Behavioral task
behavioral1
Sample
4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b.exe
Resource
win7-20230621-en
General
-
Target
4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b.zip
-
Size
93KB
-
MD5
4f9ea3cd111004a246cec096311b0332
-
SHA1
ce72533528b7778a629fad77211b3878fc28447d
-
SHA256
3eff2e1ab5632f6a2b0ca5c0b007c9f1b2bb2fbbe1517c4ba0695802116da001
-
SHA512
4e5abff7a39293319a56fa9f2a9cfedcb4bbb4edfbbbea6f3f28656094742577e47730611d39e9636314aa127e7ed592a7b35b38c3d83135a84f489d55af6e2c
-
SSDEEP
1536:Ca127uypgDB1Q6e72npFj2AyIveJ6F63ReIEzUR3rlpBJN/ZwjaTvPxDPOmHymsg:CGjpFTe7OaAyceJ6FC6qhpBJN/oabxD/
Malware Config
Signatures
-
Arkei Stealer Payload 1 IoCs
resource yara_rule static1/unpack001/4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b.bin family_arkei -
Arkei family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b.bin
Files
-
4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b.zip.zip
Password: infected
-
4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b.bin.exe windows x86
Password: infected
4c665f81387442ad965e3f4eba69f083
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strstr
strncpy
getenv
rand
srand
_mbsicmp
_putenv
strtok
memcpy
memset
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LLCPPC Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE