Extracted

• • Target
    369486f07d32510fc01a063b7fbdd0c8b65f841dec755cfa97b71c6e5827d472
  • Size 263KB
  • SHA256 369486f07d32510fc01a063b7fbdd0c8b65f841dec755cfa97b71c6e5827d472
  • MD5 eae4d5107bc7ebf30f77736af6ade673
  • SHA1 497463b7abd55929a4248e5fbf3ad9ba01ef51ea
  • SHA512 9c693dc1ca6eb62da891abe4162319801d180e08b00bbced6c70d6ee3e5fdb6f243640622f09cfb2836d99c79b85504dae8c1f9e9f7553805428b016d915da21
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoverypersistencespywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1