PO HALLEY PROJECT01X40 CFR 72020.tbz2.exe

General
Target

PO HALLEY PROJECT01X40 CFR 72020.tbz2.exe

Filesize

781KB

Completed

03-06-2020 12:06

Score
10 /10
MD5

f31581564b5bbc14d3c862c2be157a52

SHA1

64e62fe3198a16cb205acd31400af967ad3dd347

SHA256

7c0f66eed3a2fc7c90ab5db03483aada693894a77a1480e22521ccf422a08ba3

Malware Config

Extracted

Family hawkeye_reborn
Version 10.0.0.1
Attributes
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:eagle*qaz _EmailPort:587 _EmailSSL:true _EmailServer:mail.eagleeyeapparels.com _EmailUsername:faruq@eagleeyeapparels.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f98d37f4-ca90-4ed7-9f6f-6121c4014605 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.1 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.1, Culture=neutral, PublicKeyToken=null
Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\PO HALLEY PROJECT01X40 CFR 72020.tbz2.exe.log

    • C:\Users\Admin\AppData\Local\Temp\tmp4B47.tmp

    • memory/64-5-0x0000000000400000-0x000000000045C000-memory.dmp

    • memory/64-6-0x0000000000400000-0x000000000045C000-memory.dmp

    • memory/752-9-0x0000000000400000-0x000000000041C000-memory.dmp

    • memory/752-8-0x0000000000400000-0x000000000041C000-memory.dmp

    • memory/1568-3-0x0000000000400000-0x0000000000490000-memory.dmp