hawkeye

General

Target

ddfc57b8fd3e5e0f81dee8ead0e38518
Size

964KB
Sample

240325-persfsac3v
MD5

ddfc57b8fd3e5e0f81dee8ead0e38518
SHA1

ca35000ed1844f30e932d8903633e4beb519967f
SHA256

c1cd0692836798f5cb7e9335f4547a2650b77cf456193cbe7e384906a20c0603
SHA512

083bc3c27ddefbf541b91ef71728a2e3831563be171f4d7ca63dea9e04357533d2bf345c7ccdced551cc8220826d79f894b43f1de2ae8d3fd17a39c1bf838fcc
SSDEEP

12288:MeTvtJpA3OXv2BFokZRhXQ5TZaRPlPO0E09wrp:MeDtJSO/2ffxA5TZaP20Eh9

Score

10^/10

Malware Config

Targets

- Target
  
  ddfc57b8fd3e5e0f81dee8ead0e38518
- Size
  
  964KB
- MD5
  
  ddfc57b8fd3e5e0f81dee8ead0e38518
- SHA1
  
  ca35000ed1844f30e932d8903633e4beb519967f
- SHA256
  
  c1cd0692836798f5cb7e9335f4547a2650b77cf456193cbe7e384906a20c0603
- SHA512
  
  083bc3c27ddefbf541b91ef71728a2e3831563be171f4d7ca63dea9e04357533d2bf345c7ccdced551cc8220826d79f894b43f1de2ae8d3fd17a39c1bf838fcc
- SSDEEP
  
  12288:MeTvtJpA3OXv2BFokZRhXQ5TZaRPlPO0E09wrp:MeDtJSO/2ffxA5TZaP20Eh9
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2