Overview

overview

10

Static

static

260017# PU...df.exe

windows7_x64

10

260017# PU...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    260017# PURCHASE LIST pdf.exe

  • Size

    1.1MB

  • Sample

    200319-b2aee7h1ws

  • MD5

    2a01ff3fa54364cc15e6535be1e57cca

  • SHA1

    8c1d0197d9fac0d7d580702860d35049424aa9af

  • SHA256

    3dd0e88a93b6d4fa561f0ece77fee607262c53a5ecb7164b64c29505b88083a8

  • SHA512

    3a2467296decf132a37fa164424acee57a3299e4d851829786359d0b2c9c41e62a5f136049b06ae2e51697f27561f7d24f86e4c5a12f024a7305d81089d9b041

Score
10/10
hawkeye_rebornkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      260017# PURCHASE LIST pdf.exe

    • Size

      1.1MB

    • MD5

      2a01ff3fa54364cc15e6535be1e57cca

    • SHA1

      8c1d0197d9fac0d7d580702860d35049424aa9af

    • SHA256

      3dd0e88a93b6d4fa561f0ece77fee607262c53a5ecb7164b64c29505b88083a8

    • SHA512

      3a2467296decf132a37fa164424acee57a3299e4d851829786359d0b2c9c41e62a5f136049b06ae2e51697f27561f7d24f86e4c5a12f024a7305d81089d9b041

    Score
    10/10
    spywarekeyloggertrojanstealerhawkeye_reborn

    • HawkEye Reborn

      HawkEye Reborn is an enchanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks