General

  • Target

    ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f

  • Size

    552KB

  • Sample

    220314-pd98eahaal

  • MD5

    1963a2ebcb06a50b355783ec0f2e6fee

  • SHA1

    48b6b4a8ece0683e203727f34afe371b376b0dcf

  • SHA256

    ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f

  • SHA512

    450ae811891338754af880886c62e4015dfff6f0376d1b42ef067e3f735afe478b0985a81c005096c58933181040b9d0cdd644610b1d7800f806cf10aa489eed

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f

    • Size

      552KB

    • MD5

      1963a2ebcb06a50b355783ec0f2e6fee

    • SHA1

      48b6b4a8ece0683e203727f34afe371b376b0dcf

    • SHA256

      ca8073cdeb4f3cca2e21faf93496b5fbabb6ebb3c42477ce0d7e6c077cedf93f

    • SHA512

      450ae811891338754af880886c62e4015dfff6f0376d1b42ef067e3f735afe478b0985a81c005096c58933181040b9d0cdd644610b1d7800f806cf10aa489eed

    Score
    9/10
    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks