General
- Target db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10
- Size 690KB
- Sample220212-qbqxesedcm
- SHA256 db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10
Malware Config
Extracted
-
hawkeye_reborn
-
10.1.0.0
-
Protocol
ftp
-
Host
ftp.suzukirmkjakarta.com
-
Port
21
-
Username
-
Password
tooblessed77
-
bb6b10af-6b63-4400-a703-75211ef8113b
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:tooblessed77 _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.suzukirmkjakarta.com _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:bb6b10af-6b63-4400-a703-75211ef8113b _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - RebornX, Version=10.1.0.0, Culture=neutral, PublicKeyToken=null
Targets
-
- Target db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10
- Size 690KB
- SHA256 db2b38258707432f6ff76fec06aa4150cd8eb57994ff23863078efab2bc42e10
Score10/10HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
M00nD3v Logger Payload
Detects M00nD3v Logger payload in memory.
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Nirsoft
Uses the VBS compiler for execution
Suspicious use of SetThreadContext