hawkeye | 8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919 | Triage

Submit
Reports

Overview

overview

Static

static

8ce8ce097b...19.exe

windows7-x64

8ce8ce097b...19.exe

windows10-2004-x64

Sharing

General

Target

8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919
Size

380KB
Sample

221122-w33yyscg85
MD5

96949aa353cf2a1c4f638d1c4e787513
SHA1

56e9551ebe76a092e4b65f2721fd402ed5c17d45
SHA256

8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919
SHA512

bf372cb7fda028d2cd1c954308c14a14893475de3a29acf38291a088d0248c2c77c24f0f60881719de33906ddd7be3c668a85f0e9bcea71bade47c4001dd0edc
SSDEEP

6144:XD9OCbxXkQo+5KvQyDc+8VTxCtiAtnbFbC/8D9zaj4vT31KRM5gdaYKlGq6+VnFH:zwCXNh8Iy4+8Tm1tW8DdJKRMGdaQqrnF

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919.exe

Resource

win7-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919.exe

Resource

win10v2004-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919
- Size
  
  380KB
- MD5
  
  96949aa353cf2a1c4f638d1c4e787513
- SHA1
  
  56e9551ebe76a092e4b65f2721fd402ed5c17d45
- SHA256
  
  8ce8ce097b483b6a971f5df8fbfbba2b7936f9089f41ea7d958a45246b616919
- SHA512
  
  bf372cb7fda028d2cd1c954308c14a14893475de3a29acf38291a088d0248c2c77c24f0f60881719de33906ddd7be3c668a85f0e9bcea71bade47c4001dd0edc
- SSDEEP
  
  6144:XD9OCbxXkQo+5KvQyDc+8VTxCtiAtnbFbC/8D9zaj4vT31KRM5gdaYKlGq6+VnFH:zwCXNh8Iy4+8Tm1tW8DdJKRMGdaQqrnF
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy