hawkeye

General

Target

d4e56599498e8ca64363329d11b2c2d4_JaffaCakes118
Size

2.2MB
Sample

240908-v5l8jsycmk
MD5

d4e56599498e8ca64363329d11b2c2d4
SHA1

86b5f8f48e6ff22031e4bfde6cc709421c5ba753
SHA256

2b68ea22dbc7e66ee13c583dfa62e85df53a1a03aa34b3d1b0d96ae3185c7711
SHA512

9d5ff46578340ca74da5290f1e4449a770e20dc2c715ff00db00950aecc0c70e9064543ffa87a2e4af36a43d51a7bae1c57708482b5a7b2893b0d3a5389b1147
SSDEEP

49152:QWr3uYv+f7aKUKXLsFwM/vsv/wIBkCUcRmVsIK3Qp18YYu:jaYvKuKXL69nsv/dCwIKgkBu

Score

10^/10

Malware Config

Targets

- Target
  
  d4e56599498e8ca64363329d11b2c2d4_JaffaCakes118
- Size
  
  2.2MB
- MD5
  
  d4e56599498e8ca64363329d11b2c2d4
- SHA1
  
  86b5f8f48e6ff22031e4bfde6cc709421c5ba753
- SHA256
  
  2b68ea22dbc7e66ee13c583dfa62e85df53a1a03aa34b3d1b0d96ae3185c7711
- SHA512
  
  9d5ff46578340ca74da5290f1e4449a770e20dc2c715ff00db00950aecc0c70e9064543ffa87a2e4af36a43d51a7bae1c57708482b5a7b2893b0d3a5389b1147
- SSDEEP
  
  49152:QWr3uYv+f7aKUKXLsFwM/vsv/wIBkCUcRmVsIK3Qp18YYu:jaYvKuKXL69nsv/dCwIKgkBu
Score

10^/10

hawkeye collection credential_access discovery keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2