Extracted

• • Target
    3b6a1ec69abfabaf3ffad5aa204f00ef14d2fcd579e5e8c2baedcc92c31c2587
  • Size 293KB
  • SHA256 3b6a1ec69abfabaf3ffad5aa204f00ef14d2fcd579e5e8c2baedcc92c31c2587
  • MD5 305f81545867b71b374044841f711ec9
  • SHA1 c7d3c2331136c486dd0fb989b92cd6cdf819d1a5
  • SHA512 d505472c04ede03446e07284180dc821f11b673be7f2401c5bb29f77bcb869f53fd472ee31888b94a423ad99d826f54b9407f6b7a83fc61810120214b58a8d84
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoverypersistencespywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1