Extracted

• • Target
    order15062020944758666.exe
  • Size 930KB
  • SHA256 5321f28c4dc096dbf5eda4f882cb97f22acd91fa73826ccaa64d4e9b66f12499
  • MD5 af125a9d30de93e3208b8672187e9bc7
  • SHA1 fe0b7a363b9fcaf8ba854114efc88caa142a6160
  • SHA512 b465c550db6f8631cba73362ee78fd8c9052d0986842e7fed17309588362491c068e256d0f99fa3b228f4f12f96afe88462d1bcb3d1f4e848d78df4d3b8bbd67
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyekeyloggerpersistencespywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2