hawkeye

General

Target

a03826478cd1d5a43ffe38c33c9bd180ee2e0bfc59bdb5bfd4909bd91d8305f2
Size

634KB
Sample

221126-ryyq8aba62
MD5

585ce3a1c9d2e7692833c40833cb164c
SHA1

1401a42744b91cd8ad36ed0e1844fc9d51504a71
SHA256

a03826478cd1d5a43ffe38c33c9bd180ee2e0bfc59bdb5bfd4909bd91d8305f2
SHA512

aafbc1f3e2df8afcf3fdac8b1aa2942de37ae66367a4d0b567e14099a21683c50133b0a40990c2d4c40b1a9d44485026bc914e7951540db2398a6114d04a31a8
SSDEEP

12288:F55tXHo4ipjuqK6ASWuGQgoPwt5R9cV0Z1olNnf7sqKMh1fH:/vYhASYNFtL9o0MltszMhBH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.mail.ru
Port:
2525
Username:
[email protected]
Password:
lagos2013

Targets

- Target
  
  a03826478cd1d5a43ffe38c33c9bd180ee2e0bfc59bdb5bfd4909bd91d8305f2
- Size
  
  634KB
- MD5
  
  585ce3a1c9d2e7692833c40833cb164c
- SHA1
  
  1401a42744b91cd8ad36ed0e1844fc9d51504a71
- SHA256
  
  a03826478cd1d5a43ffe38c33c9bd180ee2e0bfc59bdb5bfd4909bd91d8305f2
- SHA512
  
  aafbc1f3e2df8afcf3fdac8b1aa2942de37ae66367a4d0b567e14099a21683c50133b0a40990c2d4c40b1a9d44485026bc914e7951540db2398a6114d04a31a8
- SSDEEP
  
  12288:F55tXHo4ipjuqK6ASWuGQgoPwt5R9cV0Z1olNnf7sqKMh1fH:/vYhASYNFtL9o0MltszMhBH
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2