General

  • Target

    2354acc2e08040fdb4e398ea40062da9_JaffaCakes118

  • Size

    779KB

  • Sample

    240508-fs3x7sfa26

  • MD5

    2354acc2e08040fdb4e398ea40062da9

  • SHA1

    8a525b3b5548ed9307c9d6386ee279670f876217

  • SHA256

    c17aec1f84a9e118f4ad17718876fc631d6338029f2b671a2c10d9dab9ffd57e

  • SHA512

    de34ef2dcb88954d6e89d35155ec88abb77f6ea45c2da4484da444199a7d408aaa7af6b680609472f1dbdabcd1ed2aeaf35a27c297889a1cd40ebf56598218ae

  • SSDEEP

    24576:7qRL+nFbsPPfNvSbPWCPYMT76af4RWkF2btD4:7qb9v2uCvxeC

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      2354acc2e08040fdb4e398ea40062da9_JaffaCakes118

    • Size

      779KB

    • MD5

      2354acc2e08040fdb4e398ea40062da9

    • SHA1

      8a525b3b5548ed9307c9d6386ee279670f876217

    • SHA256

      c17aec1f84a9e118f4ad17718876fc631d6338029f2b671a2c10d9dab9ffd57e

    • SHA512

      de34ef2dcb88954d6e89d35155ec88abb77f6ea45c2da4484da444199a7d408aaa7af6b680609472f1dbdabcd1ed2aeaf35a27c297889a1cd40ebf56598218ae

    • SSDEEP

      24576:7qRL+nFbsPPfNvSbPWCPYMT76af4RWkF2btD4:7qb9v2uCvxeC

    • Detect ZGRat V1

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • M00nD3v Logger payload

      Detects M00nD3v Logger payload in memory.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks