MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd8657ba8b70c80c8aa31de95f01be7fe06e3eb301bcccb2a213b54ba7883b36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	fd8657ba8b70c80c8aa31de95f01be7fe06e3eb301bcccb2a213b54ba7883b36
SHA3-384 hash:	aafe1290946a7723574607243b2f49c38b02008b03ec29beeedd037a87c84cc2253a2821d52778d101c1732f03449bb6
SHA1 hash:	d29a7968c98cc2d21359d5eb8fb3b60a31e84ec1
MD5 hash:	3b7ad7287ce56957ba33e7e61ed7eb29
humanhash:	oven-fanta-saturn-july
File name:	3b7ad7287ce56957ba33e7e61ed7eb29.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	434'176 bytes
First seen:	2022-07-15 07:51:47 UTC
Last seen:	2024-07-24 23:27:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7364064dd132b4d512c254b1e8fe9ea2 (5 x RedLineStealer, 1 x Amadey, 1 x ArkeiStealer)
ssdeep	6144:9WuJ0qGRrkMM5p0EfN6wYElP1Z0ONmHl/Llyyqe1lFSdn0qIso3uQS:JJWRre5uON6glP1ANLUyr17Sd0qIsoe
Threatray	5'382 similar samples on MalwareBazaar
TLSH	T15C94CF10BA50D435F8B712F446B69368B92D7EE1972854CF62D53AEE2B385D0EC3231B
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	2dac1378319b9b91 (29 x Smoke Loader, 23 x RedLineStealer, 22 x Amadey)
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

socelars

ID:

File name:

https://we.tl/t-LRczCHGqJB

Verdict:

Malicious activity

Analysis date:

2022-07-13 02:15:41 UTC

Tags:

evasion trojan socelars stealer loader rat redline opendir ransomware stop

Link:

https://app.any.run/tasks/15cc33fc-aaf4-4e80-b541-0d39c0cfd700

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/289438/

Detection(s):

Win.Packed.Crypterx-9954995-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/25285/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed vidar virut

Link:

https://www.filescan.io/uploads/62d11cec3ec0b068997b1075/reports/dabe9051-e4e7-4254-ae37-818b542907e5/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c45bd869-a6b6-477e-99fe-733c29a03b2a

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1032297

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Detected unpacking (creates a PE file in dynamic memory)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd8657ba8b70c80c8aa31de95f01be7fe06e3eb301bcccb2a213b54ba7883b36/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2022-07-12 09:15:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

34 of 41 (82.93%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7wdfpoulodeazcvddxuv6an6p7qg4pvtag6mzmvcco2uxj4ihm3a._file

Verdict:

malicious

ArkeiStealer

829fa71dbd6820fc92a1d20fd3adc4ce96e7d4c99ca503f26d706e7594e0578e

ArkeiStealer

a20723e685893bb03cdfc734c172e792a4d863381613b9d9d5719a9c00dc6fa3

ArkeiStealer

c1bb0bfef2557c7c68967699964152c1b4898bbeefb1175ee9a8989d49ec367c

ArkeiStealer

d9ac9870270224d8c179a560d2a4ebb27190f6757df63a9d035260cb5d64cf9e

ArkeiStealer

e88c91cc3efaea2a70a4c776c22f6ba462044007b6e6bf4c294ef9a7df850b26

ArkeiStealer

f08411f389d5065c97508c3b99422301877c3c56877fc6f2913939c24ae48706

ArkeiStealer

+ 5'372 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar botnet:517 discovery spyware stealer suricata

Link:

https://tria.ge/reports/220715-jqd3vaegdj/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Vidar Stealer

Vidar

suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

Malware Config

C2 Extraction:

https://t.me/tgch_hijuly
https://c.im/@olegf9844h

Unpacked files

SH256 hash:

d7399394ab328ed894d9a02ecd65d58b9b2856ecd84a4e88a7d03bf8b2d9fab2

MD5 hash:

622e12f3fea16f2c2de073d2fe509de6

SHA1 hash:

dcb16ddbbceedbb97481656425f6fecea2ca2d0b

Link:

https://www.unpac.me/results/a002a2a8-73b8-4b94-92e5-7c950966adb2/

SH256 hash:

fd8657ba8b70c80c8aa31de95f01be7fe06e3eb301bcccb2a213b54ba7883b36

MD5 hash:

3b7ad7287ce56957ba33e7e61ed7eb29

SHA1 hash:

d29a7968c98cc2d21359d5eb8fb3b60a31e84ec1

Link:

https://www.unpac.me/results/a002a2a8-73b8-4b94-92e5-7c950966adb2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd8657ba8b70c80c8aa31de95f01be7fe06e3eb301bcccb2a213b54ba7883b36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers