Extracted

• • Target

    04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc

  • Size

    817KB

  • MD5

    8d914bfb5f45b53628eb5e6956a696d2

  • SHA1

    fb8e636a77c99f508f9193027bc5da24e712dabc

  • SHA256

    04dd071c5cb9fb78ad922c1d19ae97bfe32583c210758cb2fa8f91ed2b7fdcbc

  • SHA512

    0c5e86dc0b39bd57566ee12c85ac7fb0418f5cc2fa1bcf5e39ee23f73368c76111c8688dd312cf16ab35d75ada5c21afee8b1874777a7b04e986f487de182db3

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger Payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2