Extracted

Extracted

• • Target

    028adfdfe2ca971c48d9e0f0714400e8c729eecb20643871552ddb4072578adb

  • Size

    734KB

  • MD5

    fd5b5cc293d372853c023c7b0ee5b3b4

  • SHA1

    d07d60444b165d75dc396aaf9ea4b56c509545b8

  • SHA256

    028adfdfe2ca971c48d9e0f0714400e8c729eecb20643871552ddb4072578adb

  • SHA512

    96c5af7e4f01184d7999a51638e3301b290aa24afdffb145d575901186073db1512c3c7df9b5da0772d64b0ab2c64c60ba50cb4ab82fd95a6119616ad4fddd8f

  Score

  10^/10

  persistencespywaresuricataarkeidefaultstealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

    suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • suricata: ET MALWARE Windows executable base64 encoded

    suricata: ET MALWARE Windows executable base64 encoded

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2