Overview

overview

10

Static

static

58300ed487...9f.exe

windows7-x64

10

58300ed487...9f.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58300ed487030f27d336224eab15a9d105f5ed5f7bb9fb40fe27f8c0f4c53b9f

  • Size

    954KB

  • Sample

    221128-gz2jdsfg8y

  • MD5

    4aba18b63e0787b1df8f07d624fd85f1

  • SHA1

    b7f3d2f5be26d1b6705dc49b22070bd81fe8f601

  • SHA256

    58300ed487030f27d336224eab15a9d105f5ed5f7bb9fb40fe27f8c0f4c53b9f

  • SHA512

    450081962c03bf08c36214f6b62d1ade04005950cab073ed41d7dfe7aa1539fa9e4e8ec2ea32c054a8518d5c3a391817047cfc85367847419d5ba5a16945d0f6

  • SSDEEP

    12288:aWR/kC+1YIwHzgBcix3x5rn1GJIShUkIzsSFqI/xRWBgFm4:aWRMZYIw8BcQGJTek47//xQ

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      58300ed487030f27d336224eab15a9d105f5ed5f7bb9fb40fe27f8c0f4c53b9f

    • Size

      954KB

    • MD5

      4aba18b63e0787b1df8f07d624fd85f1

    • SHA1

      b7f3d2f5be26d1b6705dc49b22070bd81fe8f601

    • SHA256

      58300ed487030f27d336224eab15a9d105f5ed5f7bb9fb40fe27f8c0f4c53b9f

    • SHA512

      450081962c03bf08c36214f6b62d1ade04005950cab073ed41d7dfe7aa1539fa9e4e8ec2ea32c054a8518d5c3a391817047cfc85367847419d5ba5a16945d0f6

    • SSDEEP

      12288:aWR/kC+1YIwHzgBcix3x5rn1GJIShUkIzsSFqI/xRWBgFm4:aWRMZYIw8BcQGJTek47//xQ

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks