Overview

overview

10

Static

static

3

Bill of La...DF.exe

windows7-x64

10

Bill of La...DF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aec6543421c86bd2dabd570544aa3266_JaffaCakes118

  • Size

    754KB

  • Sample

    240615-rdms8axbkr

  • MD5

    aec6543421c86bd2dabd570544aa3266

  • SHA1

    6af9a1a57b885a7010c4c8e1212170c880568d9b

  • SHA256

    1f4a6c8c26bfc7816cec59c19392d56fd255574d25170f50e7384db1a5ff7aad

  • SHA512

    79f4602c616f58ecf00afe21d2e3aee16eaee49b87041600465ba5d10a6124921c4ef1b5c2430f25287624d518fff8560e1fec2b4dcad10d7da3d202e041688e

  • SSDEEP

    12288:7FwVbZVN71EFbMOoeECHOWmy0E9Rl6Qp7yKg3DvmfZG87FNiMLDEsmbUcQyBClK:apNJBijHfb9Rl6Q1yKqDOrFN5Aw1lK

Score
10/10
hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Targets

    • Target

      Bill of Lading 849393_PDF.exe

    • Size

      1.2MB

    • MD5

      73c2cd286f7fd036ddd063bc13625f52

    • SHA1

      6b75d16f137ee336bed4c0bc04ce0a1edcfb735c

    • SHA256

      1e2d1f6aa0d7209265b92faa2a4665d1906bffb20f2521134ef1fd6e87624b1a

    • SHA512

      67d714d339f149499cf8c7df1814d0e2091ca1932b3c1fed43df810c6ff5a484c49b8d2eaa609568b353e3c6f2f0ffca55a37d30faf43bf43aa3d057f39eb035

    • SSDEEP

      24576:IPJU+Pdx5J0XIcfkfvizNE5EbUR7tenbuuK:IPe+V6Rcfviz5bMeu

    Score
    10/10
    hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

    • HawkEye Reborn

      HawkEye Reborn is an enhanced version of the HawkEye malware kit.

      keyloggertrojanstealerspywarehawkeye_reborn

    • M00nd3v_Logger

      M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarem00nd3v_logger

    • M00nD3v Logger payload

      Detects M00nD3v Logger payload in memory.

      infostealer

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks