Overview

overview

10

Static

static

c526c99131...b8.exe

windows7-x64

10

c526c99131...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c526c99131d2b0de4cbd2a8d1f4bd8d920521c0dd0715d0919cd9a79d11968b8

  • Size

    797KB

  • Sample

    220725-c46xfsbcc4

  • MD5

    ae1f24e0d12029fc5e7e51cc1c90f722

  • SHA1

    220a564d2d066ceb698becef6f4de6ef0432ed72

  • SHA256

    c526c99131d2b0de4cbd2a8d1f4bd8d920521c0dd0715d0919cd9a79d11968b8

  • SHA512

    a72ee37227c30d9e3486664e5fcfa8d3d197fa8829c888ac0870e7349bf8fa609d4ba9bdc76df9220ef915e5d1b7bb2170ea5ebebd3598323ef26bd494b5f336

Score
10/10
hawkeye_rebornm00nd3v_loggercollectioninfostealerkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    hongngoc@cleansfood.com
  • Password:
    biggod1234
Mutex

446f0307-6387-474d-bee7-64d3f6e89d65

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:biggod1234 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:hongngoc@cleansfood.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:446f0307-6387-474d-bee7-64d3f6e89d65 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

    • Target

      c526c99131d2b0de4cbd2a8d1f4bd8d920521c0dd0715d0919cd9a79d11968b8

    • Size

      797KB

    • MD5

      ae1f24e0d12029fc5e7e51cc1c90f722

    • SHA1

      220a564d2d066ceb698becef6f4de6ef0432ed72

    • SHA256

      c526c99131d2b0de4cbd2a8d1f4bd8d920521c0dd0715d0919cd9a79d11968b8

    • SHA512

      a72ee37227c30d9e3486664e5fcfa8d3d197fa8829c888ac0870e7349bf8fa609d4ba9bdc76df9220ef915e5d1b7bb2170ea5ebebd3598323ef26bd494b5f336

    Score
    10/10
    hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojancollection

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarem00nd3v_logger

    • M00nD3v Logger payload

      Detects M00nD3v Logger payload in memory.

      infostealer

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.