General
- Target a547ef59224abe9aa0915697fead0135d78919d14c3496d68885d17661117231
- Size 265KB
- Sample220131-sk786shecr
- SHA256 a547ef59224abe9aa0915697fead0135d78919d14c3496d68885d17661117231
- MD5 9819f09197c0888f296381c19f747e88
- SHA1 c18aea2c16da69cfc7459bd4da2a58244b37c69a
- SHA512 fde3434c87c29d5285f9f7e966c6d05f76f2a492595057c0b9ed2d5c62412f3c03d6f6aebca9afb1f82d1205469024b727cf352d44f489134775b52e46b82542
- MD5 SHA1 SHA512
Static task
static1
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://coin-file-file-19.com/tratata.php
Targets
-
- Target a547ef59224abe9aa0915697fead0135d78919d14c3496d68885d17661117231
- Size 265KB
- SHA256 a547ef59224abe9aa0915697fead0135d78919d14c3496d68885d17661117231
- MD5 9819f09197c0888f296381c19f747e88
- SHA1 c18aea2c16da69cfc7459bd4da2a58244b37c69a
- SHA512 fde3434c87c29d5285f9f7e966c6d05f76f2a492595057c0b9ed2d5c62412f3c03d6f6aebca9afb1f82d1205469024b727cf352d44f489134775b52e46b82542
- MD5 SHA1 SHA512
Arkei Stealer Payload
Downloads MZ/PE file
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.