Overview

overview

10

Static

static

7

bc559e3422...b8.exe

windows7-x64

10

bc559e3422...b8.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc559e34221021bd9447ec44a01514d60e3a0947ed67f6ea7b6da4537431c6b8

  • Size

    1.0MB

  • Sample

    221128-v2ez3agc3w

  • MD5

    b94449517e6e249068ed414e93fd1124

  • SHA1

    f09f2517a4c1930bd6d1c12ebd0e75864bc4a7ac

  • SHA256

    bc559e34221021bd9447ec44a01514d60e3a0947ed67f6ea7b6da4537431c6b8

  • SHA512

    5769d014364e054fc75fcb221136699504dd736544deae38b52b4ff304c51950404f37d553c834921ab7a1154244d9e5b69941b7c1ec984a5724b077e3364b82

  • SSDEEP

    24576:pYAxsZn4U7D3hIC96owoKYAB+Aq/gX57L4BmAvXpDqedXUEQ1LCINN5:pY0sCU7D3mCsogYUNplINvtq6X9Un5

Score
10/10
hawkeyeagilenetcollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      bc559e34221021bd9447ec44a01514d60e3a0947ed67f6ea7b6da4537431c6b8

    • Size

      1.0MB

    • MD5

      b94449517e6e249068ed414e93fd1124

    • SHA1

      f09f2517a4c1930bd6d1c12ebd0e75864bc4a7ac

    • SHA256

      bc559e34221021bd9447ec44a01514d60e3a0947ed67f6ea7b6da4537431c6b8

    • SHA512

      5769d014364e054fc75fcb221136699504dd736544deae38b52b4ff304c51950404f37d553c834921ab7a1154244d9e5b69941b7c1ec984a5724b077e3364b82

    • SSDEEP

      24576:pYAxsZn4U7D3hIC96owoKYAB+Aq/gX57L4BmAvXpDqedXUEQ1LCINN5:pY0sCU7D3mCsogYUNplINvtq6X9Un5

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks