hawkeye_reborn | fe89ded0deff6d4827bce7db83100bc4553361a9d03cd0b4440b6b36deb4d4da

General

Target

fe89ded0deff6d4827bce7db83100bc4553361a9d03cd0b4440b6b36deb4d4da
Size

2.2MB
Sample

221130-xzwadabb7z
MD5

70b556029f0b8dfdad375254b78d15cb
SHA1

98e816fcfd9aa3c530323c3b9384009ada68a562
SHA256

fe89ded0deff6d4827bce7db83100bc4553361a9d03cd0b4440b6b36deb4d4da
SHA512

d54450d1b00807465b92ea22c97280602d25c5c4d01faa71c48150a015754acaafd4cfb069ec6182cc9d4b67f9bc06c1955401944726c215313af8a078b3f207
SSDEEP

24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaKxltXzCNMkaZi9yaT0be+0bf++dcMf1lH5:Uh+ZkldoPK8YaKWbf1Wcz

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Mutex

1eca0552-b776-470b-a3ec-98937ece378e

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:3 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:1eca0552-b776-470b-a3ec-98937ece378e _PanelSecret:e8346ab4-0dd7-ccdd-1f4e-95faaf575a58 _PanelURL:http://redafire.ml/afrika/ _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  fe89ded0deff6d4827bce7db83100bc4553361a9d03cd0b4440b6b36deb4d4da
- Size
  
  2.2MB
- MD5
  
  70b556029f0b8dfdad375254b78d15cb
- SHA1
  
  98e816fcfd9aa3c530323c3b9384009ada68a562
- SHA256
  
  fe89ded0deff6d4827bce7db83100bc4553361a9d03cd0b4440b6b36deb4d4da
- SHA512
  
  d54450d1b00807465b92ea22c97280602d25c5c4d01faa71c48150a015754acaafd4cfb069ec6182cc9d4b67f9bc06c1955401944726c215313af8a078b3f207
- SSDEEP
  
  24576:lAHnh+eWsN3skA4RV1Hom2KXMmHaKxltXzCNMkaZi9yaT0be+0bf++dcMf1lH5:Uh+ZkldoPK8YaKWbf1Wcz
Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2