General
-
Target
ee74f1e753c7e461a6c67762afe1cc480d6d719870e7319b6f7050bce8ae0d3f
-
Size
302KB
-
Sample
220119-l1tbmaghcr
-
MD5
895110a06b7a0c8b04fde9ca74563215
-
SHA1
a0b0e6c981985146435d475410fb6417f6d4c981
-
SHA256
ee74f1e753c7e461a6c67762afe1cc480d6d719870e7319b6f7050bce8ae0d3f
-
SHA512
6a3532778beffeecdc8c39017642be673f367cc6f492618af1b0ad6f18bd0bac177f93b023a1f5de34c6d434eaaeb4f5c0b644bdec57fe1778aa81f82aa96e6b
Static task
static1
Behavioral task
behavioral1
Sample
ee74f1e753c7e461a6c67762afe1cc480d6d719870e7319b6f7050bce8ae0d3f.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
arkei
homesteadr
http://homesteadr.link/ggate.php
Targets
-
-
Target
ee74f1e753c7e461a6c67762afe1cc480d6d719870e7319b6f7050bce8ae0d3f
-
Size
302KB
-
MD5
895110a06b7a0c8b04fde9ca74563215
-
SHA1
a0b0e6c981985146435d475410fb6417f6d4c981
-
SHA256
ee74f1e753c7e461a6c67762afe1cc480d6d719870e7319b6f7050bce8ae0d3f
-
SHA512
6a3532778beffeecdc8c39017642be673f367cc6f492618af1b0ad6f18bd0bac177f93b023a1f5de34c6d434eaaeb4f5c0b644bdec57fe1778aa81f82aa96e6b
Score10/10-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-