General
- Target 029f52496f4fa2f85e5a7b759256c181486f08bdc040648730542279354304f1
- Size 241KB
- Sample220202-j7wdfshebl
- SHA256 029f52496f4fa2f85e5a7b759256c181486f08bdc040648730542279354304f1
- MD5 3a735ebc5702e02109dd8ab950b390c0
- SHA1 37b5eaeac95eaf30e93f5b10b22ed1f93a1247e2
- SHA512 0c44290d5a934b91d0f250358483f4e58b34afc35aabf8bfc6dd9291f2614a919c57c4d02a53491be6558aeb412a3aed6f2d7f749c08335a1b373cda6a4392a0
- MD5 SHA1 SHA512
Static task
static1
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://coin-file-file-19.com/tratata.php
Targets
-
- Target 029f52496f4fa2f85e5a7b759256c181486f08bdc040648730542279354304f1
- Size 241KB
- SHA256 029f52496f4fa2f85e5a7b759256c181486f08bdc040648730542279354304f1
- MD5 3a735ebc5702e02109dd8ab950b390c0
- SHA1 37b5eaeac95eaf30e93f5b10b22ed1f93a1247e2
- SHA512 0c44290d5a934b91d0f250358483f4e58b34afc35aabf8bfc6dd9291f2614a919c57c4d02a53491be6558aeb412a3aed6f2d7f749c08335a1b373cda6a4392a0
- MD5 SHA1 SHA512
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.