Overview

overview

10

Static

static

2eef092f26...53.exe

windows7-x64

10

2eef092f26...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2eef092f260720c97156d265a118272ef905723e4673250b1a4b61dbd8a07e53

  • Size

    372KB

  • Sample

    221003-cz9sjscdc3

  • MD5

    a3dc0f8557940ed10e37c32369d4f36d

  • SHA1

    8a023d2762210836ee6746b9490aac06dfa1d104

  • SHA256

    2eef092f260720c97156d265a118272ef905723e4673250b1a4b61dbd8a07e53

  • SHA512

    9f8883454d5c49412cf9fc2aee2ad6996844cdc43b061af32abd3b25f0a04ad0d6e5af3aee814cb8303a61519eefdf785bffc89d1295accbd8f3c342db44d23b

  • SSDEEP

    6144:x+1xwEHGjcswWIc340iGxm6DQM8aQNSp9I7xuh+ZbZbSDvC0bQHeTJnZC:c1x37swRc34Qm6sM8a9U7fjbSDvq+TJE

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      2eef092f260720c97156d265a118272ef905723e4673250b1a4b61dbd8a07e53

    • Size

      372KB

    • MD5

      a3dc0f8557940ed10e37c32369d4f36d

    • SHA1

      8a023d2762210836ee6746b9490aac06dfa1d104

    • SHA256

      2eef092f260720c97156d265a118272ef905723e4673250b1a4b61dbd8a07e53

    • SHA512

      9f8883454d5c49412cf9fc2aee2ad6996844cdc43b061af32abd3b25f0a04ad0d6e5af3aee814cb8303a61519eefdf785bffc89d1295accbd8f3c342db44d23b

    • SSDEEP

      6144:x+1xwEHGjcswWIc340iGxm6DQM8aQNSp9I7xuh+ZbZbSDvC0bQHeTJnZC:c1x37swRc34Qm6sM8a9U7fjbSDvq+TJE

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks