hawkeye | 0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0 | Triage

Submit
Reports

Overview

overview

Static

static

0dece745d5...b0.exe

windows7-x64

0dece745d5...b0.exe

windows10-2004-x64

Sharing

General

Target

0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0
Size

424KB
Sample

221122-yyl6rafe97
MD5

809367e83582491b5d32ecf926ad9cf1
SHA1

14a96a774f70a0ad409947b638dd50d1442cb6c2
SHA256

0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0
SHA512

b5a166ffed48b40a059325cefa5141be8061c8133b7d34df89366e42b6087a919d7ba9ad2237d98d1cf300ca2c4eecfd1022d96cc6e3d84efff2edd879be12b4
SSDEEP

12288:y6bOR1aAIvWIMtvjeJ/RfL2PmkWvwONkDC4rGFcm:vbOR1aAIuIOvjeJ/Rf6PmLoukG

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0.exe

Resource

win7-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  
  0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0
- Size
  
  424KB
- MD5
  
  809367e83582491b5d32ecf926ad9cf1
- SHA1
  
  14a96a774f70a0ad409947b638dd50d1442cb6c2
- SHA256
  
  0dece745d53227a0db0cb5edd7e422300917c0b0a41883093b8375cde0739ab0
- SHA512
  
  b5a166ffed48b40a059325cefa5141be8061c8133b7d34df89366e42b6087a919d7ba9ad2237d98d1cf300ca2c4eecfd1022d96cc6e3d84efff2edd879be12b4
- SSDEEP
  
  12288:y6bOR1aAIvWIMtvjeJ/RfL2PmkWvwONkDC4rGFcm:vbOR1aAIuIOvjeJ/Rf6PmLoukG
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy