Extracted

Extracted

• • Target

    d1050ecae55aa83cfdaf595b29e3028d0a5964aa8f285e92d8a980f001d33169

  • Size

    1.3MB

  • MD5

    d95dad4b055594d2bb0a33fb96a72fb4

  • SHA1

    18c95e82c43fe78fd9685f165acda3e3b9963795

  • SHA256

    d1050ecae55aa83cfdaf595b29e3028d0a5964aa8f285e92d8a980f001d33169

  • SHA512

    131e61ed8312737d2100d343bb5418ba430983faaf49592095f739525020e01a866f06b0624e19c7f8f1a271fd5368c206169593a61da1afad88d6a0e020193e

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggercollectioninfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2