Extracted

• • Target

    scan00238393903,pdf.exe

  • Size

    594KB

  • MD5

    48140b427e5241a5a806bbb0b925b7d2

  • SHA1

    772d2f450c44f05ac4132d7c9cb8b72e5e54332c

  • SHA256

    ae72463f201a18d30960ea34ec664a5e30f2889fef997bd020eb73f83b0a9593

  • SHA512

    ecd026fc3a7aeb5baeabd811c15b279773a4c51457525b72baa1437231d523889596b2b4905c68cbdaedb7045404b878984bf94fee006e1e71435ac7ac8bdcb3

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger Payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2