hawkeye

General

Target

c2679d748341e1ab35a991585fd750c3_JaffaCakes118
Size

993KB
Sample

240826-glms3szdqp
MD5

c2679d748341e1ab35a991585fd750c3
SHA1

a36fa10943f300b249014a6f6bc46518ec95403b
SHA256

937d34b17a22293e537fbca84db1569fa6ebe32b176a388c5f576ac7af235006
SHA512

9349bc5fed652b9835fd2fa0d360b300679d7a51ef29eec47ee5f71cb3cfddf77a64749d297376d6ff6fcacdf8e772f6ce66360f6b621019cc3a50743b27121d
SSDEEP

24576:5hgNnxEfGs7utip+ZGI9+dFLcUAg4vLW4XpIfY:P/fGs7/oZGI9+dFjAg4y4Zo

Score

10^/10

Malware Config

Targets

- Target
  
  c2679d748341e1ab35a991585fd750c3_JaffaCakes118
- Size
  
  993KB
- MD5
  
  c2679d748341e1ab35a991585fd750c3
- SHA1
  
  a36fa10943f300b249014a6f6bc46518ec95403b
- SHA256
  
  937d34b17a22293e537fbca84db1569fa6ebe32b176a388c5f576ac7af235006
- SHA512
  
  9349bc5fed652b9835fd2fa0d360b300679d7a51ef29eec47ee5f71cb3cfddf77a64749d297376d6ff6fcacdf8e772f6ce66360f6b621019cc3a50743b27121d
- SSDEEP
  
  24576:5hgNnxEfGs7utip+ZGI9+dFLcUAg4vLW4XpIfY:P/fGs7/oZGI9+dFjAg4y4Zo
Score

10^/10

hawkeye collection credential_access discovery keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2