General

  • Target

    17380eaccf460c42bb0516d0f8358af57000db0eae288a8912a73cb7e688e150

  • Size

    602KB

  • Sample

    220222-s4xlsaaeg5

  • MD5

    9fded850abb9ece62919fb8dabe95a5b

  • SHA1

    3a448631fced7f1f1cbc5990480b09ba4b19b30f

  • SHA256

    17380eaccf460c42bb0516d0f8358af57000db0eae288a8912a73cb7e688e150

  • SHA512

    042f2656aa11ee39cafab2cb89f87ab73bda50465795e88d77890e75c4799ac05f4020ec962627d19ce8ed3de6c995d4b32756d9d406b72d359dfe1b68c46122

Malware Config

Targets

    • Target

      17380eaccf460c42bb0516d0f8358af57000db0eae288a8912a73cb7e688e150

    • Size

      602KB

    • MD5

      9fded850abb9ece62919fb8dabe95a5b

    • SHA1

      3a448631fced7f1f1cbc5990480b09ba4b19b30f

    • SHA256

      17380eaccf460c42bb0516d0f8358af57000db0eae288a8912a73cb7e688e150

    • SHA512

      042f2656aa11ee39cafab2cb89f87ab73bda50465795e88d77890e75c4799ac05f4020ec962627d19ce8ed3de6c995d4b32756d9d406b72d359dfe1b68c46122

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks