ArkeiStealer
bc1f1478ce900528834df2c37730991b230f4744e0fc45bb7349a6f6a5f4513c
ArkeiStealer
bdf2a1937a05ca661942145ec7317ce25e54cb0469fe4c3ae60a7994bcb6bd3a
ArkeiStealer
f065150b972ebc49773372130ad8c4f6313a34d85da930905baf47b07d66f701
ArkeiStealer
+ 618 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar discovery evasion spyware stealer trojan upx
Link:
https://tria.ge/reports/201228-cq9llp5zps/
Behaviour
Checks processor information in registry
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
NTFS ADS
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
JavaScript code in executable
Looks up external IP address via web service
Checks whether UAC is enabled
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Checks BIOS information in registry
Modifies file permissions
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar
Unpacked files
SH256 hash:
fadc2505e2ab95f18a2ef8e88e837f2c3f1a70f7109b0046c55cf6b69735088b
MD5 hash:
6472ee765e23daecc00ef622d615ed4c
SHA1 hash:
9363d5b9045ea58a2db74b02e041398b4f81a9e4
Link:
https://www.unpac.me/results/98559693-e73f-4c57-8802-157ae4b315f1/
SH256 hash:
bf6ba157ff2ceffe36d296c396bfe77bb645159d8947b1c4740987106112914e
MD5 hash:
045b50a387e48f5bf46c9628c146adb2
SHA1 hash:
12ea2e77fa65ab81eb9f506cbc6083f9cef0f121
Detections:
win_vidar_g0
Create hunting rule
Link:
https://www.unpac.me/results/98559693-e73f-4c57-8802-157ae4b315f1/
SH256 hash:
f9f072e9e6d366d1ccb933632b54130ab28c38f2004c23cdbc03fcd57f8118c7
MD5 hash:
88d89420e36809fd2203fd4cea534241
SHA1 hash:
5185285da23dcdf057cc88de9ceca2c9111f1223
Link:
https://www.unpac.me/results/98559693-e73f-4c57-8802-157ae4b315f1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9f072e9e6d366d1ccb933632b54130ab28c38f2004c23cdbc03fcd57f8118c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_vidar_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments