General

  • Target

    4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b

  • Size

    158KB

  • Sample

    220406-k1kttacaf2

  • MD5

    880924e5583978c615dd03ff89648093

  • SHA1

    ef759f6eca63d6b05a7b6e395df3571c9703278b

  • SHA256

    4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b

  • SHA512

    ddb8e5e43977981324e8ab761469e079102fc7deaccc26af4f5d57e30ae1b2a28c64c7fd83d86f4cb85f1e0913366209a3a02673b4064466b1176e8aaee62241

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://194.87.218.39/RyC66VfSGP.php

Targets

    • Target

      4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b

    • Size

      158KB

    • MD5

      880924e5583978c615dd03ff89648093

    • SHA1

      ef759f6eca63d6b05a7b6e395df3571c9703278b

    • SHA256

      4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b

    • SHA512

      ddb8e5e43977981324e8ab761469e079102fc7deaccc26af4f5d57e30ae1b2a28c64c7fd83d86f4cb85f1e0913366209a3a02673b4064466b1176e8aaee62241

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks