Extracted

• • Target
    efe2ce70cee5e8d9b4aed311ddd1716535e98fa6c1fa67d67d54bd97beb70a7a
  • Size 1.1MB
  • SHA256 efe2ce70cee5e8d9b4aed311ddd1716535e98fa6c1fa67d67d54bd97beb70a7a
  • MD5 a95d71f5a4f3543ec53ba2fdd85aa317
  • SHA1 3056dc2a08a59967e3f05fa2749540f1534c1356
  • SHA512 150d33a68a9770580fdf949e205d82af833f4f71eb7bbe00f3a872aa5fd4ff9878a9b4ae9fa42b7e115cec9bc6ecd3cfaae919264a482f51814c9d85f47d7560
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyekeyloggerpersistencespywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2