Extracted

• • Target

    dcae989d2c708fa2b73374698b1a8acc.exe

  • Size

    336KB

  • MD5

    dcae989d2c708fa2b73374698b1a8acc

  • SHA1

    5846cc14d013c09c1f86796aba571ee65daa2d7e

  • SHA256

    edfaf15aa4e28a3891b08e7e948f0d08680b492b8ba4ca464ad1b68df0190719

  • SHA512

    4216de9f3641ba425cab752c769117f8c52e0087af09ae0413b2afcc2d82cb77ce1da0c5508cfcfa503de8f8f1c4d0b19fe263b65056b69c4de746874e72a0d1

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)

    suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)

    suricata

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2