Overview

overview

10

Static

static

O729202098...DF.exe

windows7_x64

10

O729202098...DF.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88194c9e2e3a3159f19558a93ab684d8545539baec3873c73aa1afe104c89a58

  • Size

    681KB

  • Sample

    220521-ag438sdbcq

  • MD5

    7e1244ba265f4433ecb8b6dd99f83f05

  • SHA1

    fa22d3f0026b18d76e110764447953d490adbf8a

  • SHA256

    88194c9e2e3a3159f19558a93ab684d8545539baec3873c73aa1afe104c89a58

  • SHA512

    e7a01cc95e0318c5c4919c71f09898934c53d35ad36e98520db3b8fc3bc67d15c443f2cbc03c7323f3ef305bcfd561c7ea3521028362de67a8d993cba1bb4051

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      O7292020987725545.PDF.exe

    • Size

      784KB

    • MD5

      ea1fd15ccebbaf20b2d2c20e59289e2c

    • SHA1

      6c6fa518ea45ecefb182e7906aad81fc77b8bb4f

    • SHA256

      814a5dc8dbe791a8e554c6823eedb3b4e9bfcd1006901df2f3468f71d1dd8437

    • SHA512

      42143fa1befcf6afa28f454677963f509c9e044fbd26a0043659422cc009c1555b9a221d3a15fe2fd96b218c9a8e390e70cea4bdef00a0e30ba049babb4bb9d7

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks