hawkeye

General

Target

2974f47de4efcbe1d9120b9559171c1ce778e74ac24fe3942571f80197b4be36
Size

623KB
Sample

220222-k95wcagcbj
MD5

64a169883ffe51e4983ee4c355d579cd
SHA1

04bee5866b3a8423b5d49d32d4b6ff215bf04f0b
SHA256

2974f47de4efcbe1d9120b9559171c1ce778e74ac24fe3942571f80197b4be36
SHA512

12114110a1c630c748a4bb323fc9c3b353859b75944b60164eb1615783accdd666eedaf3d6987992fec35942b79d742c54342a649a4ebd4b170c9afb72bc4f39

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
Russia@1961

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Targets

- Target
  
  2974f47de4efcbe1d9120b9559171c1ce778e74ac24fe3942571f80197b4be36
- Size
  
  623KB
- MD5
  
  64a169883ffe51e4983ee4c355d579cd
- SHA1
  
  04bee5866b3a8423b5d49d32d4b6ff215bf04f0b
- SHA256
  
  2974f47de4efcbe1d9120b9559171c1ce778e74ac24fe3942571f80197b4be36
- SHA512
  
  12114110a1c630c748a4bb323fc9c3b353859b75944b60164eb1615783accdd666eedaf3d6987992fec35942b79d742c54342a649a4ebd4b170c9afb72bc4f39
Score

10^/10

hawkeye neshta njrat hacked collection keylogger persistence spyware stealer trojan
- Detect Neshta Payload
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2