Extracted

• • Target
    98de22167c236dd4996aa1e08a0359335b91330f1ddbbce32a2761ecc62c5b7c
  • Size 988KB
  • SHA256 98de22167c236dd4996aa1e08a0359335b91330f1ddbbce32a2761ecc62c5b7c
  • MD5 0fd093b396c04267816fc402e0e18e45
  • SHA1 d4baf0baafc3acff7a2f898272b06d6bf0a39477
  • SHA512 b2a907a0632f92d77c46d5c72e9569a8d713dd1ae33bd60b3b9f457dd887e03c71c7f8f309fb335f732bf140a50662525115d7a2b910b87f9ad3ecb77bb86273
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyekeyloggerpersistencespywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2