Extracted

Extracted

• • Target

    helf.hpl.dll

  • Size

    1.7MB

  • MD5

    5df3d0f5c72cf5e5f5558d0427fbe188

  • SHA1

    7f3d18d51f70b226fd93cdcc50b30f24584e54a9

  • SHA256

    446322c5499d41edee0ca0b83aba36f0cc74ed4743a2e50e6eb36d2a3469d85f

  • SHA512

    85b4bac6afcb5e909ba6b805ef14479305a785a68b99893287bdb07c5a55e51db8f22c2ab5343d7898e07a8de424357377aacd8c5c1288e06d07fefaa2d0c757

  Score

  10^/10

  arkeihancitor2103_punoshdefaultdiscoverydownloaderspywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2