Overview

overview

10

Static

static

582ee16dbf...94.exe

windows7-x64

10

582ee16dbf...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    582ee16dbf4cd83474afb0bacdc27369aed7214cb2972e7aa2026860dabbad94

  • Size

    773KB

  • Sample

    220724-tnp3faabh2

  • MD5

    847ebb85ec30a8d241155a181e772406

  • SHA1

    ccf35f05ee42e72c8e61aa19de10000c312ce47a

  • SHA256

    582ee16dbf4cd83474afb0bacdc27369aed7214cb2972e7aa2026860dabbad94

  • SHA512

    afbf0e6b596ce937b4da95f5c0d3ca4470701f0bb860143a57e690e31c8c3c676e454f58922e87d12bcab279808f1c806320766ad135c0e2145e1fe158f5448b

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    andrea.santox@yandex.com
  • Password:
    Thiago!!!

Targets

    • Target

      582ee16dbf4cd83474afb0bacdc27369aed7214cb2972e7aa2026860dabbad94

    • Size

      773KB

    • MD5

      847ebb85ec30a8d241155a181e772406

    • SHA1

      ccf35f05ee42e72c8e61aa19de10000c312ce47a

    • SHA256

      582ee16dbf4cd83474afb0bacdc27369aed7214cb2972e7aa2026860dabbad94

    • SHA512

      afbf0e6b596ce937b4da95f5c0d3ca4470701f0bb860143a57e690e31c8c3c676e454f58922e87d12bcab279808f1c806320766ad135c0e2145e1fe158f5448b

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks