hawkeye | 79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed | Triage

Submit
Reports

Overview

overview

Static

static

79d9c2e706...ed.exe

windows7-x64

79d9c2e706...ed.exe

windows10-2004-x64

Sharing

General

Target

79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed
Size

502KB
Sample

221122-w8a55ada48
MD5

9ed5b01e66e266a32e1792e5206e6502
SHA1

c41ac44cbee929c46a937a81a0b9016232f1dbbf
SHA256

79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed
SHA512

39f4e2302db8c404dd61245bf94c490f9d0ecbcae4e55bd936a5f4d6211da12d99a68eff0632eb637a0f1bbb419334b52e881ab1fb27dd1fefc2c20da2140fdc
SSDEEP

6144:EbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx97HD:EQtqB5urTIoYWBQk1E+VF9mOx9v

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed
- Size
  
  502KB
- MD5
  
  9ed5b01e66e266a32e1792e5206e6502
- SHA1
  
  c41ac44cbee929c46a937a81a0b9016232f1dbbf
- SHA256
  
  79d9c2e7068c5f2ad3423b5ea33025116bda2255e473b9c68275e614410dabed
- SHA512
  
  39f4e2302db8c404dd61245bf94c490f9d0ecbcae4e55bd936a5f4d6211da12d99a68eff0632eb637a0f1bbb419334b52e881ab1fb27dd1fefc2c20da2140fdc
- SSDEEP
  
  6144:EbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx97HD:EQtqB5urTIoYWBQk1E+VF9mOx9v
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy