Extracted

• • Target
    Order07JUL2020-5-40HQ.exe
  • Size 909KB
  • SHA256 8d8236eed9973c50c80b31c7aed1bab0a46dfdcc9b1f1ce749aa7d88963abe1b
  • MD5 e003ceeef6a45f3fe2d6b652d77816c8
  • SHA1 96fbeecc72ace768f544b7e574b996171b8d02a0
  • SHA512 e61fe04a71d50903e78f0b7dcbb8a01ea25b6424c32464e068d5bc38b60d008ce340b26137b15b25e652d108440a78d335367f83f273c8cdd9c6c5d5a55a3a50
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarekeyloggertrojanstealerhawkeyepersistence

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run entry to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2