hawkeye_reborn | c17aec1f84a9e118f4ad17718876fc631d6338029f2b671a2c10d9dab9ffd57e

General

Target

2354acc2e08040fdb4e398ea40062da9_JaffaCakes118
Size

779KB
Sample

240508-fs3x7sfa26
MD5

2354acc2e08040fdb4e398ea40062da9
SHA1

8a525b3b5548ed9307c9d6386ee279670f876217
SHA256

c17aec1f84a9e118f4ad17718876fc631d6338029f2b671a2c10d9dab9ffd57e
SHA512

de34ef2dcb88954d6e89d35155ec88abb77f6ea45c2da4484da444199a7d408aaa7af6b680609472f1dbdabcd1ed2aeaf35a27c297889a1cd40ebf56598218ae
SSDEEP

24576:7qRL+nFbsPPfNvSbPWCPYMT76af4RWkF2btD4:7qb9v2uCvxeC

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Targets

- Target
  
  2354acc2e08040fdb4e398ea40062da9_JaffaCakes118
- Size
  
  779KB
- MD5
  
  2354acc2e08040fdb4e398ea40062da9
- SHA1
  
  8a525b3b5548ed9307c9d6386ee279670f876217
- SHA256
  
  c17aec1f84a9e118f4ad17718876fc631d6338029f2b671a2c10d9dab9ffd57e
- SHA512
  
  de34ef2dcb88954d6e89d35155ec88abb77f6ea45c2da4484da444199a7d408aaa7af6b680609472f1dbdabcd1ed2aeaf35a27c297889a1cd40ebf56598218ae
- SSDEEP
  
  24576:7qRL+nFbsPPfNvSbPWCPYMT76af4RWkF2btD4:7qb9v2uCvxeC
Score

10^/10

hawkeye_reborn m00nd3v_logger zgrat collection infostealer keylogger persistence rat spyware stealer trojan
- Detect ZGRat V1
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2