hawkeye | c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48 | Triage

Submit
Reports

Overview

overview

Static

static

c9f178d143...48.exe

windows7-x64

c9f178d143...48.exe

windows10-2004-x64

Sharing

General

Target

c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48
Size

502KB
Sample

221122-wl45paff6y
MD5

e7afa2112e90467843e82b2bf9adea14
SHA1

ecd7f5ef00b83da12b3d9db8368790d026efbd34
SHA256

c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48
SHA512

295108ee7b8d591536b719d6326214defb03e461f897a51d19f744bb159088a890fe5bb50025a763c43e7a24c38ad267171b28ff411dd2417fe5f6242e21471a
SSDEEP

6144:mbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx93Hw:mQtqB5urTIoYWBQk1E+VF9mOx9g

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48
- Size
  
  502KB
- MD5
  
  e7afa2112e90467843e82b2bf9adea14
- SHA1
  
  ecd7f5ef00b83da12b3d9db8368790d026efbd34
- SHA256
  
  c9f178d143b96fba8cbe62558705fed90d467ee8088206b813681acb8fc0ce48
- SHA512
  
  295108ee7b8d591536b719d6326214defb03e461f897a51d19f744bb159088a890fe5bb50025a763c43e7a24c38ad267171b28ff411dd2417fe5f6242e21471a
- SSDEEP
  
  6144:mbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx93Hw:mQtqB5urTIoYWBQk1E+VF9mOx9g
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy