Overview

overview

10

Static

static

SCAN001.exe

windows7_x64

10

SCAN001.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCAN001.exe

  • Size

    903KB

  • Sample

    200321-fpfpfznkcx

  • MD5

    8a5867be14ac55f133f64e6234f2d2f7

  • SHA1

    b3aaafea6913d1ae69c9102310d51bf8257c0d25

  • SHA256

    95dce20d910cf373ff2b72697282c344313dd3bf7ffd09c4ece59cd9f58c8972

  • SHA512

    7aefa44f9fbd4d7c80529bea8b5b6c2c7b43cd4bdcda41f54e1cb84bb1ec15a6811ba8650c1cb5025793e46d3fe142f697d449c9b5840f00b311c828341a0270

Score
10/10
hawkeye_rebornkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      SCAN001.exe

    • Size

      903KB

    • MD5

      8a5867be14ac55f133f64e6234f2d2f7

    • SHA1

      b3aaafea6913d1ae69c9102310d51bf8257c0d25

    • SHA256

      95dce20d910cf373ff2b72697282c344313dd3bf7ffd09c4ece59cd9f58c8972

    • SHA512

      7aefa44f9fbd4d7c80529bea8b5b6c2c7b43cd4bdcda41f54e1cb84bb1ec15a6811ba8650c1cb5025793e46d3fe142f697d449c9b5840f00b311c828341a0270

    Score
    10/10
    keyloggertrojanstealerspywarehawkeye_reborn

    • HawkEye Reborn

      HawkEye Reborn is an enchanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks