Extracted

• • Target

    e6b2ea851cc6e13831c4aeec7385ac3358c3971be9accc567936a56c133a4696

  • Size

    941KB

  • MD5

    ebb80fa33ac5c7f7d1b345ed4bb483fa

  • SHA1

    bcc39da1895763088edc3e8c45e30d646f6c2802

  • SHA256

    e6b2ea851cc6e13831c4aeec7385ac3358c3971be9accc567936a56c133a4696

  • SHA512

    4ee465ac24909b8ade11e61f2e15d898f0aec84268cae90719cae250abf62852e09c45914602c8509a7cce6300e8e32f437d0f595aee986879d750afdb2aeff4

  • SSDEEP

    24576:K1L/RH37hRlZa2gnYfv+9/DD83LEL9dhmxRw3/:K1bF3tRDa2aYfv+9rMLm3+w3

  Score

  10^/10

  hawkeyecollectionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Modifies WinLogon for persistence

    persistence

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2