Overview

overview

10

Static

static

70a063c675...5b.exe

windows7-x64

10

70a063c675...5b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70a063c675107ac0c986af50c2eca76baa6687182a6a90f85530a46a8a2e445b

  • Size

    1.0MB

  • Sample

    221125-zrwbhshd9x

  • MD5

    5c17a6ed37625b222e60e58434982d9d

  • SHA1

    429a4d280a4073a28700cd237171c420280c1fcf

  • SHA256

    70a063c675107ac0c986af50c2eca76baa6687182a6a90f85530a46a8a2e445b

  • SHA512

    4461bed6b96027176eaa78500fc99cd6556d8e810d6bf0d930682a0030cdf46eeea8cdeac78a8ec808ea5ab92df575219b934fd4cd8c66a20c069f89f410b9d0

  • SSDEEP

    24576:VM/jzSaUAZdhNvaNZXip9F/jSbFLHiJ8SRR0YffEupBXT:KUetaNhm7/ub16RRbVJ

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      70a063c675107ac0c986af50c2eca76baa6687182a6a90f85530a46a8a2e445b

    • Size

      1.0MB

    • MD5

      5c17a6ed37625b222e60e58434982d9d

    • SHA1

      429a4d280a4073a28700cd237171c420280c1fcf

    • SHA256

      70a063c675107ac0c986af50c2eca76baa6687182a6a90f85530a46a8a2e445b

    • SHA512

      4461bed6b96027176eaa78500fc99cd6556d8e810d6bf0d930682a0030cdf46eeea8cdeac78a8ec808ea5ab92df575219b934fd4cd8c66a20c069f89f410b9d0

    • SSDEEP

      24576:VM/jzSaUAZdhNvaNZXip9F/jSbFLHiJ8SRR0YffEupBXT:KUetaNhm7/ub16RRbVJ

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks