hawkeye | f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9 | Triage

Submit
Reports

Overview

overview

Static

static

f3800c948c...d9.exe

windows7-x64

f3800c948c...d9.exe

windows10-2004-x64

Sharing

General

Target

f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9
Size

1.0MB
Sample

221126-kkf6pafa75
MD5

6bfa2b53a999b850da12351895e7e2f5
SHA1

e5ce1e120f13a434e1e3c9b7789bf5e5e56f3286
SHA256

f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9
SHA512

48dd1c725bfc7f382e0e462cab3f6b77757144bb1186f98a55b322233c45756c8c5e6e408406036205f1a2ede7c8c82149b83f83b1d44527de804d29a68d28b9
SSDEEP

24576:G1jWL2V1E4QjQ3wlaHt/n62NHt3RZS7ASwyjA4YdSBSe8FEVq:GZnEdNaZn62NHt3RZ5VndSZ82V

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9.exe

Resource

win10v2004-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9
- Size
  
  1.0MB
- MD5
  
  6bfa2b53a999b850da12351895e7e2f5
- SHA1
  
  e5ce1e120f13a434e1e3c9b7789bf5e5e56f3286
- SHA256
  
  f3800c948ce4761388d5bdd87399c44476e3a27138d6060f4a8e47fa0458ebd9
- SHA512
  
  48dd1c725bfc7f382e0e462cab3f6b77757144bb1186f98a55b322233c45756c8c5e6e408406036205f1a2ede7c8c82149b83f83b1d44527de804d29a68d28b9
- SSDEEP
  
  24576:G1jWL2V1E4QjQ3wlaHt/n62NHt3RZS7ASwyjA4YdSBSe8FEVq:GZnEdNaZn62NHt3RZ5VndSZ82V
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy