eye[.]exe | Triage

General

Target

eye.exe
Size

520KB
MD5

b40186916e876be867dd6037c004aad3
SHA1

406285de2f8e61389b7bd31d9dad8d6651af0f82
SHA256

aa95f10c49e042783c3b6a391b3d03f206f270ca11110a8e72e23a85de74836f
SHA512

6f06451b7a43c029e2ffb3cecade0850cd5cc2ac58dea7d9d0051e61400062d2c8464bb68023db72a6427c6a6b463e4d8730dbebdfc059e0afe220f8349f7c4c
SSDEEP

12288:IK5z5eQtqB5urTIoYWBQk1E+VF9mOx9pi:AQtqBorTlYWBhE+V3mO

Score

9^/10

Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource yara_rule

sample Nirsoft
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients

Processes:

resource yara_rule

sample MailPassView
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers

Processes:

resource yara_rule

sample WebBrowserPassView
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

eye.exe

resource	yara_rule
sample	Nirsoft

resource	yara_rule
sample	MailPassView

resource	yara_rule
sample	WebBrowserPassView

resource
eye.exe