hawkeye_reborn | 3237150c0e5eafa032604dc03b7517e5ebb333287bfd1c4e9c507edaad37f174

General

Target

3237150c0e5eafa032604dc03b7517e5ebb333287bfd1c4e9c507edaad37f174
Size

772KB
Sample

220620-jkcyladbb5
MD5

ca9c2913e35c74a38b7f8ece1cb17785
SHA1

15e2e333efb22376e11e7983aa85b70a1875eb19
SHA256

3237150c0e5eafa032604dc03b7517e5ebb333287bfd1c4e9c507edaad37f174
SHA512

dd675a29e4436e294824aba0384985c874269e93a25ee0836edc5e17d294d48a47b81e9a0627a93d863f556aa627c2aa2672e7aeba6db5683c0df361005f224f

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.0.5

Credentials

Protocol: smtp
Host:
mail.123tracein.com
Port:
587
Username:
[email protected]
Password:
Vvt.5rffGwtH

Mutex

50d9bce9-6693-4df8-986d-11678ab9d9c5

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Vvt.5rffGwtH _EmailPort:587 _EmailSSL:true _EmailServer:mail.123tracein.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:30 _MeltFile:false _Mutex:50d9bce9-6693-4df8-986d-11678ab9d9c5 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:true _Version:9.0.0.5 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.0.5, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  3237150c0e5eafa032604dc03b7517e5ebb333287bfd1c4e9c507edaad37f174
- Size
  
  772KB
- MD5
  
  ca9c2913e35c74a38b7f8ece1cb17785
- SHA1
  
  15e2e333efb22376e11e7983aa85b70a1875eb19
- SHA256
  
  3237150c0e5eafa032604dc03b7517e5ebb333287bfd1c4e9c507edaad37f174
- SHA512
  
  dd675a29e4436e294824aba0384985c874269e93a25ee0836edc5e17d294d48a47b81e9a0627a93d863f556aa627c2aa2672e7aeba6db5683c0df361005f224f
Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger Payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger Payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2