General
-
Target
ce9ef8a9a01ff0a74f445c661ea6081b1082af46ff8f355f8b487642848bd420
-
Size
289KB
-
Sample
220119-16n2esdfh2
-
MD5
63d70f5773a79ee77f3b416fdebd0bf1
-
SHA1
836d7d293724ee0d6c1c822993dd0da7945d5a52
-
SHA256
ce9ef8a9a01ff0a74f445c661ea6081b1082af46ff8f355f8b487642848bd420
-
SHA512
1e5eedfdd0a991843199639385ad32198dbf950b1858135583904780fbb7b362b1c812bd9cd115a4e663e4b005329183d8c14e906de69ff25a4f27afbff659f7
Static task
static1
Malware Config
Extracted
arkei
Default
http://file-file-host4.com/tratata.php
Targets
-
-
Target
ce9ef8a9a01ff0a74f445c661ea6081b1082af46ff8f355f8b487642848bd420
-
Size
289KB
-
MD5
63d70f5773a79ee77f3b416fdebd0bf1
-
SHA1
836d7d293724ee0d6c1c822993dd0da7945d5a52
-
SHA256
ce9ef8a9a01ff0a74f445c661ea6081b1082af46ff8f355f8b487642848bd420
-
SHA512
1e5eedfdd0a991843199639385ad32198dbf950b1858135583904780fbb7b362b1c812bd9cd115a4e663e4b005329183d8c14e906de69ff25a4f27afbff659f7
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-