hawkeye | 26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12 | Triage

Submit
Reports

Overview

overview

Static

static

26b78e9577...12.exe

windows7-x64

26b78e9577...12.exe

windows10-2004-x64

1

Sharing

General

Target

26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12
Size

443KB
Sample

221123-xbpgxsee44
MD5

64c58736bbdcf5b734fb38a4e1d8b6c6
SHA1

31dd6824e31c87d6ee0ac1035346f2daea150c5e
SHA256

26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12
SHA512

50f58f569c1f49edff4f5628e8226c3fc6dab2b04f4900fcba4c26a7960b62eca9e99bfc94347ebb5cddf492f0117a9cfbf9f5d11d856efb8c6698ed317377d3
SSDEEP

12288:n4MoSCxL4a6lw1jIHkhcEfzbakwRWrDwzg/0:n4MoSZOjIHCcEbbakwArDwW

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12.exe

Resource

win7-20220901-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  
  26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12
- Size
  
  443KB
- MD5
  
  64c58736bbdcf5b734fb38a4e1d8b6c6
- SHA1
  
  31dd6824e31c87d6ee0ac1035346f2daea150c5e
- SHA256
  
  26b78e9577c953db12622f5c100df798ce0ca0398857ad561f7b5dd63e297e12
- SHA512
  
  50f58f569c1f49edff4f5628e8226c3fc6dab2b04f4900fcba4c26a7960b62eca9e99bfc94347ebb5cddf492f0117a9cfbf9f5d11d856efb8c6698ed317377d3
- SSDEEP
  
  12288:n4MoSCxL4a6lw1jIHkhcEfzbakwRWrDwzg/0:n4MoSZOjIHCcEbbakwArDwW
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy