Extracted

• • Target

    12ea87a0cb19ce067aab71b015a08e252be1a2e1dc6198438ffe8d917b17a945

  • Size

    805KB

  • MD5

    4337923547cb41e7154154dde5b24a8b

  • SHA1

    3df315533ef1a9a72eaee16b7feb21f8a7f316f3

  • SHA256

    12ea87a0cb19ce067aab71b015a08e252be1a2e1dc6198438ffe8d917b17a945

  • SHA512

    af074e5809bd0908a302e45af481ab7ec70bcf1db0096e30618fae4bfc1b887142a189924a527e1da6ad7246c4a664964e42f5e831b108fc77d55431ffde9332

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger Payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2