General
-
Target
5337fb711ec3d85c88ef5be37f5002db5e2c45ed87721bbf4ba5c259bb58d987
-
Size
350KB
-
Sample
220125-gb9vvshfc8
-
MD5
c2b9c9c9d637e9138fc5eb178b80dd17
-
SHA1
84fcc2480384d5512baf3ec2f803a333b14ac74d
-
SHA256
5337fb711ec3d85c88ef5be37f5002db5e2c45ed87721bbf4ba5c259bb58d987
-
SHA512
676e6b7c76f779ef95cf84167d7818d593e69ff8a1df6ca029cfbcf394723794aec34709854d620ee630aacc656260da130db14da8f010a1d997f16df717fc9c
Static task
static1
Malware Config
Extracted
arkei
Default
http://homesteadr.link/ggate.php
Targets
-
-
Target
5337fb711ec3d85c88ef5be37f5002db5e2c45ed87721bbf4ba5c259bb58d987
-
Size
350KB
-
MD5
c2b9c9c9d637e9138fc5eb178b80dd17
-
SHA1
84fcc2480384d5512baf3ec2f803a333b14ac74d
-
SHA256
5337fb711ec3d85c88ef5be37f5002db5e2c45ed87721bbf4ba5c259bb58d987
-
SHA512
676e6b7c76f779ef95cf84167d7818d593e69ff8a1df6ca029cfbcf394723794aec34709854d620ee630aacc656260da130db14da8f010a1d997f16df717fc9c
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-