Extracted

• • Target
    3f8a073be59c3c47bdf4e9a42273ae84
  • Size 282KB
  • SHA256 4fb9f08b1053d49ff58f30aa0016beefcd85041435ba9bb4b0402d99feb6df5e
  • MD5 3f8a073be59c3c47bdf4e9a42273ae84
  • SHA1 5790779c7a63d48e933a6d38dc5d79a9288b9bde
  • SHA512 ac08879630a4d0a3380b9192d1733141a38306fa324662afcbbc3824ba1733ff35581cadbe1eb4b6bee18825e69c88e1eba94d877c2d3efde2eeb1580a883515
  • MD5 SHA1 SHA512

  Score

  10^/10

  arkeidafaultdiscoveryspywarestealer

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Arkei Stealer Payload

    stealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2