Extracted

• • Target

    18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.bin

  • Size

    4.7MB

  • MD5

    fc133ce298306a3e8c6443b64d1bf303

  • SHA1

    774ee564f6ae6ce7d0f75e5062b2fa88b00df5da

  • SHA256

    18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a

  • SHA512

    7c4689555eefef79a67b8dd950104755df63f17b50112b266306bafcabdf4e81d5403b61e8074decae9dfbdd1b4ce1d48fefabc8aa1e6f224f2b1c86e070a917

  Score

  10^/10

  persistencearkeidefaultdiscoveryspywarestealersuricata

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • suricata: ET MALWARE Generic gate .php GET with minimal headers

    suricata: ET MALWARE Generic gate .php GET with minimal headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2