Extracted

• • Target

    96f42ad1331687d088a13973b69cbe2ba0fe879476a921574c3d74760e2bed37

  • Size

    977KB

  • MD5

    5a17e8e2949995ef895bb0dbcb68a77c

  • SHA1

    c235836411fd3c72936d02798546d0839335eb29

  • SHA256

    96f42ad1331687d088a13973b69cbe2ba0fe879476a921574c3d74760e2bed37

  • SHA512

    1032a0574053ea8f3dbc21355089e1ca294df2ffeda4c40b708f507b935f705947fd6cd5d288323c0c24da89f3174b7439179595741e95eeec152209a116dfb9

  • SSDEEP

    24576:tHL8nZHDp6dge1sKgwHMExe53cZrrBGaSAIhQ:tr8uvMETYaSAIh

  Score

  10^/10

  hawkeyecollectionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2