Extracted

• • Target

    NO#CU-92504 Xls.exe

  • Size

    1.1MB

  • MD5

    59d184058f8e0a314db11d6f07f600fd

  • SHA1

    5e4b55295fd2b4cc5965fa1e8b322260c5d2a2b6

  • SHA256

    65df886edbea1a5bc833dba4e8e5126ad6326fa44f49e146a9c4b8b34fe75333

  • SHA512

    94adda18b842f927693d6831becbb10c249867c466cb3f2659dc1def9ae05024c7d8cf8a4567fc19f5a1c67495a7994010e1e3e3b3f7784f55f8f7916e190d8c

  • SSDEEP

    24576:mZRToVSu+nsc24YQeP18a5v8UKyd0c7u3yd2OluON4fA9uC:mZRToAu+ns082evFbdLu3yd2OluON4ff

  Score

  10^/10

  hawkeyecollectionevasionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2