General

  • Target

    c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f

  • Size

    552KB

  • Sample

    220314-rpmycsgde3

  • MD5

    498cf1b9adf3cf749e10b4dd624af0ce

  • SHA1

    f6b7784c7adf568fc20fbb25d22a664d53abfbbe

  • SHA256

    c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f

  • SHA512

    1c6bf0d15dd17c69fb32cf0e3bedb45a1e34cd8c045340cbc94e1a0ee3ea85c01e5522acd05b57fc98ab5c8dcaa7d2b57319ccf28c88af19661fd6cc38957d36

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f

    • Size

      552KB

    • MD5

      498cf1b9adf3cf749e10b4dd624af0ce

    • SHA1

      f6b7784c7adf568fc20fbb25d22a664d53abfbbe

    • SHA256

      c31d9d79d78039d830bdf92e36d8fe905237c883864a2ce795e97219eb64963f

    • SHA512

      1c6bf0d15dd17c69fb32cf0e3bedb45a1e34cd8c045340cbc94e1a0ee3ea85c01e5522acd05b57fc98ab5c8dcaa7d2b57319ccf28c88af19661fd6cc38957d36

    Score
    9/10
    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks