General

  • Target

    4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb

  • Size

    321KB

  • Sample

    220115-a13phsbfb4

  • MD5

    e914291a04849d5beb4a43969155c486

  • SHA1

    85ff3f7115cda99e31a21fddfed36197b4b673d5

  • SHA256

    4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb

  • SHA512

    2450f07c8daeb908b36470ddec9b2b9025b6fd486da622ebfde621d43cecec874c8e88e8cfc5224fb0b0268e7aeec49f9011b63fdd51ece7fc17ecd5210175cd

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Targets

    • Target

      4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb

    • Size

      321KB

    • MD5

      e914291a04849d5beb4a43969155c486

    • SHA1

      85ff3f7115cda99e31a21fddfed36197b4b673d5

    • SHA256

      4017f2124bbff8830e52c96a36f07498e3ad0d8c46096279117c799bf72af9eb

    • SHA512

      2450f07c8daeb908b36470ddec9b2b9025b6fd486da622ebfde621d43cecec874c8e88e8cfc5224fb0b0268e7aeec49f9011b63fdd51ece7fc17ecd5210175cd

    • Arkei

      Arkei is an infostealer written in C++.

    • Arkei Stealer Payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks