Extracted

Extracted

• • Target

    522ec4c87221e3f7047ee0fe3eeee288eab1298a7abf950120294e3a21e23b9f

  • Size

    1.3MB

  • MD5

    5e01622448297de584b36419c58a5cad

  • SHA1

    41666daf497c2997e0c326a22a0d87d2d421e602

  • SHA256

    522ec4c87221e3f7047ee0fe3eeee288eab1298a7abf950120294e3a21e23b9f

  • SHA512

    a7cb35c81d272d0218cdfe6ae46484bc993049a19a78275876ef2512107bca738c548779845a7e20f51714e6181ad6181e40382424e01007a66d730265020a44

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggercollectioninfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2