General

  • Target

    6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3

  • Size

    552KB

  • Sample

    220310-da81dsdah4

  • MD5

    0c2382bdc6a7bfd0070d63bf2abb1485

  • SHA1

    b47ee34d4df7270c7849dc9d1f2031c8afce19e1

  • SHA256

    6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3

  • SHA512

    a59e428fbd2913e3abb1827f42484a73b0e85de9f0a020fb794cc4d2c2ac10db59dc0b4469bb8c77bdbf8f3b4a8ccbb8378c8d10635e02abc81a45924531f55f

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3

    • Size

      552KB

    • MD5

      0c2382bdc6a7bfd0070d63bf2abb1485

    • SHA1

      b47ee34d4df7270c7849dc9d1f2031c8afce19e1

    • SHA256

      6c47e2e3c113778424298e744a5ffd42da81c783c0a0336e837ca49d8a513fe3

    • SHA512

      a59e428fbd2913e3abb1827f42484a73b0e85de9f0a020fb794cc4d2c2ac10db59dc0b4469bb8c77bdbf8f3b4a8ccbb8378c8d10635e02abc81a45924531f55f

    Score
    9/10
    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks