General

  • Target

    01d8c4d08e555c8ea87b3b227c9ddb1a7092f56787d429c71c11589a422bbee6

  • Size

    840KB

  • Sample

    220523-wagj9ahed4

  • MD5

    adedd222b98f6677ac30ccc81c38954b

  • SHA1

    1477164ec83772104e90ddda0f882283a002990f

  • SHA256

    01d8c4d08e555c8ea87b3b227c9ddb1a7092f56787d429c71c11589a422bbee6

  • SHA512

    085aeadd6d15025ec4e508cbcdfeb5c10b7c524510d8a4760a6d7214e57e71c8272b1071ca286f50a1dbe1abd39bf6c801365be5f6660133ccf9a9d091e98663

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://timebound.ug/pps.ps1

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      01d8c4d08e555c8ea87b3b227c9ddb1a7092f56787d429c71c11589a422bbee6

    • Size

      840KB

    • MD5

      adedd222b98f6677ac30ccc81c38954b

    • SHA1

      1477164ec83772104e90ddda0f882283a002990f

    • SHA256

      01d8c4d08e555c8ea87b3b227c9ddb1a7092f56787d429c71c11589a422bbee6

    • SHA512

      085aeadd6d15025ec4e508cbcdfeb5c10b7c524510d8a4760a6d7214e57e71c8272b1071ca286f50a1dbe1abd39bf6c801365be5f6660133ccf9a9d091e98663

    • Arkei

      Arkei is an infostealer written in C++.

    • suricata: ET MALWARE Windows executable base64 encoded

      suricata: ET MALWARE Windows executable base64 encoded

    • Uses the VBS compiler for execution

MITRE ATT&CK Enterprise v6

Tasks