hawkeye

General

Target

8eac9ee0328d8801e9efbfaa282065d908b069cef38b6a4c75d01750875b0026
Size

813KB
Sample

221125-ja7efsba36
MD5

72bf30383fc0eda5fc545972ef26a94b
SHA1

205e39c03bc7c820b87cb0dff45ae7b3e3cf4968
SHA256

8eac9ee0328d8801e9efbfaa282065d908b069cef38b6a4c75d01750875b0026
SHA512

1058f815de005997cba996d33784fa9e489c2229d0a29d3ded5e9e75904febb56c31de551e6f958e48dffedb810b83dbac1f471d9f5cbee0bf949346827b066d
SSDEEP

12288:DCEVCrAa1cHoAQAm/YVntYm4eaTwiUf5IyyGvpASPQzBIVsz4JDqDU:/wrAS5AjnymLaTgm1GRASPQzBi

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.bk.ru
Port:
587
Username:
[email protected]
Password:
Favour123

Targets

- Target
  
  8eac9ee0328d8801e9efbfaa282065d908b069cef38b6a4c75d01750875b0026
- Size
  
  813KB
- MD5
  
  72bf30383fc0eda5fc545972ef26a94b
- SHA1
  
  205e39c03bc7c820b87cb0dff45ae7b3e3cf4968
- SHA256
  
  8eac9ee0328d8801e9efbfaa282065d908b069cef38b6a4c75d01750875b0026
- SHA512
  
  1058f815de005997cba996d33784fa9e489c2229d0a29d3ded5e9e75904febb56c31de551e6f958e48dffedb810b83dbac1f471d9f5cbee0bf949346827b066d
- SSDEEP
  
  12288:DCEVCrAa1cHoAQAm/YVntYm4eaTwiUf5IyyGvpASPQzBIVsz4JDqDU:/wrAS5AjnymLaTgm1GRASPQzBi
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2