General
-
Target
759fb269779e5a1470f4da8438533bb3ef0312dad01967f96e65c275da58f7e6
-
Size
281KB
-
Sample
220123-q24afagah3
-
MD5
e98c178a4838d62c080c79443de714f0
-
SHA1
4b80c15e5c87166b16937dc8c96a217fac50e396
-
SHA256
759fb269779e5a1470f4da8438533bb3ef0312dad01967f96e65c275da58f7e6
-
SHA512
17a645de295e22b916efb84bf9739624a40a3925c743b9fe3014addbbe8dfe772de120b6192e9f34395a37f3620579133d7eedfed94877415a323816cb64d160
Static task
static1
Malware Config
Extracted
arkei
Default
http://coin-file-file-19.com/tratata.php
Targets
-
-
Target
759fb269779e5a1470f4da8438533bb3ef0312dad01967f96e65c275da58f7e6
-
Size
281KB
-
MD5
e98c178a4838d62c080c79443de714f0
-
SHA1
4b80c15e5c87166b16937dc8c96a217fac50e396
-
SHA256
759fb269779e5a1470f4da8438533bb3ef0312dad01967f96e65c275da58f7e6
-
SHA512
17a645de295e22b916efb84bf9739624a40a3925c743b9fe3014addbbe8dfe772de120b6192e9f34395a37f3620579133d7eedfed94877415a323816cb64d160
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-