Extracted

• • Target
    d3dc388312ff29a8ef87770101c5334d.exe
  • Size 361KB
  • SHA256 4c2ee3aea718f89be0dd83db92ed882dd4e94dc65807e344e2bcdbc032674c8e
  • MD5 d3dc388312ff29a8ef87770101c5334d
  • SHA1 0dbd1b4fe253d73d7407cde7a7b4c78c41b623ae
  • SHA512 9de1daca45e91b9a230bedfedec7a6122ff48d028b1cbe54d0e1a4ce2b587cc52e010f13f16229f33bb45e22703e96efbe14aff805d0e0a3354e823b665ba435
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2