General
-
Target
f779cd5a9ec279022112e598b779599c0e87fab4407670c8be1ccfc737ba0cae
-
Size
306KB
-
Sample
220118-seflzabgem
-
MD5
d307bd574833ad9d5f54727dcd0f41a0
-
SHA1
3158badb7e41840c5bd650d77ac28d5cb3c3c7da
-
SHA256
f779cd5a9ec279022112e598b779599c0e87fab4407670c8be1ccfc737ba0cae
-
SHA512
19b2aedbab39c9a6956d8934782976b7f7ffa9b8c67d4dbbc81e657a75138a5cf24048f076cc6e5ba7106442c8b8fb5fd234d79e4795160a4e9b96e31c958dab
Static task
static1
Behavioral task
behavioral1
Sample
f779cd5a9ec279022112e598b779599c0e87fab4407670c8be1ccfc737ba0cae.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
arkei
homesteadr
http://homesteadr.link/ggate.php
Targets
-
-
Target
f779cd5a9ec279022112e598b779599c0e87fab4407670c8be1ccfc737ba0cae
-
Size
306KB
-
MD5
d307bd574833ad9d5f54727dcd0f41a0
-
SHA1
3158badb7e41840c5bd650d77ac28d5cb3c3c7da
-
SHA256
f779cd5a9ec279022112e598b779599c0e87fab4407670c8be1ccfc737ba0cae
-
SHA512
19b2aedbab39c9a6956d8934782976b7f7ffa9b8c67d4dbbc81e657a75138a5cf24048f076cc6e5ba7106442c8b8fb5fd234d79e4795160a4e9b96e31c958dab
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-