Overview

overview

10

Static

static

9f7d62cb3c...8e.exe

windows7-x64

10

9f7d62cb3c...8e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f7d62cb3ce266a68daab1e95f91e8fbddf84ce54337128f2e78614b7fc2aa8e

  • Size

    428KB

  • Sample

    221122-yykb6afe96

  • MD5

    9636be11bfc477511d757bd7b7a567af

  • SHA1

    df89f8a9044e34b41efdb33480cb6541c12e9ae6

  • SHA256

    9f7d62cb3ce266a68daab1e95f91e8fbddf84ce54337128f2e78614b7fc2aa8e

  • SHA512

    c0839c42e4de72751271fade397381fbc7e69dd58e12323d2009e644b5df3efca731d9e98bdd40a2cf45ea0c0c22f14a034724a51de31022cd97d581be86e23b

  • SSDEEP

    6144:sONWBQfb9kJg98ncQcIMWdGRcrQXu3uGjBtwY6FIQ5CFgbiDGnMiTpHp1m7B/lVS:sOaQJY0CjP9V5BtWI+CFgiarpJOXV5k

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      9f7d62cb3ce266a68daab1e95f91e8fbddf84ce54337128f2e78614b7fc2aa8e

    • Size

      428KB

    • MD5

      9636be11bfc477511d757bd7b7a567af

    • SHA1

      df89f8a9044e34b41efdb33480cb6541c12e9ae6

    • SHA256

      9f7d62cb3ce266a68daab1e95f91e8fbddf84ce54337128f2e78614b7fc2aa8e

    • SHA512

      c0839c42e4de72751271fade397381fbc7e69dd58e12323d2009e644b5df3efca731d9e98bdd40a2cf45ea0c0c22f14a034724a51de31022cd97d581be86e23b

    • SSDEEP

      6144:sONWBQfb9kJg98ncQcIMWdGRcrQXu3uGjBtwY6FIQ5CFgbiDGnMiTpHp1m7B/lVS:sOaQJY0CjP9V5BtWI+CFgiarpJOXV5k

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks