Extracted

• • Target
    dffaf08a25150b38c19210c180862aeb.exe
  • Size 1.6MB
  • SHA256 8fdbfbf55033187c6a4d3cd7d42394cd56cbd3b5a9dc905e72aef2886172be36
  • MD5 dffaf08a25150b38c19210c180862aeb
  • SHA1 a28b135b64a08d5ed30621aac5c3e955d4d090fb
  • SHA512 140b3431fb93d4af25df7da68b9dea8eec93e721f40831c12a0a2acb0e9fd1bda23a9d9665b5d18a39a2424bf5b57a2118dab705bfaabd0ce759e3fe0786abe7
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyecollectionevasionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2