hawkeye_reborn | 26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0

General

Target

26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0
Size

1.2MB
Sample

220708-tnmbjshddm
MD5

b5c62f489422f627cff6c315b8556a2f
SHA1

afbef151e8d4037c68c00c51094aadf2d733b136
SHA256

26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0
SHA512

18ec6e684301732d94f018438174939eaf6681328f567a6659a74c380eb389f5510bbbd6c9151276ad1a110c4cd61b6e05f63986b642d7190cf364ced7e97d4d

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.jointexbd.com
Port:
587
Username:
[email protected]
Password:
Jkwl#2018

Mutex

4f444b86-60f0-4ef5-ac81-fd992cbc807c

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Jkwl#2018 _EmailPort:587 _EmailSSL:true _EmailServer:mail.jointexbd.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:45 _MeltFile:false _Mutex:4f444b86-60f0-4ef5-ac81-fd992cbc807c _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0
- Size
  
  1.2MB
- MD5
  
  b5c62f489422f627cff6c315b8556a2f
- SHA1
  
  afbef151e8d4037c68c00c51094aadf2d733b136
- SHA256
  
  26c064928cc325512536187c4fd8a4d950763ebaf6c55799ba91c7ee7349fbd0
- SHA512
  
  18ec6e684301732d94f018438174939eaf6681328f567a6659a74c380eb389f5510bbbd6c9151276ad1a110c4cd61b6e05f63986b642d7190cf364ced7e97d4d
Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan upx
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Executes dropped EXE

UPX packed file

Loads dropped DLL

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2