Overview

overview

10

Static

static

0f336f04ac...5b.exe

windows7-x64

10

0f336f04ac...5b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f336f04ace148f1dd70a9f020d37848f1855b7a6b6b48a81e25805ef8117e5b

  • Size

    1020KB

  • Sample

    221128-xd6tzsgd78

  • MD5

    4cc2c1d4268028ca0136799bb36408a0

  • SHA1

    16fbc62b9334ec6c9f423f560c11f276b4d42cc1

  • SHA256

    0f336f04ace148f1dd70a9f020d37848f1855b7a6b6b48a81e25805ef8117e5b

  • SHA512

    901a81c3e62958f7327c9776b8e8181b3313e2042d4d7f75b9cfdc9f43dca4406b2cc2aaae12848256029f75eb56f58219e9add59e0d3bc1c408e6e39a92f2d0

  • SSDEEP

    24576:WB5eCXf8iMnx4GER5XisEshTK0imdCGzEEaeZ1/8Dl:WqmJMnxKjieNKLYEEaw/M

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      0f336f04ace148f1dd70a9f020d37848f1855b7a6b6b48a81e25805ef8117e5b

    • Size

      1020KB

    • MD5

      4cc2c1d4268028ca0136799bb36408a0

    • SHA1

      16fbc62b9334ec6c9f423f560c11f276b4d42cc1

    • SHA256

      0f336f04ace148f1dd70a9f020d37848f1855b7a6b6b48a81e25805ef8117e5b

    • SHA512

      901a81c3e62958f7327c9776b8e8181b3313e2042d4d7f75b9cfdc9f43dca4406b2cc2aaae12848256029f75eb56f58219e9add59e0d3bc1c408e6e39a92f2d0

    • SSDEEP

      24576:WB5eCXf8iMnx4GER5XisEshTK0imdCGzEEaeZ1/8Dl:WqmJMnxKjieNKLYEEaw/M

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks