General
-
Target
fe93af50c77fa3cd94d409045a394d81
-
Size
1.5MB
-
Sample
220121-sx2xxsaccj
-
MD5
fe93af50c77fa3cd94d409045a394d81
-
SHA1
3516043e14b2da3cf816682b5dad45634325e527
-
SHA256
67bf11a81845fc0304895598855656632fc3b9a06ec0917adbf0daa1973e7a22
-
SHA512
ea25199808393ea5b74bd09e1388baec3fdb4fe05df71c68275bb1eeb58691190c3caf4034484388d1f2c945a3dde89ab427436f5888dbfd1d422d7288d9bd07
Static task
static1
Behavioral task
behavioral1
Sample
fe93af50c77fa3cd94d409045a394d81.exe
Resource
win7-en-20211208
Malware Config
Extracted
arkei
Default
http://85.208.185.13/kYhvOwlJLf.php
Targets
-
-
Target
fe93af50c77fa3cd94d409045a394d81
-
Size
1.5MB
-
MD5
fe93af50c77fa3cd94d409045a394d81
-
SHA1
3516043e14b2da3cf816682b5dad45634325e527
-
SHA256
67bf11a81845fc0304895598855656632fc3b9a06ec0917adbf0daa1973e7a22
-
SHA512
ea25199808393ea5b74bd09e1388baec3fdb4fe05df71c68275bb1eeb58691190c3caf4034484388d1f2c945a3dde89ab427436f5888dbfd1d422d7288d9bd07
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-