General

  • Target

    a5a77a06940cb5c8933934b8c9e4ac27.exe

  • Size

    364KB

  • Sample

    220731-q2ypysfha8

  • MD5

    a5a77a06940cb5c8933934b8c9e4ac27

  • SHA1

    a4d0bebefcbef7b718acd9f2e69a9b7767213a51

  • SHA256

    7626e47624b6d66f33395c1c0febb9d8f2c8eb9197ad4eda6c61f86f8660b7b8

  • SHA512

    dcaaabc990fd6f971810887a27cd7204bf5cc3cd16e7f4ac0712e41a277051980a079f4b9ea181d1d4509aa56b6b74d454ad2877b50e67029080adb79e7a5aad

Malware Config

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      a5a77a06940cb5c8933934b8c9e4ac27.exe

    • Size

      364KB

    • MD5

      a5a77a06940cb5c8933934b8c9e4ac27

    • SHA1

      a4d0bebefcbef7b718acd9f2e69a9b7767213a51

    • SHA256

      7626e47624b6d66f33395c1c0febb9d8f2c8eb9197ad4eda6c61f86f8660b7b8

    • SHA512

      dcaaabc990fd6f971810887a27cd7204bf5cc3cd16e7f4ac0712e41a277051980a079f4b9ea181d1d4509aa56b6b74d454ad2877b50e67029080adb79e7a5aad

    • Arkei

      Arkei is an infostealer written in C++.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks