General

  • Target

    a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24

  • Size

    552KB

  • Sample

    220312-eapr7aabbl

  • MD5

    9bc01aec43d14db349fae9a179f78f46

  • SHA1

    036efd5ee8f97e50909ec23c7e893d05d972b0e0

  • SHA256

    a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24

  • SHA512

    3d664a27fd7c9c173b2d3badd965c547f859559036fbeae4c144c0ee8ed5767694b2bf6daa9b122a9c2a80a8ac5f1c125c4ede8e8a2fbaed46cd89fa2cc1b185

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24

    • Size

      552KB

    • MD5

      9bc01aec43d14db349fae9a179f78f46

    • SHA1

      036efd5ee8f97e50909ec23c7e893d05d972b0e0

    • SHA256

      a03265120455f990fb05315ce049ed641c7fb5a62a07e29d904e53f4df5a7b24

    • SHA512

      3d664a27fd7c9c173b2d3badd965c547f859559036fbeae4c144c0ee8ed5767694b2bf6daa9b122a9c2a80a8ac5f1c125c4ede8e8a2fbaed46cd89fa2cc1b185

    Score
    9/10
    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks