Extracted

Extracted

Extracted

Extracted

• • Target

    7c0b8ecbbacfce4a4e12f9c8991375e74c7e5f0f3c2630ddf2b2be00800fd6ea

  • Size

    274KB

  • MD5

    06ea164106eb8ff24d61a24c74f3f7d9

  • SHA1

    3d039816c87cb75f5e7c6981ad1da6c36b345dba

  • SHA256

    7c0b8ecbbacfce4a4e12f9c8991375e74c7e5f0f3c2630ddf2b2be00800fd6ea

  • SHA512

    c510fd20d94fb533ec98abe881e59556626dcb9172c3a15944e87c6c8f75116c777c9030478e9ec1f63432f259b27d1a1c82b64e5ee899e3866f6941056ded0f

  Score

  10^/10

  arkeiraccoonsmokeloader470193d69fd872b73819c5e70dc68242c10ccbcedefaultbackdoordiscoveryspywarestealersuricatatrojan

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1