Overview

overview

10

Static

static

3

1e95e087dd...37.exe

windows7-x64

10

1e95e087dd...37.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e95e087ddc336bc8cc038866c629537

  • Size

    411KB

  • Sample

    231230-2g47safbc5

  • MD5

    1e95e087ddc336bc8cc038866c629537

  • SHA1

    68ff0f62b626aae7f11d5a1d7e2f7906cbe1a606

  • SHA256

    567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4

  • SHA512

    5e999094124243fccb6ed9f4eda9df203e527ca48c6d01126258b16c9f9b2546e6e4bb9a89db6b8e49cab71f3ec8625e42d2f3245603d0e3229df6b766ce0c15

  • SSDEEP

    12288:nPCNpaWbDrPHwfoXjRrPzD1lbMoKGRtq:Pd+8Uj5PnjbMoKD

Score
10/10
hawkeyekeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      1e95e087ddc336bc8cc038866c629537

    • Size

      411KB

    • MD5

      1e95e087ddc336bc8cc038866c629537

    • SHA1

      68ff0f62b626aae7f11d5a1d7e2f7906cbe1a606

    • SHA256

      567b94bcdaea498b72ea3b4193d16a0eeb6807a02fefe59b9b87d0ae03d8dcd4

    • SHA512

      5e999094124243fccb6ed9f4eda9df203e527ca48c6d01126258b16c9f9b2546e6e4bb9a89db6b8e49cab71f3ec8625e42d2f3245603d0e3229df6b766ce0c15

    • SSDEEP

      12288:nPCNpaWbDrPHwfoXjRrPzD1lbMoKGRtq:Pd+8Uj5PnjbMoKD

    Score
    10/10
    hawkeyekeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks