hawkeye | 6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f | Triage

Submit
Reports

Overview

overview

Static

static

6e711c7305...7f.exe

windows7-x64

6e711c7305...7f.exe

windows10-2004-x64

Sharing

General

Target

6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f
Size

859KB
Sample

221122-xayn7sgf31
MD5

9cc711820acb7747d9ca8553f32b7763
SHA1

6475b200826591ed2be1c020e28cc8cec328e264
SHA256

6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f
SHA512

9dfcd0b33cf97b2edf552f681ceb8b1cb1232c2e00fd9aa1116cb87669da05152686f7480dbb6d22922631d7cb62b1fbca7f922a746f15fc69dce28bdecff4dc
SSDEEP

12288:A1IQtqB5urTIoYWBQk1E+VF9mOx9wiZUe:dQtqBorTlYWBhE+V3mO

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f.exe

Resource

win10v2004-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f
- Size
  
  859KB
- MD5
  
  9cc711820acb7747d9ca8553f32b7763
- SHA1
  
  6475b200826591ed2be1c020e28cc8cec328e264
- SHA256
  
  6e711c7305c3e81336bcc1c4e0f2ef8c7806ee531a698b29b5ae997b111a947f
- SHA512
  
  9dfcd0b33cf97b2edf552f681ceb8b1cb1232c2e00fd9aa1116cb87669da05152686f7480dbb6d22922631d7cb62b1fbca7f922a746f15fc69dce28bdecff4dc
- SSDEEP
  
  12288:A1IQtqB5urTIoYWBQk1E+VF9mOx9wiZUe:dQtqBorTlYWBhE+V3mO
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy