MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcfe4c075c3b67f661de261a2f05ce34d1b9b150c286c67a3da085b006ae7b3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ArkeiStealer


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcfe4c075c3b67f661de261a2f05ce34d1b9b150c286c67a3da085b006ae7b3c
SHA3-384 hash: 52099ebc2c4ce3800ea4fbc2ccf2dfa585e4cb3852586ac50f8c51b496c23e129b469ca71a271bf3e83e4a7a4fc8c251
SHA1 hash: 081f4e64d257a91802141c855255a27fb7e58595
MD5 hash: a2d6dee0c5e30e702a68ec36788f5504
humanhash: salami-georgia-kilo-five
File name:file
Download: download sample
Signature ArkeiStealer
Create hunting rule
File size:1'894'048 bytes
First seen:2023-01-04 20:41:19 UTC
Last seen:2023-01-05 11:47:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:NrG7BVkWe95VQlgrb9V7Me4j98gXZ0jJBL/:NrG6Ke4VXoB
Threatray 887 similar samples on MalwareBazaar
TLSH T1189529243EFB9029F273EEB55ED8B9A6EE5FF763370A245A105003464723A41DD8253E
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon cccc9e9e8ecce071 (1 x ArkeiStealer)
Reporter andretavare5
Tags:ArkeiStealer exe signed

Code Signing Certificate

Organisation:Samsung C32R509FHI LC36R502FHIXCI
Issuer:Samsung C32R509FHI LC36R502FHIXCI
Algorithm:sha1WithRSAEncryption
Valid from:2023-01-03T13:40:23Z
Valid to:2033-01-04T13:40:23Z
Serial number: 658433b9ed326ab34c5f67146bed061d
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: f7ce879b2c2d3634244a0c86f4fca756ae6658c74622e1c72d10e4587a0a42a8
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://vk.com/doc685868676_647892776?hash=LfkEZDebG8EWSFpQE7hBLGZP5WzNQDC4Xfz4yMyvswc&dl=GY4DKOBWHA3DONQ:1672860569:XC8Y4aeRV4Jo7BtOo131SKzlUsRylulz25yZnlB5mXT&api=1&no_preview=1#kis_crypto

Intelligence

File Origin
# of uploads :
345
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
vidar
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-04 20:42:18 UTC
Tags:
trojan stealer vidar
Link:
https://app.any.run/tasks/245e56a3-a6ef-4f9a-be2f-88f2d295f098

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/349483/
Detection(s):
SecuriteInfo.com.Variant.Tedy.270238.21865.28052.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Reading critical registry keys
Using the Windows Management Instrumentation requests
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint overlay packed stealer
Link:
https://www.filescan.io/uploads/63b5e49bb9b1c1737520667c/reports/a9fb7afc-b55b-4cea-899a-65633879d1d4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/348b80a6-993e-47cf-84e4-acefa24e1ebb
Result
Threat name:
Laplas Clipper, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1145323
Signature
.NET source code contains very large strings
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected VMProtect packer
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Laplas Clipper
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 778055 Sample: file.exe Startdate: 04/01/2023 Architecture: WINDOWS Score: 100 59 Snort IDS alert for network traffic 2->59 61 Multi AV Scanner detection for domain / URL 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 12 other signatures 2->65 9 file.exe 4 2->9         started        13 udakqMngIV.exe 1 2->13         started        process3 dnsIp4 49 C:\Users\user\AppData\Local\...\file.exe.log, CSV 9->49 dropped 83 Writes to foreign memory regions 9->83 85 Allocates memory in foreign processes 9->85 87 Injects a PE file into a foreign processes 9->87 16 InstallUtil.exe 20 9->16         started        21 conhost.exe 9->21         started        57 clipper.guru 45.159.189.79, 49700, 80 HOSTING-SOLUTIONSUS Netherlands 13->57 89 Tries to detect virtualization through RDTSC time measurements 13->89 file5 signatures6 process7 dnsIp8 51 t.me 149.154.167.99, 443, 49697 TELEGRAMRU United Kingdom 16->51 53 94.130.190.48, 49698, 80 HETZNER-ASDE Germany 16->53 55 cdn.discordapp.com 162.159.135.233, 443, 49699 CLOUDFLARENETUS United States 16->55 41 C:\Users\user\AppData\...\autorun[1].exe, PE32 16->41 dropped 43 C:\ProgramData\89351175625800908874.exe, PE32 16->43 dropped 45 C:\ProgramData\88462817919395714309.exe, PE32 16->45 dropped 67 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->67 69 Tries to harvest and steal browser information (history, passwords, etc) 16->69 71 Tries to steal Crypto Currency Wallets 16->71 23 88462817919395714309.exe 2 16->23         started        27 89351175625800908874.exe 16->27         started        29 cmd.exe 1 16->29         started        file9 signatures10 process11 file12 47 C:\Users\user\AppData\...\udakqMngIV.exe, PE32 23->47 dropped 73 Antivirus detection for dropped file 23->73 75 Multi AV Scanner detection for dropped file 23->75 77 Machine Learning detection for dropped file 23->77 31 cmd.exe 1 23->31         started        79 Tries to detect virtualization through RDTSC time measurements 27->79 81 Uses schtasks.exe or at.exe to add and modify task schedules 29->81 33 conhost.exe 29->33         started        35 timeout.exe 1 29->35         started        signatures13 process14 process15 37 conhost.exe 31->37         started        39 schtasks.exe 1 31->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcfe4c075c3b67f661de261a2f05ce34d1b9b150c286c67a3da085b006ae7b3c/
Threat name:
Win64.Malware.Tedy
Create hunting rule
Status:
Malicious
First seen:
2023-01-04 20:42:13 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
6
AV detection:
4 of 39 (10.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7t7eyb24hnt7myo6eync6boogti3tmkqykdmm6r5ucc3abvopm6a._file
Verdict:
malicious
Similar samples:
2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168
ArkeiStealer
3a26dd85c2956529f42c1622a093f7b817cbd4af7a474d75198df9e455ac753f
ArkeiStealer
6f05a91cd30498cf1bc9b2e0058f1e3caa18b401b77d0a83b71a6df845430716
ArkeiStealer
901112dd590ebf7bb0314c090a66522540e27d7ae769f2030ac47e3046f5d313
ArkeiStealer
9d9849b524012665ec0676be4eb85efcd6d51bf1dd4a68c13f364f6e74c4bc60
ArkeiStealer
a4a93882eebffcb57433742517438c5d56a6d67470a674558f4db52ff4306c9a
ArkeiStealer
a99c69752668a94268cdb482df74649d755fcf56ecd9f431b1cb03b816a593cc
ArkeiStealer
c7943ee404bd5a75c74a3570ed1c118fc190b0c03bd66f37c6495ef84b47ee27
ArkeiStealer
d5f4b34691f83d4e43fca884fd61b14af4893be3843ec3d41ed1c38539b28f6d
ArkeiStealer
e82920cb9b7cf1077cdddabb9b56e84c70653f836ef85ea4d4a700501ccd12a3
ArkeiStealer
+ 877 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:588 spyware stealer
Link:
https://tria.ge/reports/230104-zgzwyshf64/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Vidar
Malware Config
C2 Extraction:
https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a53d8828-078e-47a4-82e2-c2c22f86bc93
Unpacked files
SH256 hash:
fcfe4c075c3b67f661de261a2f05ce34d1b9b150c286c67a3da085b006ae7b3c
MD5 hash:
a2d6dee0c5e30e702a68ec36788f5504
SHA1 hash:
081f4e64d257a91802141c855255a27fb7e58595
Link:
https://www.unpac.me/results/b93e14d4-bcf4-47de-a13b-3ceeccd2bec3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fcfe4c075c3b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fcfe4c075c3b67f661de261a2f05ce34d1b9b150c286c67a3da085b006ae7b3c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/349483/

Comments