Overview

overview

10

Static

static

6a9faed97c...e3.exe

windows7-x64

1

6a9faed97c...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a9faed97c65cd7e338e335241462f243c19af7d53a6ce174dc4ee2ea0f867e3

  • Size

    1.3MB

  • Sample

    230129-y4wmdabh83

  • MD5

    faddfed80b84a4f3746f1282b6a10c0b

  • SHA1

    69d201cf3c90bdc31cc65b53bf0727e80554575c

  • SHA256

    6a9faed97c65cd7e338e335241462f243c19af7d53a6ce174dc4ee2ea0f867e3

  • SHA512

    00beeb0fe6b854e95e07810142b255b5b1a659990c67a030325dd77482d2f1cc32daad62d732b0ecaceb6d854dc640ae1738e2f49b6b2963e4336c9599889dc2

  • SSDEEP

    24576:lz2WYQOPkRIoqmh+wxJOYAVI9NSD9zr61T3pCPJm+FEAtNfMGG:IHkg8ZAVZD9ET5CPJ13nG

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      6a9faed97c65cd7e338e335241462f243c19af7d53a6ce174dc4ee2ea0f867e3

    • Size

      1.3MB

    • MD5

      faddfed80b84a4f3746f1282b6a10c0b

    • SHA1

      69d201cf3c90bdc31cc65b53bf0727e80554575c

    • SHA256

      6a9faed97c65cd7e338e335241462f243c19af7d53a6ce174dc4ee2ea0f867e3

    • SHA512

      00beeb0fe6b854e95e07810142b255b5b1a659990c67a030325dd77482d2f1cc32daad62d732b0ecaceb6d854dc640ae1738e2f49b6b2963e4336c9599889dc2

    • SSDEEP

      24576:lz2WYQOPkRIoqmh+wxJOYAVI9NSD9zr61T3pCPJm+FEAtNfMGG:IHkg8ZAVZD9ET5CPJ13nG

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks