General
- Target 1d7812eadec5114e75f6c1f2caf2d166.exe
- Size 306KB
- Sample220118-w4cs6acdf4
- SHA256 6b82ba055be7f91eeaa1fb633fffdb3f124f941857d31258a8561365481568c9
- MD5 1d7812eadec5114e75f6c1f2caf2d166
- SHA1 2918b5750985daa824c5deee6d49bad130a04de8
- SHA512 c69ed9bcb1ce7da41e2579620f2417cd9fb15afd93b1d2b43aedd5aaadf59bf71fcd649afbe6af95f80d5e4da9973b00ecc629f0d8ba10c2db8dd35ca68eaf5b
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
1d7812eadec5114e75f6c1f2caf2d166.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1d7812eadec5114e75f6c1f2caf2d166.exe
Resource
win10v2004-en-20220113
0 signatures
0 seconds
Malware Config
Extracted
Family
-
arkei
Botnet
-
homesteadr
C2
-
http://homesteadr.link/ggate.php
Targets
-
- Target 1d7812eadec5114e75f6c1f2caf2d166.exe
- Size 306KB
- SHA256 6b82ba055be7f91eeaa1fb633fffdb3f124f941857d31258a8561365481568c9
- MD5 1d7812eadec5114e75f6c1f2caf2d166
- SHA1 2918b5750985daa824c5deee6d49bad130a04de8
- SHA512 c69ed9bcb1ce7da41e2579620f2417cd9fb15afd93b1d2b43aedd5aaadf59bf71fcd649afbe6af95f80d5e4da9973b00ecc629f0d8ba10c2db8dd35ca68eaf5b
- MD5 SHA1 SHA512
Score10/10-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.