hawkeye | 67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61 | Triage

Submit
Reports

Overview

overview

Static

static

67147822a2...61.exe

windows7-x64

67147822a2...61.exe

windows10-2004-x64

Sharing

General

Target

67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61
Size

424KB
Sample

221122-yylj8aba5v
MD5

12a2ac7fec29503dbbddaf3541f461a2
SHA1

81cc288852d0ec0eb4b0b3c40549d5a94c52d855
SHA256

67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61
SHA512

946ce36bec370a8bfb55f1b34218aed34cd0845d41cfacd1ee25993efa93ff8ca155cb148c4fb36d6af42b2ef5f3125f9b96f7b220d9f8ad6c94ff9694040ad1
SSDEEP

12288:D6x4iL/BJjb0HeIq4BycMsx8tLbeM30GzIr+:y7LJJjb0+Ra/2kq+

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61.exe

Resource

win7-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61
- Size
  
  424KB
- MD5
  
  12a2ac7fec29503dbbddaf3541f461a2
- SHA1
  
  81cc288852d0ec0eb4b0b3c40549d5a94c52d855
- SHA256
  
  67147822a25f6b0d381ccd6d402f1431de38dbc75eab958b4e9fe01c9bec8c61
- SHA512
  
  946ce36bec370a8bfb55f1b34218aed34cd0845d41cfacd1ee25993efa93ff8ca155cb148c4fb36d6af42b2ef5f3125f9b96f7b220d9f8ad6c94ff9694040ad1
- SSDEEP
  
  12288:D6x4iL/BJjb0HeIq4BycMsx8tLbeM30GzIr+:y7LJJjb0+Ra/2kq+
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy