hawkeye_reborn | 3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92

General

Target

3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92
Size

813KB
Sample

220703-ehtq4sgca3
MD5

be04d13e880984969b6d7eb4faf58a50
SHA1

815223967c0f594e4834dd58abf4ec87a57c53ec
SHA256

3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92
SHA512

bb19f6a902d68fbcae1a21394b10b9cc159fe6c87874b7fe8f8577197f86fd14a2f8f6a6938870e65063b199a320f7648bb3fd6f3cd9e8812c0c63be11b0e8c4

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Targets

- Target
  
  3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92
- Size
  
  813KB
- MD5
  
  be04d13e880984969b6d7eb4faf58a50
- SHA1
  
  815223967c0f594e4834dd58abf4ec87a57c53ec
- SHA256
  
  3d308772c193701b7f16aa6386469d4cd3aa61368818095e19cd88e3f16abe92
- SHA512
  
  bb19f6a902d68fbcae1a21394b10b9cc159fe6c87874b7fe8f8577197f86fd14a2f8f6a6938870e65063b199a320f7648bb3fd6f3cd9e8812c0c63be11b0e8c4
Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger persistence spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger Payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger Payload

Sets file execution options in registry

Loads dropped DLL

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2