Extracted

• • Target
    54d657c9a3d9b7b41c8d6c3c351e8e00
  • Size 960KB
  • SHA256 7907686d20104808021d5d4130039fed4fc7946ebc48d6e554bfcf01e69edfae
  • MD5 9a180b603d9232a773acfee12f5e448e
  • SHA1 ed5536d823ab96e7543269dceddad076af54b63d
  • SHA512 643d5062367b1fcb00399a4827e7f42e3b5e02178d4eba8b7d68ea75cf3dd843fffa7da0f75b33d82aaf4cb7840a38368c44716e5c9727d12e0a8fb5dcdffeeb
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyekeyloggerpersistencespywarestealertrojanupx

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2