hawkeye | eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda | Triage

Submit
Reports

Overview

overview

Static

static

eaa7fc17b5...da.exe

windows7-x64

eaa7fc17b5...da.exe

windows10-2004-x64

Sharing

General

Target

eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda
Size

1.0MB
Sample

221126-qsm7vsah6x
MD5

45b81318c48b807f283412fa3015270a
SHA1

56427137054c1316bcd15a38f7bdc3a9753107ce
SHA256

eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda
SHA512

937b30da21fb0ed05e17b0cde45e7b7f6efa2f0dd5b175b7c4a8579d838ff24d6b07b26874808a8ce6a1551e1493a379e39ebde4b682af1e03252a42938edaf6
SSDEEP

24576:XI1xOY6KzhBbjD10nJn0yQ+jMy4xmceFmRm4l6OT4m:4yHKn3unJ0/M7bFmT4m

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda.exe

Resource

win7-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda.exe

Resource

win10v2004-20220812-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda
- Size
  
  1.0MB
- MD5
  
  45b81318c48b807f283412fa3015270a
- SHA1
  
  56427137054c1316bcd15a38f7bdc3a9753107ce
- SHA256
  
  eaa7fc17b5ba639493867006c7ae427275053b445f658f5a908f09fdbb572cda
- SHA512
  
  937b30da21fb0ed05e17b0cde45e7b7f6efa2f0dd5b175b7c4a8579d838ff24d6b07b26874808a8ce6a1551e1493a379e39ebde4b682af1e03252a42938edaf6
- SSDEEP
  
  24576:XI1xOY6KzhBbjD10nJn0yQ+jMy4xmceFmRm4l6OT4m:4yHKn3unJ0/M7bFmT4m
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy