hawkeye_reborn | 8250c4cba2061a09f1b67ef42738e80e488f1fd44dea12b35071c15acdee4f04

General

Target

40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118
Size

739KB
Sample

240514-kb8jksha86
MD5

40d8409d81ecf1e7bef4b135a8eec054
SHA1

aceda599cc1666d7ad67ad4404275b59e1f49cda
SHA256

8250c4cba2061a09f1b67ef42738e80e488f1fd44dea12b35071c15acdee4f04
SHA512

bd48ceaf3c72836e93622afee9b73529475f7d7605187d727c279644dc7a3bb79922df5ecf8422df8ce2392bb3b3f26cd38d8c01a9622a4c9800a3ad13f36fd0
SSDEEP

12288:/6SJGKFYrwBD79S5RQGPDYTnnWe7hPtOiOGb5:/6SPXhIHQGPD+nnp7hVOijF

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Extracted

Credentials

Protocol: smtp
Host:
smtp.zoho.com
Port:
587
Username:
submitted147@zoho.com
Password:
internationallove147

Targets

- Target
  
  40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118
- Size
  
  739KB
- MD5
  
  40d8409d81ecf1e7bef4b135a8eec054
- SHA1
  
  aceda599cc1666d7ad67ad4404275b59e1f49cda
- SHA256
  
  8250c4cba2061a09f1b67ef42738e80e488f1fd44dea12b35071c15acdee4f04
- SHA512
  
  bd48ceaf3c72836e93622afee9b73529475f7d7605187d727c279644dc7a3bb79922df5ecf8422df8ce2392bb3b3f26cd38d8c01a9622a4c9800a3ad13f36fd0
- SSDEEP
  
  12288:/6SJGKFYrwBD79S5RQGPDYTnnWe7hPtOiOGb5:/6SPXhIHQGPD+nnp7hVOijF
Score

10^/10

hawkeye_reborn m00nd3v_logger zgrat agilenet collection infostealer keylogger persistence rat spyware stealer trojan
- Detect ZGRat V1
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2