arkei

Sharing

Copy URL

Twitter E-mail

General

Target

883233a1ae141a887d763b4cee1fed3a.exe
Size

135KB
Sample

210927-ld4tvagce9
MD5

883233a1ae141a887d763b4cee1fed3a
SHA1

265cbafce6bd225dff0f3dd4e2792cd5e55ae677
SHA256

948efd6ebccc98309252dee5d98879890e691fc416e6c3e969190f1273f4d61e
SHA512

ac35bec37f6d011d4fff0cc32a4fbb7d4a6400f2323dbea0f49eefa099b056db9f16e376c8725d0e6edf7beb512edf111970fa993ca611200c6067651de5e546

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

raccoon

Botnet

c524886d28411e80660e573d1de51f17556d70f6

Attributes

url4cnc
https://t.me/hobabastrepsils

rc4.plain

Extracted

Family

redline

92.246.89.6:38437

Extracted

Family

redline

Botnet

Bliss

185.237.98.178:62607

Extracted

Family

redline

Botnet

karma

94.103.9.133:39323

Extracted

Family

raccoon

Botnet

a72c96f6762e4258a13dee8bc0dd14557df18467

Attributes

url4cnc
https://t.me/h_wacel1new_1

rc4.plain

Extracted

Family

raccoon

Botnet

b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7

Attributes

url4cnc
https://t.me/hcdrom1

rc4.plain

Targets

- Target
  
  883233a1ae141a887d763b4cee1fed3a.exe
- Size
  
  135KB
- MD5
  
  883233a1ae141a887d763b4cee1fed3a
- SHA1
  
  265cbafce6bd225dff0f3dd4e2792cd5e55ae677
- SHA256
  
  948efd6ebccc98309252dee5d98879890e691fc416e6c3e969190f1273f4d61e
- SHA512
  
  ac35bec37f6d011d4fff0cc32a4fbb7d4a6400f2323dbea0f49eefa099b056db9f16e376c8725d0e6edf7beb512edf111970fa993ca611200c6067651de5e546
Score

10^/10

arkei chinese_generic_botnet raccoon redline smokeloader tofsee xmrig bliss c524886d28411e80660e573d1de51f17556d70f6 karma backdoor botnet discovery evasion infostealer miner persistence spyware stealer themida trojan a72c96f6762e4258a13dee8bc0dd14557df18467 b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7
- Arkei
  Arkei is an infostealer written in C++.
  stealer arkei
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Arkei Stealer Payload
  stealer
- Chinese Botnet Payload
  botnet
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner Payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Generic Chinese Botnet

Raccoon

RedLine

RedLine Payload

SmokeLoader

Tofsee

Windows security bypass

xmrig

Arkei Stealer Payload

Chinese Botnet Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner Payload

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Enumerates connected drives

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2