arkei

General

Target

Malware_Dropper.exe
Size

20.5MB
Sample

220708-qxbpmacher
MD5

59d02f49a025628102ce6f5614c88f9f
SHA1

72d54917f8532bb434f645f09ede4e8cf9fcabed
SHA256

641438e98f1ea2def285e5ba391435bf4b96bc95e351cfacf7be1c5729e7e365
SHA512

48dcda93fb6eb51d772b1387eb3ae956259b39d5fb9fd37b6a41e13c23a5885cc2fbcde1bca65c0c64c397faf90d0cc222959594718f33638188ec6adc61511a

Score

10^/10

Malware Config

Extracted

Family

arkei

Botnet

Default

Targets

- Target
  
  Malware_Dropper.exe
- Size
  
  20.5MB
- MD5
  
  59d02f49a025628102ce6f5614c88f9f
- SHA1
  
  72d54917f8532bb434f645f09ede4e8cf9fcabed
- SHA256
  
  641438e98f1ea2def285e5ba391435bf4b96bc95e351cfacf7be1c5729e7e365
- SHA512
  
  48dcda93fb6eb51d772b1387eb3ae956259b39d5fb9fd37b6a41e13c23a5885cc2fbcde1bca65c0c64c397faf90d0cc222959594718f33638188ec6adc61511a
Score

10^/10

arkei default discovery evasion exploit spyware stealer suricata
- Arkei
  Arkei is an infostealer written in C++.
  stealer arkei
- Modifies security service
  evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
  suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
  suricata
- suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)
  suricata: ET MALWARE Win32/Vidar Variant/Mars CnC Activity (GET)
  suricata
- suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
  suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
  suricata
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2