General

  • Target

    de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7

  • Size

    552KB

  • Sample

    220314-a64h1adbeq

  • MD5

    e6a57cad9a7f340a0f1eba302f942c9e

  • SHA1

    936249c0e6984a59ad8da4a7340e95f5c6902e70

  • SHA256

    de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7

  • SHA512

    afff394ac4ffae6657875eb575b1b050109a30e794ad639e06e8edbc0da99bf645e751082b2e333775c9fce86172bd665c1b8a59462a7255927c8cd135426d84

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7

    • Size

      552KB

    • MD5

      e6a57cad9a7f340a0f1eba302f942c9e

    • SHA1

      936249c0e6984a59ad8da4a7340e95f5c6902e70

    • SHA256

      de6e3a18158cf76909a5b39996ac3b1231aa336e9715ec92451a00fd972e10b7

    • SHA512

      afff394ac4ffae6657875eb575b1b050109a30e794ad639e06e8edbc0da99bf645e751082b2e333775c9fce86172bd665c1b8a59462a7255927c8cd135426d84

    Score
    9/10
    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks