General
- Target 7cbc2100b9698ae41f88e0cfbf6037ae.exe
- Size 190KB
- Sample211124-ybtx3sdeep
- SHA256 b0ffdeb93d45ef22371b46cf607a43a75e24568a9bc784187489c0761c3481ec
- MD5 7cbc2100b9698ae41f88e0cfbf6037ae
- SHA1 8fa3993b7782a8cb8c117f8a7457af7b4f0c2eea
- SHA512 5b1f797715500fb2629a85093a1f37de22939c5d521091e89b3161a4e29d8614630d4b360146886330e4c32e062a3d1ffa933ae3d9d5fbeec64c3d9898dc5baf
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
7cbc2100b9698ae41f88e0cfbf6037ae.exe
Resource
win7-en-20211104
0 signatures
0 seconds
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://file-file-host4.com/tratata.php
Targets
-
- Target 7cbc2100b9698ae41f88e0cfbf6037ae.exe
- Size 190KB
- SHA256 b0ffdeb93d45ef22371b46cf607a43a75e24568a9bc784187489c0761c3481ec
- MD5 7cbc2100b9698ae41f88e0cfbf6037ae
- SHA1 8fa3993b7782a8cb8c117f8a7457af7b4f0c2eea
- SHA512 5b1f797715500fb2629a85093a1f37de22939c5d521091e89b3161a4e29d8614630d4b360146886330e4c32e062a3d1ffa933ae3d9d5fbeec64c3d9898dc5baf
- MD5 SHA1 SHA512
-
Arkei Stealer Payload
-
Downloads MZ/PE file
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.