Overview

overview

10

Static

static

7252e07be0...3d.exe

windows7-x64

9

7252e07be0...3d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7252e07be0599a3db85bd4a50978383b866fe13f7f4b43489ad6bd41eaee813d

  • Size

    1.0MB

  • Sample

    221126-hzh8gsec21

  • MD5

    270253f8478b245967842b75e799429f

  • SHA1

    8c063572abd38cdcda8d7f3c58900193892ca755

  • SHA256

    7252e07be0599a3db85bd4a50978383b866fe13f7f4b43489ad6bd41eaee813d

  • SHA512

    82542c20ea779021dc305bdf13d66ae2be76c07df716f0062a076149ff1cf98502e7d8f747616b884c12952be6f07733127d3db49f3741271acb5ce37e2af4cb

  • SSDEEP

    12288:dwmEaoz2pfbBh54XiQIhwj1Wu9OHp8Clbfiazi8dNCmgelz8pUuFWasAuTmDtAuE:KmE9z4BP4XtIbc88giq/C9ejul7Jpa

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      7252e07be0599a3db85bd4a50978383b866fe13f7f4b43489ad6bd41eaee813d

    • Size

      1.0MB

    • MD5

      270253f8478b245967842b75e799429f

    • SHA1

      8c063572abd38cdcda8d7f3c58900193892ca755

    • SHA256

      7252e07be0599a3db85bd4a50978383b866fe13f7f4b43489ad6bd41eaee813d

    • SHA512

      82542c20ea779021dc305bdf13d66ae2be76c07df716f0062a076149ff1cf98502e7d8f747616b884c12952be6f07733127d3db49f3741271acb5ce37e2af4cb

    • SSDEEP

      12288:dwmEaoz2pfbBh54XiQIhwj1Wu9OHp8Clbfiazi8dNCmgelz8pUuFWasAuTmDtAuE:KmE9z4BP4XtIbc88giq/C9ejul7Jpa

    Score
    10/10
    collectionhawkeyekeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks