General
-
Target
d5ea316da41904c647d59e0eeb167f97_JaffaCakes118
-
Size
766KB
-
Sample
240909-jv7kys1bra
-
MD5
d5ea316da41904c647d59e0eeb167f97
-
SHA1
e5f06ea3d9f059ad267c476b59df3eec50ffd60e
-
SHA256
bf63f9c5c45d521d910d2f6aaabc359fa508fdd58f8b24a7c2ba51ab6125103e
-
SHA512
95b3017120bbf2e1d5c24d41895f65d8dea6111415d4307b6c1f138f15002f487fe0e80d15e266eda1117e254226341eafdffa498f112c8a996949b4bdc2b6e9
-
SSDEEP
12288:YTpSOI3LmcXkvqjty8vgtoRt2BpzXsswFWBUhyO2jWEt8huvJ1MVKAV4mfxJ:PLCG5y8vgtCCpxwF869vEGVKABj
Malware Config
Targets
-
-
Target
d5ea316da41904c647d59e0eeb167f97_JaffaCakes118
-
Size
766KB
-
MD5
d5ea316da41904c647d59e0eeb167f97
-
SHA1
e5f06ea3d9f059ad267c476b59df3eec50ffd60e
-
SHA256
bf63f9c5c45d521d910d2f6aaabc359fa508fdd58f8b24a7c2ba51ab6125103e
-
SHA512
95b3017120bbf2e1d5c24d41895f65d8dea6111415d4307b6c1f138f15002f487fe0e80d15e266eda1117e254226341eafdffa498f112c8a996949b4bdc2b6e9
-
SSDEEP
12288:YTpSOI3LmcXkvqjty8vgtoRt2BpzXsswFWBUhyO2jWEt8huvJ1MVKAV4mfxJ:PLCG5y8vgtCCpxwF869vEGVKABj
Score10/10-
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-