Arkei StealerMalware
- arkeistealer
Arkei is a stealer that appeared around May 2018. It collects data about browsers (saved passwords and autofill forms), cryptocurrency wallets, and steal files matching an attacker-defined pattern. It then exfiltrates everything in a zip file uploaded to the attacker's panel. Later, it was forked and used as a base to create Vidar stealer.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1005Data from Local System
“T1005 Data from Local System”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1012Query Registry
“T1012 Query Registry”
- T1014Rootkit
“T1014 Rootkit”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
What the reports say
1 report, newest first · the exact sentence from each-
Package deal: Malware bundles causing disruption and damage across EMEA“DJVU/STOP ransomware itself is seen to be used increasingly often together with Arkei Stealer and various RATs.”
Indicators in its reports
named in the reports above- hxxps://digitalfitsoft[.]comin 1 report
- digitalfitsoft[.]comin 1 report
- hxxps://installmentloan7vrt[.]orgin 1 report
- installmentloan7vrt[.]orgin 1 report
- soft-you[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.