Overview

overview

10

Static

static

KxAv6dlO4dTXfWq.exe

windows7_x64

10

KxAv6dlO4dTXfWq.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KxAv6dlO4dTXfWq.exe

  • Size

    240KB

  • Sample

    200504-p4w6wxya12

  • MD5

    23ffd35d0d0afd657a63be803e6d1049

  • SHA1

    ef6c7aa6567da81a14fceb47858ece21cfb0aa45

  • SHA256

    bd878970ab0cbcf5b29bf5a7e2f9ae25e81279ddc0cc30d59bdd242f40a465c2

  • SHA512

    0915b561391c5c6127881d762eeb2d4c9d96c6462a8bef1c8827d875727879feb06e1b29b2596f7358b669f66d21f6ca67575e7644782541081301f2332a736f

Score
10/10
hawkeye_rebornkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      KxAv6dlO4dTXfWq.exe

    • Size

      240KB

    • MD5

      23ffd35d0d0afd657a63be803e6d1049

    • SHA1

      ef6c7aa6567da81a14fceb47858ece21cfb0aa45

    • SHA256

      bd878970ab0cbcf5b29bf5a7e2f9ae25e81279ddc0cc30d59bdd242f40a465c2

    • SHA512

      0915b561391c5c6127881d762eeb2d4c9d96c6462a8bef1c8827d875727879feb06e1b29b2596f7358b669f66d21f6ca67575e7644782541081301f2332a736f

    Score
    10/10
    keyloggertrojanstealerspywarehawkeye_reborn

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks