Overview

overview

10

Static

static

10

85efbbd924...18.exe

windows7-x64

9

85efbbd924...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85efbbd9244db86c7fd1f8414724d6f9_JaffaCakes118

  • Size

    552KB

  • Sample

    240531-erfwlsff73

  • MD5

    85efbbd9244db86c7fd1f8414724d6f9

  • SHA1

    124179c4c6799c497e22d8e50b242c850b6d03a2

  • SHA256

    699a6aac01b01c35c3c5da0825339fbf481ce2d39fd4546dc99eda9729954ca3

  • SHA512

    c94fbf6812149e361531b710867050ca55b22432df61860351b8dc4602acf8e0af7ba4592afc7e155c7e75b4545defcc3eaf05ed5c89795a6cbd67b74c57614e

  • SSDEEP

    12288:k9rD+H23OO3n/LpPxM35B9qgObN8F6qlfNUqIFzGRIF6nj1K20XdDixi8B7xDFC6:irDF3ln/Llib0J2

Score
10/10
hawkeye_rebornm00nd3v_loggercollectioninfostealer

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.zoho.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    fidelis165

Targets

    • Target

      85efbbd9244db86c7fd1f8414724d6f9_JaffaCakes118

    • Size

      552KB

    • MD5

      85efbbd9244db86c7fd1f8414724d6f9

    • SHA1

      124179c4c6799c497e22d8e50b242c850b6d03a2

    • SHA256

      699a6aac01b01c35c3c5da0825339fbf481ce2d39fd4546dc99eda9729954ca3

    • SHA512

      c94fbf6812149e361531b710867050ca55b22432df61860351b8dc4602acf8e0af7ba4592afc7e155c7e75b4545defcc3eaf05ed5c89795a6cbd67b74c57614e

    • SSDEEP

      12288:k9rD+H23OO3n/LpPxM35B9qgObN8F6qlfNUqIFzGRIF6nj1K20XdDixi8B7xDFC6:irDF3ln/Llib0J2

    Score
    10/10
    collection

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks