General
-
Target
2aca79fda2f8a1921295b09bd486de16_JaffaCakes118
-
Size
808KB
-
Sample
240509-tps6gsdg94
-
MD5
2aca79fda2f8a1921295b09bd486de16
-
SHA1
0e6bf9c82791862d69836bd14aceca46841bf53a
-
SHA256
19c68f9e178765d9676476754db29a351eb8eebf905bb97b95e0c954520052a5
-
SHA512
7408354fec602fac9e16b16220d657ced49c39be7a365dd10d6c77c0d955bfce9249520288ded3f454d30e7c38d00b9f615e0b2ffc4cc37ec08498ba793f515e
-
SSDEEP
12288:D/YzK338/LgnU7wz9yl084/hAQR/8Hcmy6ZzPa8csxEU6LRHb6+js+:kz//Lg5cf4/hVR/88GZO8vOU2Hb6+s+
Malware Config
Extracted
hawkeye_reborn
- fields
- name
Targets
-
-
Target
2aca79fda2f8a1921295b09bd486de16_JaffaCakes118
-
Size
808KB
-
MD5
2aca79fda2f8a1921295b09bd486de16
-
SHA1
0e6bf9c82791862d69836bd14aceca46841bf53a
-
SHA256
19c68f9e178765d9676476754db29a351eb8eebf905bb97b95e0c954520052a5
-
SHA512
7408354fec602fac9e16b16220d657ced49c39be7a365dd10d6c77c0d955bfce9249520288ded3f454d30e7c38d00b9f615e0b2ffc4cc37ec08498ba793f515e
-
SSDEEP
12288:D/YzK338/LgnU7wz9yl084/hAQR/8Hcmy6ZzPa8csxEU6LRHb6+js+:kz//Lg5cf4/hVR/88GZO8vOU2Hb6+s+
Score10/10-
Detect Neshta payload
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
M00nD3v Logger payload
Detects M00nD3v Logger payload in memory.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-