Description
Arkei is an infostealer written in C++.
b56e025d3efa3a65a6d31daff33d11f8.exe
General
Target
Size
Sample
b56e025d3efa3a65a6d31daff33d11f8.exe
310KB
211125-vajh6sbbe7
Score
10 /10
MD5
SHA1
SHA256
SHA512
b56e025d3efa3a65a6d31daff33d11f8
6bf85a2da13381521053967cf6de35249eae84b8
61743625175cf4def0b55b55f8b5f7193e10de0b2de17236a59e4f5e9b081cf4
2539f3b7d773f5826ac8afa430739b89df2f8d7f6263d85d5385d20c67db67b9f63d58cf0a28ee71e45a74ee268fce414ed39d1be946ce9cb57f691b1b84ecf9
Malware Config
Extracted
| Family | arkei |
| Botnet | Default |
| C2 |
http://file-file-host4.com/tratata.php |
Targets
Target
MD5
Filesize
b56e025d3efa3a65a6d31daff33d11f8.exe
b56e025d3efa3a65a6d31daff33d11f8
310KB
Score
10 /10
SHA1
SHA256
SHA512
6bf85a2da13381521053967cf6de35249eae84b8
61743625175cf4def0b55b55f8b5f7193e10de0b2de17236a59e4f5e9b081cf4
2539f3b7d773f5826ac8afa430739b89df2f8d7f6263d85d5385d20c67db67b9f63d58cf0a28ee71e45a74ee268fce414ed39d1be946ce9cb57f691b1b84ecf9
Tags
Signatures
-
Arkei
-
Arkei Stealer Payload
Tags
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks