Overview

overview

10

Static

static

ade28a9041...25.exe

windows7-x64

9

ade28a9041...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ade28a90414d70863cdccfb5584a98539ac39066e8f95469b26817d6d8d47925

  • Size

    1.5MB

  • Sample

    221123-sx11mafe9x

  • MD5

    27477706a2f6218e58cb5fa7c3ed9fe8

  • SHA1

    4fb7cc1155816e66156b1721d9e21221ea4cf02d

  • SHA256

    ade28a90414d70863cdccfb5584a98539ac39066e8f95469b26817d6d8d47925

  • SHA512

    ead51258deb4f65f3dcb4280fdda9a294fada2a34fb85a7aa6fc647d60da2964e89864b635951c82c9370b0c096ccb65f8eb71584041e16e2701eee0d6a1fb07

  • SSDEEP

    24576:Lr4AICV4HDPzWbWMbE22/P4ppLA0qEXB1f3K2HeDN5Dtn3a3U0OAx:P4AI84jLHMbEei0quHittn3k

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      ade28a90414d70863cdccfb5584a98539ac39066e8f95469b26817d6d8d47925

    • Size

      1.5MB

    • MD5

      27477706a2f6218e58cb5fa7c3ed9fe8

    • SHA1

      4fb7cc1155816e66156b1721d9e21221ea4cf02d

    • SHA256

      ade28a90414d70863cdccfb5584a98539ac39066e8f95469b26817d6d8d47925

    • SHA512

      ead51258deb4f65f3dcb4280fdda9a294fada2a34fb85a7aa6fc647d60da2964e89864b635951c82c9370b0c096ccb65f8eb71584041e16e2701eee0d6a1fb07

    • SSDEEP

      24576:Lr4AICV4HDPzWbWMbE22/P4ppLA0qEXB1f3K2HeDN5Dtn3a3U0OAx:P4AI84jLHMbEei0quHittn3k

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks