Extracted

• • Target
    6f54535a2bf34c32c2adb107d45425b78ce7baad19789d72d2fd0398f0c798db
  • Size 993KB
  • SHA256 6f54535a2bf34c32c2adb107d45425b78ce7baad19789d72d2fd0398f0c798db
  • MD5 7e8621bc9756157664b830082b4557ec
  • SHA1 4566b2019eea70f9bea84d326b933f9e0ad5b6ba
  • SHA512 90b0a87b6827eb653128bb1f34a8bb98f3cf21ab0ce14f47b6a630b2682f60b4c578b1664ab693339090211717659de522cadd21d7623ede113c419f18630ad8
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyekeyloggerpersistencespywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2