Overview

overview

10

Static

static

df48765732...31.exe

windows7_x64

10

df48765732...31.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

  • Size

    100KB

  • Sample

    220514-q5nn6acdfj

  • MD5

    c7a310982da68b10360854f9cd78e718

  • SHA1

    60140c28e0b7db797a771c2dee081fa3812246db

  • SHA256

    df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731

  • SHA512

    6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3

Score
10/10
arkeidefaultstealersuricata

Malware Config

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

    • Size

      100KB

    • MD5

      c7a310982da68b10360854f9cd78e718

    • SHA1

      60140c28e0b7db797a771c2dee081fa3812246db

    • SHA256

      df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731

    • SHA512

      6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3

    Score
    10/10
    arkeidefaultstealersuricata

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks