General

  • Target

    88daef270fa90aeb0a1100b41ee68039d7adc05ca4d558439250085febac2a68

  • Size

    296KB

  • Sample

    220124-mcezrsebd7

  • MD5

    052127c4e3d3be8f889864669e2b4714

  • SHA1

    797cda8fd5aa935a97c519b19afe4b19c4b9a508

  • SHA256

    88daef270fa90aeb0a1100b41ee68039d7adc05ca4d558439250085febac2a68

  • SHA512

    8c8e477ddc870d45aca9bffbf6c715fb7d780e5484586ec84e7325171850282068dbb74e3e38c63965b19fce3e0f1e5a06c8b645069af240b6799eae6b73e977

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://coin-file-file-19.com/tratata.php

Targets

    • Target

      88daef270fa90aeb0a1100b41ee68039d7adc05ca4d558439250085febac2a68

    • Size

      296KB

    • MD5

      052127c4e3d3be8f889864669e2b4714

    • SHA1

      797cda8fd5aa935a97c519b19afe4b19c4b9a508

    • SHA256

      88daef270fa90aeb0a1100b41ee68039d7adc05ca4d558439250085febac2a68

    • SHA512

      8c8e477ddc870d45aca9bffbf6c715fb7d780e5484586ec84e7325171850282068dbb74e3e38c63965b19fce3e0f1e5a06c8b645069af240b6799eae6b73e977

    • Arkei

      Arkei is an infostealer written in C++.

    • Arkei Stealer Payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks