arkei

General

Target

028adfdfe2ca971c48d9e0f0714400e8c729eecb20643871552ddb4072578adb
Size

734KB
Sample

220528-ek4n4acccq
MD5

fd5b5cc293d372853c023c7b0ee5b3b4
SHA1

d07d60444b165d75dc396aaf9ea4b56c509545b8
SHA256

028adfdfe2ca971c48d9e0f0714400e8c729eecb20643871552ddb4072578adb
SHA512

96c5af7e4f01184d7999a51638e3301b290aa24afdffb145d575901186073db1512c3c7df9b5da0772d64b0ab2c64c60ba50cb4ab82fd95a6119616ad4fddd8f

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://timebound.ug/pps.ps1

Extracted

Family

arkei

Botnet

Default

Targets

- Target
  
  028adfdfe2ca971c48d9e0f0714400e8c729eecb20643871552ddb4072578adb
- Size
  
  734KB
- MD5
  
  fd5b5cc293d372853c023c7b0ee5b3b4
- SHA1
  
  d07d60444b165d75dc396aaf9ea4b56c509545b8
- SHA256
  
  028adfdfe2ca971c48d9e0f0714400e8c729eecb20643871552ddb4072578adb
- SHA512
  
  96c5af7e4f01184d7999a51638e3301b290aa24afdffb145d575901186073db1512c3c7df9b5da0772d64b0ab2c64c60ba50cb4ab82fd95a6119616ad4fddd8f
Score

10^/10

persistence spyware suricata arkei default stealer
- Arkei
  Arkei is an infostealer written in C++.
  stealer arkei
- suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
  suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
  suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
  suricata
- suricata: ET MALWARE Windows executable base64 encoded
  suricata: ET MALWARE Windows executable base64 encoded
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2