hawkeye_reborn | b40dc507aa36ecaf42aab34ccb8db8e0bb8922399d90f42184ba1b7e4168d3fe

General

Target

b40dc507aa36ecaf42aab34ccb8db8e0bb8922399d90f42184ba1b7e4168d3fe
Size

714KB
Sample

220731-kg362sgdd8
MD5

86ecc60aa57528f4eb2489eb45024208
SHA1

6756f16b87ac575539bea52de65a0341dc4e4747
SHA256

b40dc507aa36ecaf42aab34ccb8db8e0bb8922399d90f42184ba1b7e4168d3fe
SHA512

c6c40836eab2564349a92f19bfb82464ec5900e2344d2dfecc395fd4e4a4f5626a97d09e0db8ab4bd9857032c881202dc7e33ded2f700e36b06abfe73fbd3482

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
doggy@blessedinc.xyz
Password:
okpfunds654

Mutex

2375eb41-6771-495b-bda7-62e3349cedf7

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:okpfunds654 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:doggy@blessedinc.xyz _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:2375eb41-6771-495b-bda7-62e3349cedf7 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  b40dc507aa36ecaf42aab34ccb8db8e0bb8922399d90f42184ba1b7e4168d3fe
- Size
  
  714KB
- MD5
  
  86ecc60aa57528f4eb2489eb45024208
- SHA1
  
  6756f16b87ac575539bea52de65a0341dc4e4747
- SHA256
  
  b40dc507aa36ecaf42aab34ccb8db8e0bb8922399d90f42184ba1b7e4168d3fe
- SHA512
  
  c6c40836eab2564349a92f19bfb82464ec5900e2344d2dfecc395fd4e4a4f5626a97d09e0db8ab4bd9857032c881202dc7e33ded2f700e36b06abfe73fbd3482
Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan collection
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

We care about your privacy.