General
-
Target
4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb
-
Size
321KB
-
Sample
220115-a13phsbfb4
-
MD5
e914291a04849d5beb4a43969155c486
-
SHA1
85ff3f7115cda99e31a21fddfed36197b4b673d5
-
SHA256
4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb
-
SHA512
2450f07c8daeb908b36470ddec9b2b9025b6fd486da622ebfde621d43cecec874c8e88e8cfc5224fb0b0268e7aeec49f9011b63fdd51ece7fc17ecd5210175cd
Static task
static1
Malware Config
Extracted
arkei
Default
http://file-file-host4.com/tratata.php
Targets
-
-
Target
4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb
-
Size
321KB
-
MD5
e914291a04849d5beb4a43969155c486
-
SHA1
85ff3f7115cda99e31a21fddfed36197b4b673d5
-
SHA256
4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb
-
SHA512
2450f07c8daeb908b36470ddec9b2b9025b6fd486da622ebfde621d43cecec874c8e88e8cfc5224fb0b0268e7aeec49f9011b63fdd51ece7fc17ecd5210175cd
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-