General
-
Target
0e6636134ba2befca9d66aee547fbf9423a080c16096328fc22a13b95dab138d
-
Size
302KB
-
Sample
220119-mjhdgahafp
-
MD5
88147d7d8bdb7f04d1ab1d9c99ca3821
-
SHA1
2e7fd4ebab84c475c2fca11ed6010d08b6803718
-
SHA256
0e6636134ba2befca9d66aee547fbf9423a080c16096328fc22a13b95dab138d
-
SHA512
e1ceb4106b6d955962a0e3e2a693d0cb9a77b09d79af8ada05db502d04e79334135433f4017209e422d6e7b78e41984db2e5c5bd59bdd6f8e2fa9765eebd5916
Static task
static1
Malware Config
Extracted
arkei
Default
http://file-file-host4.com/tratata.php
Targets
-
-
Target
0e6636134ba2befca9d66aee547fbf9423a080c16096328fc22a13b95dab138d
-
Size
302KB
-
MD5
88147d7d8bdb7f04d1ab1d9c99ca3821
-
SHA1
2e7fd4ebab84c475c2fca11ed6010d08b6803718
-
SHA256
0e6636134ba2befca9d66aee547fbf9423a080c16096328fc22a13b95dab138d
-
SHA512
e1ceb4106b6d955962a0e3e2a693d0cb9a77b09d79af8ada05db502d04e79334135433f4017209e422d6e7b78e41984db2e5c5bd59bdd6f8e2fa9765eebd5916
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-