hawkeye | c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25 | Triage

Submit
Reports

Overview

overview

Static

static

c714bf1d15...25.exe

windows7-x64

c714bf1d15...25.exe

windows10-2004-x64

Sharing

General

Target

c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25
Size

380KB
Sample

221123-xz16mage57
MD5

c1b5a66001fb42a800f4d752f81af14d
SHA1

09157a77f3ec58014ce7942937e1e25ce09e900a
SHA256

c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25
SHA512

464fd86992352f01f728c18ce6b19cb6666c552efb65b2cd5dea9e82318a0c1919779a45e7f4c9e1c32766a9444dcb733da416d4d83744ffefed413104e73f62
SSDEEP

6144:51oGRDOh9czp8VCBUqL4L/GczUfhCbTuVx82Et/wIySTvY2ISVCuVuY/mQ:51LRg9cz8/joZCbTuVx8pwIjvYkdIE

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25
- Size
  
  380KB
- MD5
  
  c1b5a66001fb42a800f4d752f81af14d
- SHA1
  
  09157a77f3ec58014ce7942937e1e25ce09e900a
- SHA256
  
  c714bf1d154e7316b7be2f1cc788e390ff22c0729442d36242233564b7851f25
- SHA512
  
  464fd86992352f01f728c18ce6b19cb6666c552efb65b2cd5dea9e82318a0c1919779a45e7f4c9e1c32766a9444dcb733da416d4d83744ffefed413104e73f62
- SSDEEP
  
  6144:51oGRDOh9czp8VCBUqL4L/GczUfhCbTuVx82Et/wIySTvY2ISVCuVuY/mQ:51LRg9cz8/joZCbTuVx8pwIjvYkdIE
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy