General

  • Target

    87585830c648948e8a4f0721714b1dc7c5c32ab208a70f04eadcd472a5c89586

  • Size

    228KB

  • Sample

    221201-chbt7aec27

  • MD5

    329f6bbcb2a52df13d255d25dc1bce10

  • SHA1

    455e863b1af3e738abdc6c1d5a2743071a75b584

  • SHA256

    87585830c648948e8a4f0721714b1dc7c5c32ab208a70f04eadcd472a5c89586

  • SHA512

    2dd4ab27b676bf157988795e50c066d1d24628ebe477471e9ac3849619f85088b9afd29c078953222d26a28c06303f971ed6877a39a2911e4f616fcb98914e8d

  • SSDEEP

    6144:WpIWTqzmgoJlS5Oz4BS9sqLFuV8G0BjH8K:Wh4mgoJlS5OsGQ8d

Malware Config

Targets

    • Target

      87585830c648948e8a4f0721714b1dc7c5c32ab208a70f04eadcd472a5c89586

    • Size

      228KB

    • MD5

      329f6bbcb2a52df13d255d25dc1bce10

    • SHA1

      455e863b1af3e738abdc6c1d5a2743071a75b584

    • SHA256

      87585830c648948e8a4f0721714b1dc7c5c32ab208a70f04eadcd472a5c89586

    • SHA512

      2dd4ab27b676bf157988795e50c066d1d24628ebe477471e9ac3849619f85088b9afd29c078953222d26a28c06303f971ed6877a39a2911e4f616fcb98914e8d

    • SSDEEP

      6144:WpIWTqzmgoJlS5Oz4BS9sqLFuV8G0BjH8K:Wh4mgoJlS5OsGQ8d

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

3
T1005

Tasks