hawkeye

General

Target

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118
Size

686KB
Sample

240921-gpqn5syajl
MD5

ef30953cbaaa700a085e3cfe29aaff9e
SHA1

8d2b2aea2daa5f43426e0b300b57d86bf20cacb3
SHA256

acd94d6b3021ebdd56e395a37644d6765bd0012d4571714d6d418feeb626d000
SHA512

b21b1a654a7bfe8bc0f3b9995822ab9fc60dca431f231ecccb32ceb40bc478bed315301a2c58f78fab831351d1e4ca1ee2e88dd2d4bafa4eb140f2c6891dd2eb
SSDEEP

12288:ZOFxsG29O71cvz3XMR4tTw9l2177oEKE8wEKLq3R5oKzkU5xgKZkgMUe0WSa:USG2UJcvz3JtTw3E8/B5oESKs0WF

Score

10^/10

Malware Config

Targets

- Target
  
  ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118
- Size
  
  686KB
- MD5
  
  ef30953cbaaa700a085e3cfe29aaff9e
- SHA1
  
  8d2b2aea2daa5f43426e0b300b57d86bf20cacb3
- SHA256
  
  acd94d6b3021ebdd56e395a37644d6765bd0012d4571714d6d418feeb626d000
- SHA512
  
  b21b1a654a7bfe8bc0f3b9995822ab9fc60dca431f231ecccb32ceb40bc478bed315301a2c58f78fab831351d1e4ca1ee2e88dd2d4bafa4eb140f2c6891dd2eb
- SSDEEP
  
  12288:ZOFxsG29O71cvz3XMR4tTw9l2177oEKE8wEKLq3R5oKzkU5xgKZkgMUe0WSa:USG2UJcvz3JtTw3E8/B5oESKs0WF
Score

10^/10

hawkeye collection credential_access discovery keylogger spyware stealer trojan upx
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2