Extracted

• • Target
    499ca982044b74b5ec45876d5ea0f9c3a85865f11a5e9f07869235b45bb53e2b
  • Size 241KB
  • SHA256 499ca982044b74b5ec45876d5ea0f9c3a85865f11a5e9f07869235b45bb53e2b
  • MD5 2449890f5d9c10d4082e129e0b893efc
  • SHA1 f42516f88e49d773cb96b6e1118e0f69ca8b1e21
  • SHA512 8f717f8cd80d6c86ddd7f29f9c6f96de9239127191917839fe56a118804bf3ef01b70f3cc93a1e3f6b6f7d567c38930060e3374576d1ecaab03638360e7dcec0
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoverypersistencespywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1