Overview

overview

10

Static

static

798723de87...7f.exe

windows7-x64

10

798723de87...7f.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    798723de8795b8cae4ee2286ebb9e1b4c7916ae46fda8a63c691bb23debdba7f

  • Size

    1.4MB

  • Sample

    221127-s56abahd72

  • MD5

    4257b2dbf6dce34b6cc71497db99212a

  • SHA1

    e5361540379475f036d706de5b91de3d9c56f1fa

  • SHA256

    798723de8795b8cae4ee2286ebb9e1b4c7916ae46fda8a63c691bb23debdba7f

  • SHA512

    610591a9444662d30ff2356bf35a9068577fb87b70485ee20947dc222c0540026935c64801ac95219660ddd491b49d8feec6cbf48e68aabfc1d628042b84bcce

  • SSDEEP

    24576:uQOWlP6XjrM7ah6ia/xertxa++7dqwaUrYkf8OnOL7CZb2cSmq:bVlP2jh6irrtxD+vxrr2Lxmq

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      798723de8795b8cae4ee2286ebb9e1b4c7916ae46fda8a63c691bb23debdba7f

    • Size

      1.4MB

    • MD5

      4257b2dbf6dce34b6cc71497db99212a

    • SHA1

      e5361540379475f036d706de5b91de3d9c56f1fa

    • SHA256

      798723de8795b8cae4ee2286ebb9e1b4c7916ae46fda8a63c691bb23debdba7f

    • SHA512

      610591a9444662d30ff2356bf35a9068577fb87b70485ee20947dc222c0540026935c64801ac95219660ddd491b49d8feec6cbf48e68aabfc1d628042b84bcce

    • SSDEEP

      24576:uQOWlP6XjrM7ah6ia/xertxa++7dqwaUrYkf8OnOL7CZb2cSmq:bVlP2jh6irrtxD+vxrr2Lxmq

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks