Overview

overview

10

Static

static

zxcv.exe

windows7_x64

1

zxcv.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    zxcv.EXEuigodfls
  • Size 100KB
  • Sample220507-e7ctwsegbj
  • SHA256 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
  • MD5 SHA1 SHA512
Score
10/10
arkeidefaultstealersuricata

Malware Config

Extracted

Family

  • arkei

Botnet

  • Default

Targets

    • Target
      zxcv.EXEuigodfls
    • Size 100KB
    • SHA256 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
    • MD5 SHA1 SHA512
    Score
    10/10
    arkeidefaultstealersuricata

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks