General

  • Target

    2eb453b7ebccdba6050ae59249e360d5cd04d225f6977685616906cfe098cc45

  • Size

    159KB

  • Sample

    220803-epy96sehd4

  • MD5

    1dc9ff655bb6fe367b17902f0b0554b1

  • SHA1

    4d2163439b09ffdb7cdeb8f8d92f80220e59adfe

  • SHA256

    2eb453b7ebccdba6050ae59249e360d5cd04d225f6977685616906cfe098cc45

  • SHA512

    5bbb1628b3e5f5481eae31c4f0c320ca569a908a5d5b4f627cb2c200b8d544bad7243ec925f85bea67ef4cbe6dd6c5df5bd66d53525dc2625225cdf7a76092cd

Malware Config

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      2eb453b7ebccdba6050ae59249e360d5cd04d225f6977685616906cfe098cc45

    • Size

      159KB

    • MD5

      1dc9ff655bb6fe367b17902f0b0554b1

    • SHA1

      4d2163439b09ffdb7cdeb8f8d92f80220e59adfe

    • SHA256

      2eb453b7ebccdba6050ae59249e360d5cd04d225f6977685616906cfe098cc45

    • SHA512

      5bbb1628b3e5f5481eae31c4f0c320ca569a908a5d5b4f627cb2c200b8d544bad7243ec925f85bea67ef4cbe6dd6c5df5bd66d53525dc2625225cdf7a76092cd

    • Arkei

      Arkei is an infostealer written in C++.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks