Extracted

• • Target
    PO_3421.msi
  • Size 2.3MB
  • SHA256 1f7830f0117f694b87ae81caed022c82174f9a8d158a0b8e127154e17d1600cc
  • MD5 30a04930a6888a2df882478fef4a7ade
  • SHA1 c91b1b550c3a74840f3066e7a4b0fe08c37b7d2a
  • SHA512 b101b58533e61dd8fe8d27af36cb3c6300927286a51994bb7adbafac63ff20af61196660bc79f3f6ffef1e9975be8d06d9ed0c88891389abedcf823480565b49
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2