Overview

overview

10

Static

static

eufive_202...56.exe

windows7_x64

10

eufive_202...56.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eufive_20210830-223756

  • Size

    264KB

  • Sample

    210830-jf66awadzx

  • MD5

    134fac2ca9c3723cd6107a69f7f06c9e

  • SHA1

    dd81965431606b8e940bb4a5f8f83a9b060d7f10

  • SHA256

    111dd17966a5f7058eb1cfc468c1d062602437a69694aa05eff97d121d611408

  • SHA512

    3d170c5cfaae1ad3f0288afae0a45ce43b852196c74b779618ccaa6dd53009ca3342aa867c6e44164c34b295698b9bf096b640cceeb183e82b1e6cb4f379ada3

Score
10/10
arkeidiscoveryspywarestealer

Malware Config

Targets

    • Target

      eufive_20210830-223756

    • Size

      264KB

    • MD5

      134fac2ca9c3723cd6107a69f7f06c9e

    • SHA1

      dd81965431606b8e940bb4a5f8f83a9b060d7f10

    • SHA256

      111dd17966a5f7058eb1cfc468c1d062602437a69694aa05eff97d121d611408

    • SHA512

      3d170c5cfaae1ad3f0288afae0a45ce43b852196c74b779618ccaa6dd53009ca3342aa867c6e44164c34b295698b9bf096b640cceeb183e82b1e6cb4f379ada3

    Score
    10/10
    arkeidiscoveryspywarestealer

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Arkei Stealer Payload

      stealer

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks