Extracted

• • Target

    1364992369a3d4b3b9fde7bd25887335_JaffaCakes118

  • Size

    937KB

  • MD5

    1364992369a3d4b3b9fde7bd25887335

  • SHA1

    74d4425da265cca1b665daee821cced920289a16

  • SHA256

    39da82aec5faf855d0e6c320cf9381f5f01f08dd4eb149790a07d71ea5f9fa95

  • SHA512

    8d92a3fd67e19e6bbc9d529cd07999a4deecb761bf5c7aa1fc8af64e4e526a22fe549d07bdef4590ced3f5350c4de514857306848b6ab955de1399e16eeed782

  • SSDEEP

    12288:36o/xuDT9T8aP8dSfWy8i/bvKziF7j2w2BTwR6ry9msEUOOgGwbP8u7:k3QXy8i/bvkTHry9m/UOOgGcV

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2