hawkeye_reborn | fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6

General

Target

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6
Size

2.0MB
Sample

220724-zqwkwsgag2
MD5

83aebff419895e406911862d5ee7a029
SHA1

2d5545557538754a98258dc4cbf6af55fb065808
SHA256

fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6
SHA512

ff3817928467ebad1821fad2d319d22a374863a0c3bbb70a5e2babf9256968fb427f9f7455f85dd506d3ac260eaa2ce177cdd64f998fabc40dbb57e6b8a7a1fa

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: ftp
Host:
ftp.sventiskai.lt
Port:
21
Username:
[email protected]
Password:
bathram0123

Mutex

5c11938b-5cda-4e44-b703-c5960eef7ac8

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:bathram0123 _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.sventiskai.lt _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:43800 _MeltFile:false _Mutex:5c11938b-5cda-4e44-b703-c5960eef7ac8 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6
- Size
  
  2.0MB
- MD5
  
  83aebff419895e406911862d5ee7a029
- SHA1
  
  2d5545557538754a98258dc4cbf6af55fb065808
- SHA256
  
  fa494cb8c439fadfb6b67ed491513aa3c2fa1dfb4e0d03769ad909407a3b81f6
- SHA512
  
  ff3817928467ebad1821fad2d319d22a374863a0c3bbb70a5e2babf9256968fb427f9f7455f85dd506d3ac260eaa2ce177cdd64f998fabc40dbb57e6b8a7a1fa
Score

10^/10

m00nd3v_logger infostealer spyware stealer hawkeye_reborn collection keylogger trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2