hawkeye | b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24 | Triage

Submit
Reports

Overview

overview

Static

static

b6132cf838...24.exe

windows7-x64

9

b6132cf838...24.exe

windows10-2004-x64

Sharing

General

Target

b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24
Size

1.2MB
Sample

221125-kjwvrahe6s
MD5

8b2996fb30bba79cf90a80fe4455a303
SHA1

f6e0c2224389016f97aee2059f9947c6dc62e352
SHA256

b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24
SHA512

9b2e71684fbe7c9982eed2b9bb00af288b7788865864959761f12da40cdba53c8b62049235b4fef9e7f263b19965e837465cb181b1291f66fb40a2ea14362f15
SSDEEP

24576:JmWsLGJOr1IrzB7b8m2t4xSTdzgz5nn2T3:VsLGsrOXBv8m2tBTdzyIT

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24.exe

Resource

win7-20221111-en

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24.exe

Resource

win10v2004-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24
- Size
  
  1.2MB
- MD5
  
  8b2996fb30bba79cf90a80fe4455a303
- SHA1
  
  f6e0c2224389016f97aee2059f9947c6dc62e352
- SHA256
  
  b6132cf8384c7e5f153ebb7da387d401950393bb45e27648903f923cbc2cdd24
- SHA512
  
  9b2e71684fbe7c9982eed2b9bb00af288b7788865864959761f12da40cdba53c8b62049235b4fef9e7f263b19965e837465cb181b1291f66fb40a2ea14362f15
- SSDEEP
  
  24576:JmWsLGJOr1IrzB7b8m2t4xSTdzgz5nn2T3:VsLGsrOXBv8m2tBTdzyIT
Score

10^/10

collection hawkeye keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy