Resubmissions

19-01-2022 16:33

220119-t2pc3abecj 10

30-11-2021 19:11

211130-xv663sgbal 8

25-11-2021 12:38

211125-pt3hhaaee8 8

General

  • Target

    e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc

  • Size

    5.0MB

  • Sample

    220119-t2pc3abecj

  • MD5

    360a8874d4d0fe45bf44f54c82ae99d3

  • SHA1

    f145f9c6e1ef7be5e0095d3cd7b6a337e32c25c6

  • SHA256

    e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc

  • SHA512

    7894365f80c2d78d85678eaeb1e2b876749e013b2ac297926ce452a6d304aa5ad408941cbc5b1cf9b31c4242b3eb0ebc39a0f6c94ea81655ac071fc77ad992e2

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://185.215.113.39/7vlcKuayFx.php

Targets

    • Target

      e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc

    • Size

      5.0MB

    • MD5

      360a8874d4d0fe45bf44f54c82ae99d3

    • SHA1

      f145f9c6e1ef7be5e0095d3cd7b6a337e32c25c6

    • SHA256

      e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc

    • SHA512

      7894365f80c2d78d85678eaeb1e2b876749e013b2ac297926ce452a6d304aa5ad408941cbc5b1cf9b31c4242b3eb0ebc39a0f6c94ea81655ac071fc77ad992e2

    • Arkei

      Arkei is an infostealer written in C++.

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    • Babadeda Crypter

    • Arkei Stealer Payload

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks