Extracted

• • Target
    OFFICIAL WINNING NOTIFICATION LETTER.exe
  • Size 886KB
  • SHA256 0edc6218dec611e4dd00d3251ba2b3361d512f09dde595a8489639b9aa250ec9
  • MD5 f69f7be04689dee675797e1178d8e8b8
  • SHA1 73745846e0af98121ef66e64f743f5955f4e49c1
  • SHA512 bd7abed76e0415e6fecb730389b5f4be3789c078667decc4a6c3447e1c4c62d40852a05e7f85c91e4b86db75b567d633b6ba904b6114ec16233495c3b4919f72
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarekeyloggertrojanstealerhawkeyepersistence

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run entry to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2