Extracted

• • Target
    SecuriteInfo.com.Trojan.MalPack.GS.21189.1019
  • Size 315KB
  • SHA256 f106e2e0fa9b292f28808409cdc7a363f3c9310fbb547d896fdadcde4e8ea660
  • MD5 4d5b4f886995716e343d14b9fbaf6299
  • SHA1 fa2de8445dd7275c31568756c731fab58adf14e0
  • SHA512 b3d7a10ba738b2daa2833d0d192b3af0d7b5614964d0bae03256a609860fb11330cadc5f02b0dca834c1f68883230a6abcfcbb650d74ab35397eec6d425af128
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2