MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac
SHA3-384 hash:	c1a58c059f5598647bda322aa8cf4ff87ee94c570acf80f852046d87737279e9035a79c5d5f9be454220eab878e2c69d
SHA1 hash:	61e7c42a4a20fa8f12f44b7c771ebedc4be5fb17
MD5 hash:	7499c20554084c32e5881c30ac3031d0
humanhash:	alanine-crazy-romeo-gee
File name:	file.exe
Download:	download sample
Signature	ArkeiStealer Alert Create hunting rule
File size:	383'488 bytes
First seen:	2023-06-04 00:31:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	382962f043b5a0413c587a899bceffb1 (5 x Stop, 2 x ArkeiStealer, 1 x RecordBreaker)
ssdeep	6144:NY6Y/7plOmn9yd/s9h01JbPU5Kxx7tVZohR/HBZomU0fJMk:2X7pYHd/s9ujwKbRythZomU
Threatray	17 similar samples on MalwareBazaar
TLSH	T10F849F1362937C60E5165AB28E2EC6E46A1EFF918F573BDF12146E1F08B11B1C273B52
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	140e66020820a400 (1 x ArkeiStealer)
Reporter	Chainskilabs
Tags:	ArkeiStealer exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

265

Origin country :

US

Vendor Threat Intelligence

ANY.RUN arkei

Malware family:

arkei

Alert

Create hunting rule

ID:

1

File name:

file.exe

Verdict:

Malicious activity

Analysis date:

2023-06-04 00:34:27 UTC

Tags:

stealer arkei vidar

Link:

https://app.any.run/tasks/d78c60b1-f288-4950-840a-51f1fc549523

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Vidar

Detection:

Vidar

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/395376/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.5235.28460.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Using the Windows Management Instrumentation requests

Creating a window

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/647bdb83723bea465f4ccec6/reports/d274fccd-e25b-42a4-a479-69632ca2f021/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/761e04ad-1031-40d0-a08a-618d27fc9249

Joe Sandbox Vidar

Result

Threat name:

Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1248295

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac/

ReversingLabs TitaniumCloud Win32.Spyware.Vidar

Threat name:

Win32.Spyware.Vidar

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-06-03 20:41:19 UTC

File Type:

PE (Exe)

Extracted files:

49

AV detection:

19 of 24 (79.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7wj73rp7jk5vvbdzunrrnb253rphp5c6jwdloq3yrdsxic7sm2wa._file

Threatray malicious

Verdict:

malicious

Similar samples:

03931c184546f243b3b931cd794fe8ed6b64635fbb07162508b45f0292407621

ArkeiStealer

2e05e4d2d7b1d6d1b1caa909037f39057c9a929e53849a0ed49e5d001afd7508

ArkeiStealer

533915e4d0ad9a2646008aa0806f1b5036494cace39a5a329af6e37b7bf72c8b

ArkeiStealer

54c3132ced005758148cd36e63a125bfb4deac0378d3ed9b692bb0b61233785d

ArkeiStealer

8532a39ee1ff5934c30e3e1ee2d98ecd7949dec7817c21d17cc25434456c1768

ArkeiStealer

88182016daa697b08bb26ef40195a3c9271f42479cfa4be5e0824386de459e27

ArkeiStealer

a26ca054725b5b6ab140e88300e7294925e5357199ac4feadde0f7eeb2f09fe5

ArkeiStealer

c819bff14d4cff52015cde3b51d09c43515d6cadb4db674ed45cd26d43b1b5b1

ArkeiStealer

e96f81681418f41f6450e7c75cb6f669faa400eea0da19cbf5a77da4cf36332e

ArkeiStealer

f41a52b26618cc929bff3ca1371cca58bfa3ecb782722b2ee7e466758b53a5a4

ArkeiStealer

+ 7 additional samples on MalwareBazaar

Hatching Triage vidar

Result

Malware family:

vidar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vidar botnet:a247b760bbf343752090be1436805458 discovery spyware stealer

Link:

https://tria.ge/reports/230604-avmq4sba5w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Enumerates physical storage devices

Program crash

Accesses 2FA software files, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Vidar

Malware Config

C2 Extraction:

https://t.me/task4manager
http://23.88.46.113:80
https://steamcommunity.com/profiles/76561199510444991

UnpacMe VidarStealer

Unpacked files

SH256 hash:

7bdd65dcc0a46d5200a4a20112f6eb283d9dfcad2e39ea5dbc441f3a59abd075

MD5 hash:

2cc398afd4678620f68ce5883a094d83

SHA1 hash:

0886689ce2b2355fc788b560fc5207ed4a9a106a

Detections:

VidarStealer

Alert

Create hunting rule

Link:

https://www.unpac.me/results/a24dfb49-6449-4ca2-9ffa-af08a71185c6/

Parent samples :

533915e4d0ad9a2646008aa0806f1b5036494cace39a5a329af6e37b7bf72c8b
03931c184546f243b3b931cd794fe8ed6b64635fbb07162508b45f0292407621
88182016daa697b08bb26ef40195a3c9271f42479cfa4be5e0824386de459e27
2e05e4d2d7b1d6d1b1caa909037f39057c9a929e53849a0ed49e5d001afd7508
e96f81681418f41f6450e7c75cb6f669faa400eea0da19cbf5a77da4cf36332e
54c3132ced005758148cd36e63a125bfb4deac0378d3ed9b692bb0b61233785d
dfe39e525e71eefcdc6aefae1ec773cf935ef64b77428f2873f147707037ed1d
5fb53e00848d2471075bb31b47a20eb1d35744c148ba9640f14bfadfabb00148
54f4c5cc097a37ed8aa2da97869bd7251f68020b3c1dd66ea977bacaf717817c
c819bff14d4cff52015cde3b51d09c43515d6cadb4db674ed45cd26d43b1b5b1
8532a39ee1ff5934c30e3e1ee2d98ecd7949dec7817c21d17cc25434456c1768
fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac
f41a52b26618cc929bff3ca1371cca58bfa3ecb782722b2ee7e466758b53a5a4
a26ca054725b5b6ab140e88300e7294925e5357199ac4feadde0f7eeb2f09fe5

SH256 hash:

fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac

MD5 hash:

7499c20554084c32e5881c30ac3031d0

SHA1 hash:

61e7c42a4a20fa8f12f44b7c771ebedc4be5fb17

Link:

https://www.unpac.me/results/a24dfb49-6449-4ca2-9ffa-af08a71185c6/

VMRay Vidar.A

Malware family:

Vidar.A

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd93fdc5ff4a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ArkeiStealer

exe fd93fdc5ff4abb5a8479a36316875ddc5e77f45e4d86b7437888e5740bf266ac

(this sample)

  

Delivery method

Distributed via web download

  

URLhaus

https://urlhaus.abuse.ch/url/2643215/

Cape

https://www.capesandbox.com/analysis/395376/