Threat Thursday: Arkei Infostealer Expands Reach Using SmokeLoader to Target Crypto Wallets and MFA

Summary

The criminal group behind the Arkei information stealer appears to be interested in more than just picking our pockets. While cryptocurrency remains a primary target for the malware, which has recently been tied to use of the stealthy SmokeLoader downloader, a new analysis of Arkei shows that it has now expanded its reach to collect multifactor (MFA) authentication data as well.  

It’s not currently clear what attackers are looking to do with this information, but a threat group that is specifically targeting this information has the capacity to impact people using MFA both at home and at work.

Arkei also downloads a variety of legitimate components, which are often hosted via compromised websites, and puts them to use for malicious purposes. Much of Arkei’s flexibility relies on its configuration file, often hosted alongside these legitimate components, to receive its marching orders. Depending on what is enabled in this file, the malware will perform different activities, such as stealing saved password details, raiding auto-complete forms, and purloining saved credit card details and browser cookies.

Operating System

Risk & Impact

Technical Analysis

Attack Vector

Like many modern information-stealer families such as RedLine, Arkei is often sold and distributed as Malware-as-a-Service (MaaS), which means its initial attack vector can vary. However, over the past few weeks, this threat has been spotted utilizing the notorious downloader SmokeLoader as a method of deployment. Both Arkei and SmokeLoader have been identified using the same Indicators of Compromise (IOCs) and known-malicious URLs to conduct their malicious functionality.

Information-stealers and banking Trojans commonly use malware downloaders like SmokeLoader to get onto a victim device. Often, these types of malware rely on phishing websites or Trojanized download pages for hosting, offering seemingly benign software – cracked paid-applications or other potentially-trojanized downloads – to entice people to accept their poisoned offerings.

Components

On execution, Arkei will attempt to make several HTTP web-requests to a malicious URL. These GET HTTP Requests are designed to download known-legitimate components that the malware will then use to achieve some of its malicious functionality.

Once downloaded, Arkei will typically store the following Dynamic Link Libraries (DLLs) into the %\ProgramData\% directory for use throughout its execution process.

Configuration

Once Arkei has obtained its components, it will make one final GET Request to the same malicious URL to obtain its configuration file, as shown in Figure 1. This file is a small Base64-encoded .PHP file.

Arkei interprets the data within this configuration file and, depending on which flags are enabled within it, will carry out different malicious activities. This strategy makes the malware extremely flexible, as it allows the threat actor to extend the threat’s capabilities, or to focus on specific information to steal. For example, depending on which items in the configuration file are enabled, it determines which applications to automatically exfiltrate data from.

Figure 1: Request for Arkei's configuration

Using the CyberChef tool, the data contained within the config file can be de-obfuscated, as shown in Figure 2.

Figure 2: CyberChef output of Arkei config

Anti-Emulation and Region Checks

Arkei will check both the region of the device and the computer name. If the malware is executed with the computer name “HAL9TH,” it will terminate its execution chain. This computer name check is done because it is the name given to the Windows Defender Emulator; this technique is used by malware to prevent itself from running in an emulated environment.

The malware will also exit if it finds it’s being run in one of the following regions:

• Russian (Russia)
• Uzbek (Latin, Uzbekistan)
• Azerbaijani (Cyrillic, Azerbaijan)
• Kazakh (Kazakhstan)
• Belarusian (Belarus)

Browser Targets

One of the first pieces of information Arkei will attempt to steal is information about the victim’s Internet browser. Arkei searches for the presence of many popular browsers, including Google Chrome™ and Firefox, before attempting to scrape various pieces of data from them to exfiltrate.

The following applications are typically targeted:

Grabber

Arkei has an internal function labelled “Grabber,” which finds valuable information stored in Internet browsers. Because information is stored differently in each browser, Arkei has specific locations of a victim device where it looks for data to steal.

If enabled via the configuration file, Arkei will initially attempt to store different types of information in text files with the following file names.

Browser Extensions

One of most notable functions of Arkei is its ability to steal data from Google Chrome browser extensions. For each Chrome-based extension, an “Extension ID” is given. The malware uses this information to harvest data stored within.

This Extension ID is often stored within the following folders:

• %AppData%\Local\Google\Chrome\User Data\Default\Local Extension Settings
• %AppData%\Local\Google\Chrome\User Data\Default\Sync Extension Settings
• %AppData%\Local\Google\Chrome\User Data\Default\IndexedDB\Domain Name.indexeddb.leveldb

Arkei will attempt to harvest any files located within the extension folder. For cryptocurrency holders, this malware poses a significant threat due to the large number of wallets and crypto services it targets.

However, Arkei is not solely focused on stealing cryptocurrency. Arkei appears to also target additional Chrome-based browser extensions related to two-factor and multifactor authentication (2FA/MFA) and password management, increasing its risk to both corporate and private environments. It’s not entirely clear what attackers seek to do with this information; they could be seeking to change the device used to verify 2FA access (such as someone’s cell phone) to one controlled by attackers.

Browser Extension List – Passwords and Authentication

Browser Extension List – Cryptocurrency Wallets

Crypto Wallets

Arkei does not just stop at targeting crypto currencies via browser extensions. Many people prefer not to use third-party applications and services to store their digital currency. So, like the BlackJack component of BHunt we discussed in last week’s Threat Thursday blog, Arkei performs a similar routine to look for specific crypto wallets stored locally on the victim’s device.

Arkei will sweep through various folders looking for specific files related to cryptocurrency. This threat will search specific folders for terms like “wallet.dat,” which is a file-name format used by a wide range of different currencies. If a match is found, the malware attempts to store the content of the file in a SQL database, which it will exfiltrate back to its command-and-control (C2) server.

Though Arkei has the ability to target a wide range of crypto wallets, observed samples have had dedicated functionality to target the following crypto wallets:

Exfiltration

Once Arkei has finished ransacking the victim’s computer, it will attempt to bundle all the data it has obtained and exfiltrate it back to its C2. It collects this information in a folder with a name that is typically comprised of 12 random letters and numbers [0-9A-Z], as shown in Figure 3.

As Arkei obtains data, it will catalog that information before sending it back to the C2. As part of this catalog, the malware will also take a screenshot of the victim device and gather system information into a file called “system.txt.”

Figure 3: Example of Arkei exfiltration file

System Information

The system.txt file contains the following information about the victim’s device:

Arkei will also append a list of all installed software to this text file before exfiltrating the data. The data from Arkei is then sent to a new C2 and exfiltrated to the URL it initially reached out to.

Once Arkei has completed this step and exfiltration is successful, it will kill the process and delete itself. This is done as a clean-up mechanism to remove the malware from the device and prevent the victim from discovering they have been targeted.

Conclusions

Arkei is a flexible and stealthy information stealer that can impact both personal and corporate devices. As a MaaS, it bundles together several desirable features for attackers to use, allowing them to change infection tactics to suit their needs.

Inclusion of a configuration file allows threat actors to tailor exactly what information they choose to steal from the victim. And using legitimate files to perform nefarious functions makes Arkei more difficult for legacy anti-malware products to detect.

As more people both use cryptocurrencies and work from home, it is becoming more common to store personal financial information, as well as corporate data, on personal devices. This makes information-stealing an extremely rewarding pursuit for threat actors, who will continue pushing boundaries in their attempts to pursue bigger financial rewards.

Who is Typically Affected?

• Commercial and Professional Services
• Consumer Durables and Apparel
• Telecommunication Services
• Public Sector
• Insurance

Mitigation Tips

• Avoid downloading cracked software, or software from unknown/unverified links.
• Make sure corporate login credentials and personal passwords are not saved in your browser.
• Use two-factor authentication on a separate device, such as an authentication application installed on a mobile phone or tablet.
   

YARA Rule

The following YARA rule was authored by the BlackBerry Research & Intelligence Team to catch the threat described in this blog:

Indicators of Compromise (IoCs)

BlackBerry Assistance

If you’re battling this malware or a similar threat, you’ve come to the right place, regardless of your existing BlackBerry relationship.

The BlackBerry Incident Response team is made up of world-class consultants dedicated to handling response and containment services for a wide range of incidents, including ransomware and Advanced Persistent Threat (APT) cases.

We have a global consulting team standing by to assist you, providing around-the-clock support where required, as well as local assistance. Please contact us here: https://www.blackberry.com/us/en/forms/cylance/handraiser/emergency-incident-response-containment