General
- Target 22987954c310d538025035f6741edee6ef382388e3b92fc5fdc51deb7d2a735b
- Size 248KB
- Sample220131-wmew7abcd3
- SHA256 22987954c310d538025035f6741edee6ef382388e3b92fc5fdc51deb7d2a735b
- MD5 142969f93eafec6fcaaa172bd8edeba3
- SHA1 ecc4f6865ce61aa84f1f7494c565da2c891a4400
- SHA512 6fa663490b22e578305253d454af2c7eb86e9928c121131e56a39ebc67d180bd01092ea4a99353c0dda84678569d7b682b0598aa8e1a696b8b78cdffcdc10a75
- MD5 SHA1 SHA512
Static task
static1
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://coin-file-file-19.com/tratata.php
Targets
-
- Target 22987954c310d538025035f6741edee6ef382388e3b92fc5fdc51deb7d2a735b
- Size 248KB
- SHA256 22987954c310d538025035f6741edee6ef382388e3b92fc5fdc51deb7d2a735b
- MD5 142969f93eafec6fcaaa172bd8edeba3
- SHA1 ecc4f6865ce61aa84f1f7494c565da2c891a4400
- SHA512 6fa663490b22e578305253d454af2c7eb86e9928c121131e56a39ebc67d180bd01092ea4a99353c0dda84678569d7b682b0598aa8e1a696b8b78cdffcdc10a75
- MD5 SHA1 SHA512
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.