General
- Target 1767d67e58b4974f5437129a53d1266aa9a9e08ee500c47e99831240b1a2a2a8
- Size 266KB
- Sample220131-glwe8afgdr
- SHA256 1767d67e58b4974f5437129a53d1266aa9a9e08ee500c47e99831240b1a2a2a8
- MD5 c1c3a7da480ad92da52e65f4d4a46d2d
- SHA1 b54bc2214d37e47c4b221e03db9cef9ede2da05b
- SHA512 2d0aa3771c78b699dc3e5e3c4d3a79c7bdbcdd9b8e3517a15d728bbba9b2ef308adea29f87c5a0b338fe710c295fc0c3cf14cb1dd5788e9de4818e2f16028967
- MD5 SHA1 SHA512
Static task
static1
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://coin-file-file-19.com/tratata.php
Targets
-
- Target 1767d67e58b4974f5437129a53d1266aa9a9e08ee500c47e99831240b1a2a2a8
- Size 266KB
- SHA256 1767d67e58b4974f5437129a53d1266aa9a9e08ee500c47e99831240b1a2a2a8
- MD5 c1c3a7da480ad92da52e65f4d4a46d2d
- SHA1 b54bc2214d37e47c4b221e03db9cef9ede2da05b
- SHA512 2d0aa3771c78b699dc3e5e3c4d3a79c7bdbcdd9b8e3517a15d728bbba9b2ef308adea29f87c5a0b338fe710c295fc0c3cf14cb1dd5788e9de4818e2f16028967
- MD5 SHA1 SHA512
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.