hawkeye

General

Target

2022and2023TaxDocuments.zip
Size

19.8MB
Sample

240524-rs4qaahb5s
MD5

0936e3826a329f3e897ea4018bc6ce3b
SHA1

21b792de20e31dde09df25e35f5abb27654a6624
SHA256

8f395dc9ca7802646cec0791fa6272449371c9ec9867448a004067f2a243d8ce
SHA512

ef2b9c8a30a5a8833580c5ad9a3496cd3926fdac71414fe68e25e4d883544011f590eb7b26656867672f2506537c458ee948472107894e4b0fd6bdbdf4947705
SSDEEP

393216:uUKsNTeHCWNRWHvOuC3GYAkemATX84qc4dUq5RAbncvXUULedMtXM1:IxNAHvDCWX840dUq5KQPUjdd

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

deytrycooldown.duckdns.org:7070

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TYSCJG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  Tax Organizer.exe
- Size
  
  6.1MB
- MD5
  
  4864a55cff27f686023456a22371e790
- SHA1
  
  6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
- SHA256
  
  08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
- SHA512
  
  4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
- SSDEEP
  
  98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Score

10^/10

remcos remotehost persistence rat hawkeye keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2
- Target
  
  msimg32.dll
- Size
  
  45.1MB
- MD5
  
  2b0cd6422137c4f1c4496305467b95c4
- SHA1
  
  a4ede1255abdda3fc27347fc46a0b3b9fd963972
- SHA256
  
  d9ffb32f33d1f16ca20346890449d410edb025a631f40b277c692474ba0c0318
- SHA512
  
  b1e8e238ccabf4be29d862d49191345a52310be178b1eb3b305cb2277877f948c14860a9fb95df1b93b6a01bb234217cc7cddedbd3ebdcd1e92b7ff05dd1a0a6
- SSDEEP
  
  786432:oUP7GCGO7t0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp2:oUP7GCG6iSrkx1hSzYsHQD3t/RY
Score

10^/10

remcos remotehost rat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral3 behavioral4