Extracted

• • Target
    f59f15bba5a4fe8df9441253eda4e8f85f411bdbe492d9f39f23bbf7969bacd3
  • Size 1.1MB
  • SHA256 f59f15bba5a4fe8df9441253eda4e8f85f411bdbe492d9f39f23bbf7969bacd3
  • MD5 6f315f335430f24f4a3b3d77eeff2768
  • SHA1 69cf7fc7a7d8334b804dbde1a7942388a4f9dde1
  • SHA512 90ba482b48257437bd1e37f143345d3110498cdd366ea12c6b940bbfe17e7a365cbd2d2a6526b2277be8b1234370f648564fb4b776e6307c4b1f44c2c24de8e1
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyekeyloggerpersistencespywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2