Description
Arkei is an infostealer written in C++.
79cdd66821ea52bbf0ab5fc40a5f2b28798df4818c908543b2fc599aed0df665
General
Target
Size
Sample
79cdd66821ea52bbf0ab5fc40a5f2b28798df4818c908543b2fc599aed0df665
284KB
220124-gxg2zadcg3
Score
10 /10
MD5
SHA1
SHA256
SHA512
e4d0d081d7ef5eaa42c9823e712f2196
433f522f427df47df4d5868e18bfbf4c37703a50
79cdd66821ea52bbf0ab5fc40a5f2b28798df4818c908543b2fc599aed0df665
32908bdaa5dc3c8ea2b5c581152f9932d584f9ac62674da023ee97e94ad77fa22664eb5893c4289a48189851e15de974d7841184392f3615f98390527d98b081
Malware Config
Extracted
| Family | arkei |
| Botnet | Default |
| C2 |
http://coin-file-file-19.com/tratata.php |
Targets
Target
MD5
Filesize
79cdd66821ea52bbf0ab5fc40a5f2b28798df4818c908543b2fc599aed0df665
e4d0d081d7ef5eaa42c9823e712f2196
284KB
Score
10/10
SHA1
SHA256
SHA512
433f522f427df47df4d5868e18bfbf4c37703a50
79cdd66821ea52bbf0ab5fc40a5f2b28798df4818c908543b2fc599aed0df665
32908bdaa5dc3c8ea2b5c581152f9932d584f9ac62674da023ee97e94ad77fa22664eb5893c4289a48189851e15de974d7841184392f3615f98390527d98b081
Tags
Signatures
-
Arkei
-
Arkei Stealer Payload
Tags
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks