Extracted

• • Target
    9b8ec9e094676d88b02f038f318afd86
  • Size 648KB
  • SHA256 54fa4651e925e0fd845ca5652d57a010c26e4ab799211b8d3299cbb7dec35ae8
  • MD5 9b8ec9e094676d88b02f038f318afd86
  • SHA1 65f99e529982f1c1a5cf9eb59f60edfeecdf2eec
  • SHA512 adda29b5ad3a05f9d34ba4a033cc400d9d45cf82887ac292f7174b3853a2d0edddecee939f32ab784e4c2e4cc58631e7bb5137d353546f5024cb7a402e4bd4b8
  • MD5 SHA1 SHA512

  Score

  10^/10

  hawkeyecollectionkeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2