Overview

overview

10

Static

static

3

0e0ea9d429...18.exe

windows7-x64

10

0e0ea9d429...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e0ea9d429fa54e7ca87d9b2ced3bb8c_JaffaCakes118

  • Size

    729KB

  • Sample

    240625-pkep3szaqg

  • MD5

    0e0ea9d429fa54e7ca87d9b2ced3bb8c

  • SHA1

    7e187475cf9e1478d0ed4e6678ecfdc5844626a4

  • SHA256

    76c043ac044f732861301ba2bd9af9ab99540311d660c55e7b4537e4d7ac3f76

  • SHA512

    fe03ff95063e10682a8885e081ca9d1fa252c4b81caf7139e78c47420375c06d0b14e22f993e59dbb6c0bf09b6363c7ba51a9f546714ccaa888b895374a32d59

  • SSDEEP

    12288:NTwZUC/WMY+PAJem5QCWpFRLQ4Zqe+q04iZtiQjOcfu5KQ:NOUX/eJm55KFRU4Zqer04iHjOcfu5D

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      0e0ea9d429fa54e7ca87d9b2ced3bb8c_JaffaCakes118

    • Size

      729KB

    • MD5

      0e0ea9d429fa54e7ca87d9b2ced3bb8c

    • SHA1

      7e187475cf9e1478d0ed4e6678ecfdc5844626a4

    • SHA256

      76c043ac044f732861301ba2bd9af9ab99540311d660c55e7b4537e4d7ac3f76

    • SHA512

      fe03ff95063e10682a8885e081ca9d1fa252c4b81caf7139e78c47420375c06d0b14e22f993e59dbb6c0bf09b6363c7ba51a9f546714ccaa888b895374a32d59

    • SSDEEP

      12288:NTwZUC/WMY+PAJem5QCWpFRLQ4Zqe+q04iZtiQjOcfu5KQ:NOUX/eJm55KFRU4Zqer04iHjOcfu5D

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks