hawkeye_reborn | 1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325

General

Target

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325
Size

824KB
Sample

220608-dq42daefcp
MD5

2576c26966ac131a4b4b036e910ee309
SHA1

fe4260b5e6242f44ce852b088b6e91adebd889d2
SHA256

1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325
SHA512

4f02d71d633d9d280f2d420c14340ece36112046ed93b857d10901ac2c094fd9a00848abbedb15b051d63fe51dad904914a23c03e2750472a285825c51aeea26

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Targets

- Target
  
  1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325
- Size
  
  824KB
- MD5
  
  2576c26966ac131a4b4b036e910ee309
- SHA1
  
  fe4260b5e6242f44ce852b088b6e91adebd889d2
- SHA256
  
  1a726023836851ed0df4161b58abda0261261007b67d3f6aef2fd7765de3b325
- SHA512
  
  4f02d71d633d9d280f2d420c14340ece36112046ed93b857d10901ac2c094fd9a00848abbedb15b051d63fe51dad904914a23c03e2750472a285825c51aeea26
Score

10^/10

hawkeye_reborn m00nd3v_logger agilenet infostealer keylogger persistence spyware stealer trojan collection
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger Payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2