General

  • Target

    9171366cb90531614080d0d492d05c1d6e0b4c57ef03fda77175ccc1db3de812

  • Size

    326KB

  • Sample

    220118-ma22hsaff9

  • MD5

    21b6667069e0fdaeadc6c361fe70afe4

  • SHA1

    d48b535f2220e4e89db00ca529e9740cf6b27890

  • SHA256

    9171366cb90531614080d0d492d05c1d6e0b4c57ef03fda77175ccc1db3de812

  • SHA512

    defbdcd8d341c148460129fe2311adcb33a0a52c7840266517aafe766767521645b419a50b22aa37de77a899cd27b30b0fbd618918eecf71cbe3121695f695e3

Malware Config

Extracted

Family

arkei

Botnet

homesteadr

C2

http://homesteadr.link/ggate.php

Targets

    • Target

      9171366cb90531614080d0d492d05c1d6e0b4c57ef03fda77175ccc1db3de812

    • Size

      326KB

    • MD5

      21b6667069e0fdaeadc6c361fe70afe4

    • SHA1

      d48b535f2220e4e89db00ca529e9740cf6b27890

    • SHA256

      9171366cb90531614080d0d492d05c1d6e0b4c57ef03fda77175ccc1db3de812

    • SHA512

      defbdcd8d341c148460129fe2311adcb33a0a52c7840266517aafe766767521645b419a50b22aa37de77a899cd27b30b0fbd618918eecf71cbe3121695f695e3

    • Arkei

      Arkei is an infostealer written in C++.

    • Arkei Stealer Payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks