General
-
Target
e81120aba59575d9b542a38e59f2cdaf7391d2e8769f9bb179c3bb0459697f23
-
Size
302KB
-
Sample
220118-yrrsnadabq
-
MD5
73a10bd3483912f9a16eb073f1ac6f22
-
SHA1
14a800c428dbb276e587502db41ac6912e276437
-
SHA256
e81120aba59575d9b542a38e59f2cdaf7391d2e8769f9bb179c3bb0459697f23
-
SHA512
10c63c46dfe59b128e6f1cedc47b77c0a818cbcb32b9bace858e5e759c602601e6827b5a005657d1b084edca8b1167fbbe850314b8b8f9f8b78ea7f371996782
Static task
static1
Behavioral task
behavioral1
Sample
e81120aba59575d9b542a38e59f2cdaf7391d2e8769f9bb179c3bb0459697f23.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
arkei
homesteadr
http://homesteadr.link/ggate.php
Targets
-
-
Target
e81120aba59575d9b542a38e59f2cdaf7391d2e8769f9bb179c3bb0459697f23
-
Size
302KB
-
MD5
73a10bd3483912f9a16eb073f1ac6f22
-
SHA1
14a800c428dbb276e587502db41ac6912e276437
-
SHA256
e81120aba59575d9b542a38e59f2cdaf7391d2e8769f9bb179c3bb0459697f23
-
SHA512
10c63c46dfe59b128e6f1cedc47b77c0a818cbcb32b9bace858e5e759c602601e6827b5a005657d1b084edca8b1167fbbe850314b8b8f9f8b78ea7f371996782
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-