Extracted

• • Target

    2c087bb64cb5b12444c5ad9e20f46822

  • Size

    288KB

  • MD5

    2c087bb64cb5b12444c5ad9e20f46822

  • SHA1

    3c7f3b016a684ca9c61c0ef43cf229d9e48de305

  • SHA256

    965dffc8c73d88f296086b5c6324b2be6ef9cd5041d6d7822370f2a04dc1538b

  • SHA512

    e32e97190f0c167546ae98a21b25a4e42da3e8168c89c40ae8c390aff88324fdf6e8960d1afc51ff7d9f6da9538471249a6d748ca11df035fb2d3ac7bdaa1688

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealersuricatapersistence

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)

    suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)

    suricata

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2