Overview

overview

10

Static

static

dcae989d2c...cc.exe

windows7_x64

10

dcae989d2c...cc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dcae989d2c708fa2b73374698b1a8acc.exe

  • Size

    336KB

  • Sample

    220617-ldly2abchr

  • MD5

    dcae989d2c708fa2b73374698b1a8acc

  • SHA1

    5846cc14d013c09c1f86796aba571ee65daa2d7e

  • SHA256

    edfaf15aa4e28a3891b08e7e948f0d08680b492b8ba4ca464ad1b68df0190719

  • SHA512

    4216de9f3641ba425cab752c769117f8c52e0087af09ae0413b2afcc2d82cb77ce1da0c5508cfcfa503de8f8f1c4d0b19fe263b65056b69c4de746874e72a0d1

Score
10/10
arkeidefaultdiscoveryspywarestealersuricata

Malware Config

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      dcae989d2c708fa2b73374698b1a8acc.exe

    • Size

      336KB

    • MD5

      dcae989d2c708fa2b73374698b1a8acc

    • SHA1

      5846cc14d013c09c1f86796aba571ee65daa2d7e

    • SHA256

      edfaf15aa4e28a3891b08e7e948f0d08680b492b8ba4ca464ad1b68df0190719

    • SHA512

      4216de9f3641ba425cab752c769117f8c52e0087af09ae0413b2afcc2d82cb77ce1da0c5508cfcfa503de8f8f1c4d0b19fe263b65056b69c4de746874e72a0d1

    Score
    10/10
    arkeidefaultdiscoveryspywarestealersuricata

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)

      suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)

      suricata

    • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

      suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

      suricata

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks