Extracted

Extracted

Extracted

• • Target

    5420a4b5bde081383f5cd023e5e270fa940f066087b83ada3e290550fd27f330

  • Size

    1.1MB

  • MD5

    17317e485baaee24963ba10b4fbb02de

  • SHA1

    b738ea496f24c0bf920dcd662047880fb880630f

  • SHA256

    5420a4b5bde081383f5cd023e5e270fa940f066087b83ada3e290550fd27f330

  • SHA512

    6b245005c6dfbfaa85f349041bdc42f6d77f5bc0b6c8d81134b3d8049a029aa4b933eb7eb8ff3d0cb015440c1a0c0682e7bd53644f0952ddfc2090f532d99065

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggernetwirebotnetinfostealerkeyloggerratspywarestealertrojancollection

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2