hawkeye

General

Target

10482657718.zip
Size

870KB
Sample

230519-g43l9afd99
MD5

f2a69307a30e3b6c0746513193524d51
SHA1

2e69e654326811df979727d2d6449da45f73c453
SHA256

63a8ca2081b5f9766d9d130484e345d6400de1031e653048cd0e55e72f953066
SHA512

656df1a208d746709fd1201713154b80b6642ad66e6ab3dd0ffe03c4c21f53994d69a43f8f8d7e24a491ca5ce4301754122ba47fa225c3454138a56cff7a01b0
SSDEEP

24576:TD4BPw3QlJ8xcONMBGfL8ooUN2+TwQfYN/RLKJzC:X4BPw3amHNMBi5N2+vy5LyC

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.lucd.ru
Port:
21
Username:
[email protected]
Password:
obum@911

Targets

- Target
  
  4e08d3d7a3ecb630ccf016f97a79aab7f44b255484737d574599c25acf0952b2
- Size
  
  1.2MB
- MD5
  
  e488e1a45eb1b7ea061c6a3d9f0729f7
- SHA1
  
  523c99b72980e3a82a20378fe22949b2c2bf43a1
- SHA256
  
  4e08d3d7a3ecb630ccf016f97a79aab7f44b255484737d574599c25acf0952b2
- SHA512
  
  a8398e7323c247c5f5bd4239e44f2037aa03619828b8927c30277651128c392950bfd9a3fe59e946f28b3937b473d0ba86169b1baa52f59ed30f53ac7c8ccd53
- SSDEEP
  
  12288:p0yiHh/Iwu6+pM3BHB0kTp05xm0Nj/RfycXzN/7RPyIoDvS/efj1WI0CVq:pGhNu65fI5/NjJfRpNPz1AR0C
Score

10^/10

evasion hawkeye collection keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Looks for VirtualBox Guest Additions in registry
  evasion
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2