Overview

overview

10

Static

static

ac03353f0e...e8.zip

windows7_x64

1

ac03353f0e...e8.zip

windows10-2004_x64

1

scan002383...df.exe

windows7_x64

10

scan002383...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac03353f0ee1e9305418c42b3abe85bcd93b610d75aa4ed6a511ad80efbd58e8

  • Size

    527KB

  • Sample

    220615-vhvleageak

  • MD5

    742f846f88f625a6cbd3449b8170fb6a

  • SHA1

    f282a5560b9cb2294bb50871c07aebb5bf6530db

  • SHA256

    ac03353f0ee1e9305418c42b3abe85bcd93b610d75aa4ed6a511ad80efbd58e8

  • SHA512

    f9b842d4755cf50c2cdc2f201aa4274772744b2195c85dca70c0c16f4df36c22e1c079a90dff019922c2145a7ba0672ce751dee4f738dfc10645ffe751101946

Score
10/10
hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      ac03353f0ee1e9305418c42b3abe85bcd93b610d75aa4ed6a511ad80efbd58e8

    • Size

      527KB

    • MD5

      742f846f88f625a6cbd3449b8170fb6a

    • SHA1

      f282a5560b9cb2294bb50871c07aebb5bf6530db

    • SHA256

      ac03353f0ee1e9305418c42b3abe85bcd93b610d75aa4ed6a511ad80efbd58e8

    • SHA512

      f9b842d4755cf50c2cdc2f201aa4274772744b2195c85dca70c0c16f4df36c22e1c079a90dff019922c2145a7ba0672ce751dee4f738dfc10645ffe751101946

    Score
    1/10
    behavioral1behavioral2

    • Target

      scan00238393903,pdf.exe

    • Size

      594KB

    • MD5

      48140b427e5241a5a806bbb0b925b7d2

    • SHA1

      772d2f450c44f05ac4132d7c9cb8b72e5e54332c

    • SHA256

      ae72463f201a18d30960ea34ec664a5e30f2889fef997bd020eb73f83b0a9593

    • SHA512

      ecd026fc3a7aeb5baeabd811c15b279773a4c51457525b72baa1437231d523889596b2b4905c68cbdaedb7045404b878984bf94fee006e1e71435ac7ac8bdcb3

    Score
    10/10
    hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarem00nd3v_logger

    • M00nD3v Logger Payload

      Detects M00nD3v Logger payload in memory.

      infostealer

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks