Extracted

• • Target

    45edc00783917c5995cb40ffe6a82b74

  • Size

    1.1MB

  • MD5

    45edc00783917c5995cb40ffe6a82b74

  • SHA1

    62f4563a5d19b33135192e712ec56348fa64511f

  • SHA256

    cc05b8bfca420cf34c2f8625a43cc83914d507b8c9b65f466df0a3d7030c970b

  • SHA512

    b555f139e10775a481abca83ed1b17a97bf04f227ef2caa3a3404adc6587c96c8b4e9aae04e195c4f8b8004feda7fa2f5caa0b77301fdad9cf10158459c22d1f

  • SSDEEP

    12288:ilO6vQM/PuwMpPMasrHwUFjq16QYBh0RLUXusY+hVKt8Dl5YchUJlyAKp:muoPu1dMasrnFAiQUc+PKeDDJUlWp

  Score

  10^/10

  hawkeyecollectionkeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2