hawkeye_reborn | 314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42

General

Target

6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118
Size

900KB
Sample

240524-k4zgdacb84
MD5

6dff832f07ea61ef0fa90d148cf09509
SHA1

6831f7896e97c992593474731cbfa6fb1a45e698
SHA256

314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42
SHA512

7cf036e2238e280da5f2b2d3134f80ddd10cc90fdbba7115bed4dcd038cf61026db81757c3ba968cec0378334cada10ea7ae673be6d9bbb875c78798f6ed9047
SSDEEP

24576:KKOQZ1K7cdUIV4+M3EaRfUP6KbHkLYzCcpYsK5LExBMS:KKOQG7cVM3r1iHFzCMYskIw

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Targets

- Target
  
  6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118
- Size
  
  900KB
- MD5
  
  6dff832f07ea61ef0fa90d148cf09509
- SHA1
  
  6831f7896e97c992593474731cbfa6fb1a45e698
- SHA256
  
  314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42
- SHA512
  
  7cf036e2238e280da5f2b2d3134f80ddd10cc90fdbba7115bed4dcd038cf61026db81757c3ba968cec0378334cada10ea7ae673be6d9bbb875c78798f6ed9047
- SSDEEP
  
  24576:KKOQZ1K7cdUIV4+M3EaRfUP6KbHkLYzCcpYsK5LExBMS:KKOQG7cVM3r1iHFzCMYskIw
Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger persistence spyware stealer trojan collection
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2