8c4f4656118f126865f80f7f510d5b1dc1fa955c03f79b471607ac160cfa9fa9

General
Target

8c4f4656118f126865f80f7f510d5b1dc1fa955c03f79b471607ac160cfa9fa9

Size

282KB

Sample

220123-z7adzsgea3

Score
10 /10
MD5

2d0a5fad8caaa7abea26b3736a0c3bd4

SHA1

813a73e6fc02bcfa5f44324ec4a145f722cc42d6

SHA256

8c4f4656118f126865f80f7f510d5b1dc1fa955c03f79b471607ac160cfa9fa9

SHA512

b37f43616a3b071a707ff740ce4d8200387ff71e34926ddd7b393863c02d9ab3ee5391c9fc49e99deec943e822c980209ba9a0e7091f9d6240c4758b9cd61c03

Malware Config

Extracted

Family arkei
Botnet Default
C2

http://homesteadr.link/ggate.php

Targets
Target

8c4f4656118f126865f80f7f510d5b1dc1fa955c03f79b471607ac160cfa9fa9

MD5

2d0a5fad8caaa7abea26b3736a0c3bd4

Filesize

282KB

Score
10/10
SHA1

813a73e6fc02bcfa5f44324ec4a145f722cc42d6

SHA256

8c4f4656118f126865f80f7f510d5b1dc1fa955c03f79b471607ac160cfa9fa9

SHA512

b37f43616a3b071a707ff740ce4d8200387ff71e34926ddd7b393863c02d9ab3ee5391c9fc49e99deec943e822c980209ba9a0e7091f9d6240c4758b9cd61c03

Tags

Signatures

  • Arkei

    Description

    Arkei is an infostealer written in C++.

    Tags

  • Arkei Stealer Payload

    Tags

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks

                    static1