Extracted

• • Target
    TT Swift Copy.exe
  • Size 1.2MB
  • SHA256 d34bf3220c17f2188a05d855c4e5f0501ebe86407daceaa9879ef3bcefc97b12
  • MD5 06a3e8506a5c2a41e0d8b6ffbb725e9a
  • SHA1 5d5ec5b9a7529e73745d1c03badbb681939253af
  • SHA512 27269856d044d92493b80622dfe6be21fad4e0b228d1568bbbc4629197f9422a80be6515c786492e1f75c0149ebc9dd77d8cba0ef75602e01a7cd241171763b4
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywareevasionkeyloggertrojanstealerhawkeyepersistence

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2