Extracted

• • Target
    781ce17320d0d4831699551b71719d6b.exe
  • Size 273KB
  • SHA256 74afacc1e49302d3c5061cd9f1133fb89a4ddfb6da46d955a56b404bd6a3df66
  • MD5 781ce17320d0d4831699551b71719d6b
  • SHA1 94cb44e2ac96b109a455ff22002d941f849ab17f
  • SHA512 2962acd7d70d29bec21ff47184248c79b266d5711a57ded7717c0c6d82fdb20717db3874282571d82812f53f9c28265d580c7e965e9f95b228012840a3272dd9
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • suricata: ET MALWARE Win32/Arkei Stealer CnC Checkin (GET)

    suricata: ET MALWARE Win32/Arkei Stealer CnC Checkin (GET)

    suricata

  • suricata: ET MALWARE Win32/Arkei Stealer CnC Checkin (POST)

    suricata: ET MALWARE Win32/Arkei Stealer CnC Checkin (POST)

    suricata

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2