Overview

overview

10

Static

static

Microsoft....ll.exe

windows7_x64

10

Microsoft....ll.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Microsoft.ApplicationInsights.PersistenceChannel.dll

  • Size

    458KB

  • Sample

    210913-q3jx7aghbk

  • MD5

    14e351015c5d632f888dbcac03871fae

  • SHA1

    b5471c5eea356ce87ac5c2df8bbd9bc72cf84da9

  • SHA256

    977a8d56d7bbc22e780e85bea06fa4be13c8f9be01515665863cb431fb2e8daa

  • SHA512

    f7ac50b3cc68404ddc14579c9e12239a292afc4e034232274f8987579fbf3ea59a64403e122b946cceec9a383633cb3b7f3eedade819125a017de7c6a48a8947

Score
10/10
arkeidiscoveryspywarestealer

Malware Config

Targets

    • Target

      Microsoft.ApplicationInsights.PersistenceChannel.dll

    • Size

      458KB

    • MD5

      14e351015c5d632f888dbcac03871fae

    • SHA1

      b5471c5eea356ce87ac5c2df8bbd9bc72cf84da9

    • SHA256

      977a8d56d7bbc22e780e85bea06fa4be13c8f9be01515665863cb431fb2e8daa

    • SHA512

      f7ac50b3cc68404ddc14579c9e12239a292afc4e034232274f8987579fbf3ea59a64403e122b946cceec9a383633cb3b7f3eedade819125a017de7c6a48a8947

    Score
    10/10
    arkeidiscoveryspywarestealer

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • Arkei Stealer Payload

      stealer

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks