hawkeye | eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f | Triage

Submit
Reports

Overview

overview

Static

static

eb2db33202...7f.exe

windows7-x64

eb2db33202...7f.exe

windows10-2004-x64

Sharing

General

Target

eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f
Size

653KB
Sample

221125-vw1dtacd26
MD5

e806b4dd8b611d21591135cdc582d4fb
SHA1

a7ac2fbc9b927123dcd3eb1693862f1543e03e61
SHA256

eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f
SHA512

7c07f2482dc39c7bb251f8c9bf852fc5a431e1cc7bbfd7a00a34a18a9b7d00e626773b80f041951c821eadb8e56f7d8760bd3e274c1823b4488708a9be74150a
SSDEEP

12288:t1HZojx0uucH3VS5ZH7RiFYdcoR+ImmUgJEWE/SfZgr96:t1HZK0ujlS5B7RiqfmmUgJEUfZgrI

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f
- Size
  
  653KB
- MD5
  
  e806b4dd8b611d21591135cdc582d4fb
- SHA1
  
  a7ac2fbc9b927123dcd3eb1693862f1543e03e61
- SHA256
  
  eb2db33202af4e3ef1964d6560addb13cb6a3f2ea9046f650251a6d20aab447f
- SHA512
  
  7c07f2482dc39c7bb251f8c9bf852fc5a431e1cc7bbfd7a00a34a18a9b7d00e626773b80f041951c821eadb8e56f7d8760bd3e274c1823b4488708a9be74150a
- SSDEEP
  
  12288:t1HZojx0uucH3VS5ZH7RiFYdcoR+ImmUgJEWE/SfZgr96:t1HZK0ujlS5B7RiqfmmUgJEUfZgrI
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy