Extracted

• • Target

    cfd33d516ee92bc96d6eb380b7f8e7fb

  • Size

    3.0MB

  • MD5

    cfd33d516ee92bc96d6eb380b7f8e7fb

  • SHA1

    8b1a6c2d8430ad40674d7aa9b564261c8b5f4f85

  • SHA256

    66f7d8cb4ae8a8a1a9989f4a66070f9d7eefa029e2c7ff575e447827abbfcb0b

  • SHA512

    53180a9fcc2dce7fb0edbf2831a079804430f2b2255dd76b2c337dc0628f3fde69535668fba86a34530fac4956df3ad671f2ad3e6497130b2cf9f5d64e7d3481

  Score

  10^/10

  arkeidefaultaspackv2discoveryspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

    suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

    suricata

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2