General
-
Target
mixsix_20211019-165848
-
Size
284KB
-
Sample
211020-kke9dshgbk
-
MD5
43d1162f6247a5d3ebf354b713ff33c5
-
SHA1
55d2f68ee15c17111ed8f9307991c496f512c1fb
-
SHA256
da07eafad62111cfb7276c0c606bf7b4704bb122a19b80b769654c3459e664d6
-
SHA512
479288bc1d8187f8be3f0e2acffaea303ffb7fbffff8300c8dd571e162ef253fa8ab89ca7dcbe129781f64b269994fb343d1ce65bbf1eb693d74b8c69b060e23
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20211019-165848.exe
Resource
win7-en-20210920
Malware Config
Extracted
arkei
Default
http://truzen.info/ggate.php
Targets
-
-
Target
mixsix_20211019-165848
-
Size
284KB
-
MD5
43d1162f6247a5d3ebf354b713ff33c5
-
SHA1
55d2f68ee15c17111ed8f9307991c496f512c1fb
-
SHA256
da07eafad62111cfb7276c0c606bf7b4704bb122a19b80b769654c3459e664d6
-
SHA512
479288bc1d8187f8be3f0e2acffaea303ffb7fbffff8300c8dd571e162ef253fa8ab89ca7dcbe129781f64b269994fb343d1ce65bbf1eb693d74b8c69b060e23
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-