Extracted

• • Target
    df8e055e2119ec713d20a71e240e6e3fcb81b286687acf3b41abe270c2b4585f
  • Size 311KB
  • SHA256 df8e055e2119ec713d20a71e240e6e3fcb81b286687acf3b41abe270c2b4585f
  • MD5 664d128640d74892135fcc469985204b
  • SHA1 4b7d720dc68a0c5877743c83f86dbe8d860fa62a
  • SHA512 6cd944431d0e26e5950b9498b7d71892636c8c8770931d64dbdb30db2df0927b2ccc540bfe802149616ecfc96b3d4f62c1c2816f8c3a98ec12118f7e15236287
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoverypersistencespywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1