General
- Target f9c95c502f0975bd48be913f9fabbcff.exe
- Size 191KB
- Sample211126-xx84fsecbk
- SHA256 0c6b62ee546449ef1cb2bb826ecfb03279f27946f7a516dca9fca8926c1105cf
- MD5 f9c95c502f0975bd48be913f9fabbcff
- SHA1 ce464d7af866b05c8f85997e2bb9c60b87f57268
- SHA512 cc7592dc5e984ae0b1721a61da74f70e383eb463d2635c9e6e3a006b061728ff1835a0762807dfb91b18ac49031e05d3de38af30683a5edca053964ee5b69dd4
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
f9c95c502f0975bd48be913f9fabbcff.exe
Resource
win7-en-20211014
0 signatures
0 seconds
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://file-file-host4.com/tratata.php
Targets
-
- Target f9c95c502f0975bd48be913f9fabbcff.exe
- Size 191KB
- SHA256 0c6b62ee546449ef1cb2bb826ecfb03279f27946f7a516dca9fca8926c1105cf
- MD5 f9c95c502f0975bd48be913f9fabbcff
- SHA1 ce464d7af866b05c8f85997e2bb9c60b87f57268
- SHA512 cc7592dc5e984ae0b1721a61da74f70e383eb463d2635c9e6e3a006b061728ff1835a0762807dfb91b18ac49031e05d3de38af30683a5edca053964ee5b69dd4
- MD5 SHA1 SHA512
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.