Extracted

• • Target
    35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4
  • Size 271KB
  • SHA256 35f7c913b8476777e49d08d4c6285c4a390cacd8fe969839148f6cedcd143ad4
  • MD5 2faf53df7832925ed6913f4044791953
  • SHA1 94dc0dceab0b93cf0e834f3e6905ddf4a7c0362f
  • SHA512 fc719dc9ea584260a4b4455267ebaeb57ab54b16eab771cd2cf3244d56c6c4fb092ef18de30dae0cb31fe7c07b1b8299a7f47329e2c411339eb618b67abe4af6
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoverypersistencespywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1