Extracted

• • Target

    ce5706f1a1dd859a8233397c2490680b

  • Size

    416KB

  • MD5

    ce5706f1a1dd859a8233397c2490680b

  • SHA1

    9a3775d1c673313a4814abe25049efb03a3e674e

  • SHA256

    ad2c6c8d68058c316b1f3c343b59c0c14526f4a7c84ed771b2d90f590fc3c535

  • SHA512

    35b6aec7f2821baf073cc05d0e18173961757db0d458f7ed44979abbfbd040b8ecc6418e97f6bb23006fadd368191c34be0f1f5877a87b46f3c292523be00b7a

  • SSDEEP

    6144:P0XIE3wQQBHn8nd2r1XGUtZXdRloUfk+S+r2I1Fyjbl66A93LnYDttxU7Uu6wB8B:P6Yn8nd2r1XXtCXtvldA93LYzxOd6L

  Score

  10^/10

  arkeievasionstealertrojan

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2