arkei

Sharing

Copy URL

Twitter E-mail

General

Target

b05f49e2020b4e323441976fe58c9096.exe
Size

9.7MB
Sample

211130-g67zraeaan
MD5

b05f49e2020b4e323441976fe58c9096
SHA1

92249ae616ed667b822fcc6aed128c9ee9145150
SHA256

65d0b2e1c67a7fc4ae550caca3559f2ed1931b6c3d3b13c80d13d9b2731c3f4d
SHA512

91996a19eef07f2003c381fffbb9b5f94e4cb4dda0f7a08220fd9bc3c42854ee173e36ff598edf451fd28d0b956c8196d3f3f68e26e574d49c1065991e7ee40c

Malware Config

Extracted

Family

socelars

http://www.gianninidesign.com/

Extracted

Family

smokeloader

Version

2020

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32

Extracted

Family

arkei

Botnet

Default

http://truzen.info/ggate.php

Extracted

Family

cryptbot

tiskjc12.top

morkew01.top

Attributes

payload_url
http://danqyn11.top/download.php?file=xystum.exe

Extracted

Family

redline

Botnet

media18plus

91.121.67.60:51630

Extracted

Family

redline

Botnet

user2121

135.181.129.119:4805

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

48.6

Botnet

933

https://mastodon.online/@valhalla

https://koyu.space/@valhalla

Attributes

profile_id
933

Targets

- Target
  
  b05f49e2020b4e323441976fe58c9096.exe
- Size
  
  9.7MB
- MD5
  
  b05f49e2020b4e323441976fe58c9096
- SHA1
  
  92249ae616ed667b822fcc6aed128c9ee9145150
- SHA256
  
  65d0b2e1c67a7fc4ae550caca3559f2ed1931b6c3d3b13c80d13d9b2731c3f4d
- SHA512
  
  91996a19eef07f2003c381fffbb9b5f94e4cb4dda0f7a08220fd9bc3c42854ee173e36ff598edf451fd28d0b956c8196d3f3f68e26e574d49c1065991e7ee40c
Score

10^/10

arkei cryptbot redline smokeloader socelars default aspackv2 backdoor discovery infostealer persistence spyware stealer suricata trojan metasploit vidar 933 media18plus user2121
- Arkei
  Arkei is an infostealer written in C++.
  stealer arkei
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- suricata: ET MALWARE GCleaner Downloader Activity M3
  suricata: ET MALWARE GCleaner Downloader Activity M3
  suricata
- suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata: ET MALWARE GCleaner Downloader Activity M5
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  suricata
- suricata: ET MALWARE Win32/Kryptik.HMCH Dropper User-Agent M1
  suricata: ET MALWARE Win32/Kryptik.HMCH Dropper User-Agent M1
  suricata
- suricata: ET MALWARE Win32/Kryptik.HMCH Dropper User-Agent M2
  suricata: ET MALWARE Win32/Kryptik.HMCH Dropper User-Agent M2
  suricata
- suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
  suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
  suricata
- suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
  suricata
- Arkei Stealer Payload
  stealer
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

CryptBot

MetaSploit

Process spawned unexpected child process

RedLine

RedLine Payload

SmokeLoader

Socelars

Socelars Payload

Vidar

suricata: ET MALWARE GCleaner Downloader Activity M3

suricata: ET MALWARE GCleaner Downloader Activity M5

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Win32/Kryptik.HMCH Dropper User-Agent M1

suricata: ET MALWARE Win32/Kryptik.HMCH Dropper User-Agent M2

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

Arkei Stealer Payload

Vidar Stealer

ASPack v2.12-2.42

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Looks up geolocation information via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2