Overview

overview

10

Static

static

54118ae981...58.exe

windows7_x64

10

54118ae981...58.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54118ae981704768ef3943c42818b758.exe

  • Size

    337KB

  • Sample

    220126-s1mx6sefaj

  • MD5

    54118ae981704768ef3943c42818b758

  • SHA1

    34268c031520d25d4be5df04b3b56bc5939d3b20

  • SHA256

    e213fa14a7be007721a2d90d1b367827a4570493903b202b858f6fa9c89afede

  • SHA512

    473149791007add30cd8442aafcc99297021782d120c18584dee68280987bde2aeed0d929699094a3b4f9b4faee725c6b13c3b0aada63eef17d1da5d95fedd27

Score
10/10
arkeidefaultdiscoveryspywarestealer

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://coin-file-file-19.com/tratata.php

Targets

    • Target

      54118ae981704768ef3943c42818b758.exe

    • Size

      337KB

    • MD5

      54118ae981704768ef3943c42818b758

    • SHA1

      34268c031520d25d4be5df04b3b56bc5939d3b20

    • SHA256

      e213fa14a7be007721a2d90d1b367827a4570493903b202b858f6fa9c89afede

    • SHA512

      473149791007add30cd8442aafcc99297021782d120c18584dee68280987bde2aeed0d929699094a3b4f9b4faee725c6b13c3b0aada63eef17d1da5d95fedd27

    Score
    10/10
    arkeidefaultdiscoveryspywarestealer

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • Arkei Stealer Payload

      stealer

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks