Extracted

• • Target

    56943fd830e1fbe970804fdcd4ccea3b_JaffaCakes118

  • Size

    200KB

  • MD5

    56943fd830e1fbe970804fdcd4ccea3b

  • SHA1

    1d21f47c75b34245a2618a1f6b37af243ef09a42

  • SHA256

    40dc7398d7d13bc5f0b32325f264e8cb255d2c022c5df3a29a9d6932fbf5d6b6

  • SHA512

    e4bab363046c656da04e39b511b499c89423a54a6a212d948ae25993e99bfa8f2100da9e81ef0814ed0c9d398fe710383bfc0fb205f6d4cbc0d366652291a408

  • SSDEEP

    3072:cV5j6QTDgiEIDL5ntDnj/rlIudpB8gkgqXEoqGxT0S+iVjv:Kthvg8DL5ntb7hBkgXoZxT5j

  Score

  10^/10

  hawkeyekeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2