Extracted

• • Target

    56ac3350eb5e17ea5fb0a3018db0b6cfd3ae40dba2b12c1c8e70ca7ef407b38d

  • Size

    783KB

  • MD5

    63e9deac74a65e00c0c75dce31676601

  • SHA1

    6876c5e36a85aa066370fc417be0703b88bbdb9a

  • SHA256

    56ac3350eb5e17ea5fb0a3018db0b6cfd3ae40dba2b12c1c8e70ca7ef407b38d

  • SHA512

    56fce3eb77f81edc8bf4e7b3038fb63bf9abce5a07fe3a869fe3a60266e74523026ce01f369570b328745ea8d1e8db14dd73c29e1b94af00c1fe6fe1471af2df

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojancollection

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2