hawkeye_reborn | 57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3

General

Target

57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3
Size

1.5MB
Sample

220724-yfqffsecdq
MD5

f715f1684b2e0af14e6fd3013c2d8916
SHA1

8909fe915a19e5f42d46034847671bcfb087c6db
SHA256

57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3
SHA512

6062be4f9bd466257fa1dc57c931e8b9e00a3eeec3d33b5ebc35098a401348fd61f53efef6302b786e628c173f77af58907f972d41b5ebcc1f0fc4e4477096dd

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Mutex

10fc6c49-5a08-4d6d-9fd8-637c88d50362

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:3 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:10fc6c49-5a08-4d6d-9fd8-637c88d50362 _PanelSecret:521199b4-129c-520c-7e7e-4e9dbcf49467 _PanelURL:http://grindtreue.online/raz/ _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3
- Size
  
  1.5MB
- MD5
  
  f715f1684b2e0af14e6fd3013c2d8916
- SHA1
  
  8909fe915a19e5f42d46034847671bcfb087c6db
- SHA256
  
  57d53e6dcc25506afd94867438980c7ac0e1ad194c3b4cc1f4e9ee6f0ef475f3
- SHA512
  
  6062be4f9bd466257fa1dc57c931e8b9e00a3eeec3d33b5ebc35098a401348fd61f53efef6302b786e628c173f77af58907f972d41b5ebcc1f0fc4e4477096dd
Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan upx
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

UPX packed file

Drops startup file

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2