arkei

General

Target

39d95f281d34ea3306d150f50c741fc7.exe
Size

306KB
Sample

220119-jft2bafhhn
MD5

39d95f281d34ea3306d150f50c741fc7
SHA1

0faae2afaf38a721aeb7f9b366612f8afa179cbc
SHA256

37c0c7a64f42588a62acc3a764e81ca018214f640c5f28d90e96a9940f230380
SHA512

fd40044b39405de00466ba03788f53a320a17863c773bd872e3fd280665fa0e99d58de2230df1f44a0a2bb52644e3580943ce7772817ff2faaeb2a52ae93d823

Score

10^/10

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Targets

- Target
  
  39d95f281d34ea3306d150f50c741fc7.exe
- Size
  
  306KB
- MD5
  
  39d95f281d34ea3306d150f50c741fc7
- SHA1
  
  0faae2afaf38a721aeb7f9b366612f8afa179cbc
- SHA256
  
  37c0c7a64f42588a62acc3a764e81ca018214f640c5f28d90e96a9940f230380
- SHA512
  
  fd40044b39405de00466ba03788f53a320a17863c773bd872e3fd280665fa0e99d58de2230df1f44a0a2bb52644e3580943ce7772817ff2faaeb2a52ae93d823
Score

10^/10

arkei default discovery spyware stealer suricata
- Arkei
  Arkei is an infostealer written in C++.
  stealer arkei
- Suspicious use of NtCreateProcessExOtherParentProcess
- suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
  suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
  suricata
- Arkei Stealer Payload
  stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

Arkei Stealer Payload

Downloads MZ/PE file

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2