General

  • Target

    c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377

  • Size

    552KB

  • Sample

    220314-qjtchshfeq

  • MD5

    88c5d1b523842958a8f618e8fd1ca40d

  • SHA1

    a0dcaf8db3fe12902827a4feef40486a5edd92e9

  • SHA256

    c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377

  • SHA512

    da9ae58ab8218982462f324505b906d19addde8b0da20bfc0dff80b58adb6dcae0614e77e0ba6df74c9d43edc5ee1ffc5557831f20c968e8f7e87b7c3ae3c4af

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377

    • Size

      552KB

    • MD5

      88c5d1b523842958a8f618e8fd1ca40d

    • SHA1

      a0dcaf8db3fe12902827a4feef40486a5edd92e9

    • SHA256

      c6dca612733df58acbb44521906203c0720bd0a74b553ebf44864edf938fe377

    • SHA512

      da9ae58ab8218982462f324505b906d19addde8b0da20bfc0dff80b58adb6dcae0614e77e0ba6df74c9d43edc5ee1ffc5557831f20c968e8f7e87b7c3ae3c4af

    Score
    9/10
    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks