Extracted

• • Target

    d7c7be1e7a8e8b3e9cff846d8622d5b9f9442c5cbfa4ae503a8300a8f3fa518a

  • Size

    327KB

  • MD5

    dfff8e4133e4a5c3d7b75986c5e77f13

  • SHA1

    009369b437ceedc363677e554a5207060c9a4ac6

  • SHA256

    d7c7be1e7a8e8b3e9cff846d8622d5b9f9442c5cbfa4ae503a8300a8f3fa518a

  • SHA512

    cdb9bcae0d6c78f38cfe495c59bbff3cc183f9245c29b04f03f3f0cb8a428280242c952e3064e0f603b32e146d70866ebd02e9f5793b16ffeaad40cea8ed720a

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1