hawkeye

General

Target

a4594e8cc648bdc34cce2219f26bf545eb8a42a3258925284c713475bc0650de
Size

985KB
Sample

220312-cxjtcaedb9
MD5

f1e0daaf0391d14802503dfc1765ed79
SHA1

d358b88991e4eb16df13938ecabf90bbc15215ff
SHA256

a4594e8cc648bdc34cce2219f26bf545eb8a42a3258925284c713475bc0650de
SHA512

66e582fcaea00df8296682e4fdce72890f2a4c0ea831848e1c430849e1fd9ea5bc9a68b74a24cdabc6301a9db5da26650a15b1eac8151d1542a939b3ea512ced

Score

10^/10

Malware Config

Targets

- Target
  
  a4594e8cc648bdc34cce2219f26bf545eb8a42a3258925284c713475bc0650de
- Size
  
  985KB
- MD5
  
  f1e0daaf0391d14802503dfc1765ed79
- SHA1
  
  d358b88991e4eb16df13938ecabf90bbc15215ff
- SHA256
  
  a4594e8cc648bdc34cce2219f26bf545eb8a42a3258925284c713475bc0650de
- SHA512
  
  66e582fcaea00df8296682e4fdce72890f2a4c0ea831848e1c430849e1fd9ea5bc9a68b74a24cdabc6301a9db5da26650a15b1eac8151d1542a939b3ea512ced
Score

10^/10

hawkeye revengerat collection keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- RevengeRat Executable
  stealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2