Extracted

• • Target

    aa02038b4097148e856795d9624e5ab9cdf4d304b9a4bf884d84f9f715272578

  • Size

    679KB

  • MD5

    a55c7f3f1a773d7ec913460299b8f4b5

  • SHA1

    de5121270965181e3318774964c8862112f972fc

  • SHA256

    aa02038b4097148e856795d9624e5ab9cdf4d304b9a4bf884d84f9f715272578

  • SHA512

    f228abc3ac3dd091ac6ff2cf8d6c4eddf2344de767e4be3ab9e889187e461cec1d1b7af9d62dc180d1b23231fd2b81d51c41e79db7b1406eed63912258f6a609

  • SSDEEP

    12288:26m4U8qiqvbFtjabZbApi/lSDgqymdJOCzLrfZ00:yB8Pq5tOdbkysld4CC

  Score

  10^/10

  hawkeyecollectionkeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2