Overview

overview

10

Static

static

5fb8b5a37d...c4.exe

windows7-x64

10

5fb8b5a37d...c4.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4

  • Size

    611KB

  • Sample

    221125-a7ldtadg7z

  • MD5

    21ec30fd5c386931798cde196d6189ba

  • SHA1

    776e0c2fc04d0ac30df0749815349c8be563de01

  • SHA256

    5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4

  • SHA512

    6896047be229b5c3d3829aeb87904650376585992a48d7e2e45e43af50b5f60bbf10c812f8b0f6ff1208d1a3789ecaf9eff0046713c62aa2165307e6721d47aa

  • SSDEEP

    6144:iJQ7eE3M0V8DaCQwDqqkxrx5rW4W0EcDdprqsYoQH4p4IPz7lvgHeUAMQYZ2zMvE:isHV8a6H2TEqWsYomF0vF5rzKEqj6Pu

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4

    • Size

      611KB

    • MD5

      21ec30fd5c386931798cde196d6189ba

    • SHA1

      776e0c2fc04d0ac30df0749815349c8be563de01

    • SHA256

      5fb8b5a37d4a5b56b32b403ba658ed324683577e99a6fa342d401449d216f4c4

    • SHA512

      6896047be229b5c3d3829aeb87904650376585992a48d7e2e45e43af50b5f60bbf10c812f8b0f6ff1208d1a3789ecaf9eff0046713c62aa2165307e6721d47aa

    • SSDEEP

      6144:iJQ7eE3M0V8DaCQwDqqkxrx5rW4W0EcDdprqsYoQH4p4IPz7lvgHeUAMQYZ2zMvE:isHV8a6H2TEqWsYomF0vF5rzKEqj6Pu

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks