General
-
Target
35d79a7cfec3f7bcbc52a82b4916e809e9d2594806efd5ccf564d8ecb6c05bdc
-
Size
303KB
-
Sample
220119-q783waaddn
-
MD5
4dc909191d8c1243cc61696b89fd1fcc
-
SHA1
ce9b08f9fe646206a58f515db199653a5ec3e159
-
SHA256
35d79a7cfec3f7bcbc52a82b4916e809e9d2594806efd5ccf564d8ecb6c05bdc
-
SHA512
5d1b8b566a350b4dc8680ab7d1bd57410a88cee7f400476122c1bd3b9a9dfdffc14bbea634220ca34461b7944c1ea653dd54cb646ea36f9b5d948bdf8fc5951a
Static task
static1
Malware Config
Extracted
arkei
Default
http://file-file-host4.com/tratata.php
Targets
-
-
Target
35d79a7cfec3f7bcbc52a82b4916e809e9d2594806efd5ccf564d8ecb6c05bdc
-
Size
303KB
-
MD5
4dc909191d8c1243cc61696b89fd1fcc
-
SHA1
ce9b08f9fe646206a58f515db199653a5ec3e159
-
SHA256
35d79a7cfec3f7bcbc52a82b4916e809e9d2594806efd5ccf564d8ecb6c05bdc
-
SHA512
5d1b8b566a350b4dc8680ab7d1bd57410a88cee7f400476122c1bd3b9a9dfdffc14bbea634220ca34461b7944c1ea653dd54cb646ea36f9b5d948bdf8fc5951a
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-