hawkeye

General

Target

84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4
Size

565KB
Sample

221123-q34mlaaf3z
MD5

2f1e49abe8fbe294a68fc7fcef290e96
SHA1

2afac2bafa7a488d9c0a9bd3e11af0a24156bc5e
SHA256

84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4
SHA512

e02903f3780f0bb593f74822e611717e727f723bcdde499dfc5cd76fb4a099c15a3de31a6a52465f92f6bf757b0a21734a4bf0260bb7a43bc92c1e5ea84c8efa
SSDEEP

6144:ePbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9xHbp:2QtqB5urTIoYWBQk1E+VF9mOx9xp

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

steam.user32.com:5552

Mutex

51aa7e07f3bb4f632f1f0fc8c30d101f

Attributes

reg_key
51aa7e07f3bb4f632f1f0fc8c30d101f
splitter
|'|'|

Targets

- Target
  
  84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4
- Size
  
  565KB
- MD5
  
  2f1e49abe8fbe294a68fc7fcef290e96
- SHA1
  
  2afac2bafa7a488d9c0a9bd3e11af0a24156bc5e
- SHA256
  
  84e11573ea30648e2384e82f578fa2f3eb9ced4e4e227d6735e4c3fec32e35a4
- SHA512
  
  e02903f3780f0bb593f74822e611717e727f723bcdde499dfc5cd76fb4a099c15a3de31a6a52465f92f6bf757b0a21734a4bf0260bb7a43bc92c1e5ea84c8efa
- SSDEEP
  
  6144:ePbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9xHbp:2QtqB5urTIoYWBQk1E+VF9mOx9xp
Score

10^/10

hawkeye njrat hacked collection evasion keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2