hawkeye | c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963 | Triage

Submit
Reports

Overview

overview

Static

static

c5de65fbf6...63.exe

windows7-x64

c5de65fbf6...63.exe

windows10-2004-x64

Sharing

General

Target

c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963
Size

503KB
Sample

221122-wm3cgscb95
MD5

77c1b10e325f91b4d8eecad678061e1e
SHA1

7803954a678a6bb46b24c85d6c2cd8e8d40d021b
SHA256

c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963
SHA512

36c163cff89a37e9e67412bfe66bd54a0af8df6175d8455e10931a426539e14bbd7bc83c51c6439a8b2ae4eba692ae757a94299dbd667cb4030aed643fa2b0ce
SSDEEP

6144:CbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx97HD:CQtqB5urTIoYWBQk1E+VF9mOx9v

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963.exe

Resource

win7-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963.exe

Resource

win10v2004-20220901-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963
- Size
  
  503KB
- MD5
  
  77c1b10e325f91b4d8eecad678061e1e
- SHA1
  
  7803954a678a6bb46b24c85d6c2cd8e8d40d021b
- SHA256
  
  c5de65fbf6896547ac145dab976f10375d4e209d53369a5ff3dbef870174c963
- SHA512
  
  36c163cff89a37e9e67412bfe66bd54a0af8df6175d8455e10931a426539e14bbd7bc83c51c6439a8b2ae4eba692ae757a94299dbd667cb4030aed643fa2b0ce
- SSDEEP
  
  6144:CbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx97HD:CQtqB5urTIoYWBQk1E+VF9mOx9v
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy