Extracted

Extracted

Extracted

Extracted

• • Target

    9b7218c1cda5eb22d875728d20a7608f.exe

  • Size

    293KB

  • MD5

    9b7218c1cda5eb22d875728d20a7608f

  • SHA1

    e825d4399c4ead51c4c1c20c1cff1a6375079c98

  • SHA256

    c9552495438cba0e171303d7145e1de8f9c43b2db335e09a9902453a6690232c

  • SHA512

    01a7fc3f854c6414d37eed78c231ac25422c7846be41855a5e430500fcbcb6b50476a244ed8ec36a1c2192c2d6f18737436cc651cb06ad8976af138f473bf4b8

  Score

  10^/10

  arkeiraccoonsmokeloader470193d69fd872b73819c5e70dc68242c10ccbcedefaultbackdoordiscoveryspywarestealertrojanupx

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2