hawkeye | ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe | Triage

Submit
Reports

Overview

overview

Static

static

ef7df38dfb...be.exe

windows7-x64

ef7df38dfb...be.exe

windows10-2004-x64

Sharing

General

Target

ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe
Size

527KB
Sample

221126-neex8aba42
MD5

3f8412ac8ba6a375e0d0ace70f79287f
SHA1

dd9f90165ebcc7064b54471f99b28f54ef2bf63f
SHA256

ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe
SHA512

837979a39ff40986ad62df7576280287fb893b4d7b2fa973ca7ac9a1bb977b051415545bcaffd4b04adad7d685760ca64c933b29e0cbd06f3aa38c580a10343c
SSDEEP

12288:ln0aYpcqcJGXaGwCBMU2RpOVF9i4g9FkeM/4Ajv+cO:2ftcJQapKMUOCTiRbM/BO

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe
- Size
  
  527KB
- MD5
  
  3f8412ac8ba6a375e0d0ace70f79287f
- SHA1
  
  dd9f90165ebcc7064b54471f99b28f54ef2bf63f
- SHA256
  
  ef7df38dfb4985c8dd02b32df3715db795d8674ef13b18daff6e165086a7fcbe
- SHA512
  
  837979a39ff40986ad62df7576280287fb893b4d7b2fa973ca7ac9a1bb977b051415545bcaffd4b04adad7d685760ca64c933b29e0cbd06f3aa38c580a10343c
- SSDEEP
  
  12288:ln0aYpcqcJGXaGwCBMU2RpOVF9i4g9FkeM/4Ajv+cO:2ftcJQapKMUOCTiRbM/BO
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy