Extracted

• • Target

    AtomicWallet-Setup.bat

  • Size

    22KB

  • MD5

    17204bcbc62deab8d5253c0b4d7e87e9

  • SHA1

    c9766e880155869ac3eaad22382db9ec06a92be3

  • SHA256

    884b3ccd012883b6d74cb4482bd553407c5b53b741d84ce6d87850254f74298f

  • SHA512

    e1f58413373a095c1bc3d6eb4e007bb715d26f583c193f3762903cba63fc856e9daec1e3a81474ab8aab487f3ac1e6eba1db1f242e42d33abbedbd61ff3169d6

  Score

  10^/10

  evasionarkeidefaultdiscoveryspywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2