Extracted

• • Target

    4a9f6c4b7a5c0716912b22366f2b84ae.exe

  • Size

    317KB

  • MD5

    4a9f6c4b7a5c0716912b22366f2b84ae

  • SHA1

    c89d3f01152d9c593583545403492d958210831e

  • SHA256

    4b8067eeb1ff123514e59e09404686f72e9587b723814dd19efdecef767e848a

  • SHA512

    3d318bec41b833930577857e3d7ae3725c3560f4bb9692bb8a448ab1324f7f0ccc28d1ccbe7b9af7149caffc14efcac63d3a43893b6210e8f878e903a16d6085

  Score

  10^/10

  arkeidefaultdiscoveryspywarestealerpersistence

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2