Overview

overview

10

Static

static

scan002383...df.exe

windows7_x64

10

scan002383...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    289fa0412fadf3775429d27cbe5434cca821ff908a7e635c28262aeabe601baa

  • Size

    527KB

  • Sample

    220615-vhv7yabcd3

  • MD5

    41c0cb18e341075ad6b01288c72d9878

  • SHA1

    b516c9a26bde5497c0b1948f732c23ecf23f8fe7

  • SHA256

    289fa0412fadf3775429d27cbe5434cca821ff908a7e635c28262aeabe601baa

  • SHA512

    79c5ac5a5b4a1f8ad7364069825510e0fc7aabb16815b5f59f7583e30049e85b0cc5b01a7ed5f518b5372825852eb37f00ab915a5e0848ad5da98de04c442c98

Score
10/10
hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      scan00238393903,pdf.exe

    • Size

      594KB

    • MD5

      48140b427e5241a5a806bbb0b925b7d2

    • SHA1

      772d2f450c44f05ac4132d7c9cb8b72e5e54332c

    • SHA256

      ae72463f201a18d30960ea34ec664a5e30f2889fef997bd020eb73f83b0a9593

    • SHA512

      ecd026fc3a7aeb5baeabd811c15b279773a4c51457525b72baa1437231d523889596b2b4905c68cbdaedb7045404b878984bf94fee006e1e71435ac7ac8bdcb3

    Score
    10/10
    hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarem00nd3v_logger

    • M00nD3v Logger Payload

      Detects M00nD3v Logger payload in memory.

      infostealer

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks