General

  • Target

    01_extracted.exe

  • Size

    1.1MB

  • Sample

    200717-fytl1l14te

  • MD5

    bea9ed2395cb83c1680ee33fd231fef9

  • SHA1

    2620700b8c76d4236321f2a15b6392184df943e5

  • SHA256

    680e65e6219bd366e58a94117c26b39487a3bb274d1fa15537cdc9efc1e655ba

  • SHA512

    d0275ef36e13674de2505ef5997c594405f59a6327a2cfbd22cd5e185da673fd98c6ee2e4f7566083aeb7b86b955b24d6288b3d27b455d8c876155d788a6e177

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.mail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    payments00

Targets

    • Target

      01_extracted.exe

    • Size

      1.1MB

    • MD5

      bea9ed2395cb83c1680ee33fd231fef9

    • SHA1

      2620700b8c76d4236321f2a15b6392184df943e5

    • SHA256

      680e65e6219bd366e58a94117c26b39487a3bb274d1fa15537cdc9efc1e655ba

    • SHA512

      d0275ef36e13674de2505ef5997c594405f59a6327a2cfbd22cd5e185da673fd98c6ee2e4f7566083aeb7b86b955b24d6288b3d27b455d8c876155d788a6e177

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks