General
- Target 2f327913c4482f812017173ee7cbd55298446938c974b6605a567d341f5db9e5
- Size 1.1MB
- Sample220205-vtm1psdhck
- SHA256 2f327913c4482f812017173ee7cbd55298446938c974b6605a567d341f5db9e5
Malware Config
Extracted
-
hawkeye_reborn
-
9.0.1.6
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
Blessed000@
-
9d4efd23-29ac-49ba-9f53-e0071a338c3f
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Blessed000@ _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:9d4efd23-29ac-49ba-9f53-e0071a338c3f _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Targets
-
- Target 2f327913c4482f812017173ee7cbd55298446938c974b6605a567d341f5db9e5
- Size 1.1MB
- SHA256 2f327913c4482f812017173ee7cbd55298446938c974b6605a567d341f5db9e5
Score10/10HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
M00nD3v Logger Payload
Detects M00nD3v Logger payload in memory.
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Nirsoft
Uses the VBS compiler for execution
Suspicious use of SetThreadContext