arkei

General

Target

4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe
Size

384KB
Sample

240724-rgpf8ashrf
MD5

2ff5a03dff94e3d9cb079b4da0e57cf5
SHA1

d6483a3b778de602ba2c5657ca8efa2a0b75e3de
SHA256

3492109e6402567ad87451c72a554d3f112b5f59f3fb97e84082a767c2c76108
SHA512

34cd550664d44cb43d49ca060fe02f59cf19e0555adfe0f188b4f0877e6408b09ec5087ed606e0c7e7b39ec1d10f8305268337048b73bf36e9d67b6d64960f41
SSDEEP

6144:++pLw3TFfhAvLp2z62Dpl+X9Z+nD0nYwL6Q9HL6QGI7:BpLITFaKtuX9QnDmjj9rjGI

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

03252020

C2

62.204.41.166:27688

Attributes

auth_value
615a24be0b062774496a554724a2fe2b

Extracted

Family

arkei

Botnet

Default

C2

62.204.41.69/p8jG9WvgbE.php

Targets

- Target
  
  4F26B9B399E238579178958FC76C17AB1A605A33CB6BD6D47AAC073596A2DEE6.exe
- Size
  
  384KB
- MD5
  
  2ff5a03dff94e3d9cb079b4da0e57cf5
- SHA1
  
  d6483a3b778de602ba2c5657ca8efa2a0b75e3de
- SHA256
  
  3492109e6402567ad87451c72a554d3f112b5f59f3fb97e84082a767c2c76108
- SHA512
  
  34cd550664d44cb43d49ca060fe02f59cf19e0555adfe0f188b4f0877e6408b09ec5087ed606e0c7e7b39ec1d10f8305268337048b73bf36e9d67b6d64960f41
- SSDEEP
  
  6144:++pLw3TFfhAvLp2z62Dpl+X9Z+nD0nYwL6Q9HL6QGI7:BpLITFaKtuX9QnDmjj9rjGI
Score

10^/10

arkei redline 03252020 default aspackv2 discovery infostealer stealer
- Arkei
  Arkei is an infostealer written in C++.
  stealer arkei
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

RedLine

RedLine payload

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2