hawkeye_reborn | 33f05806ab5437e453da7fbf2f5b09ccaf62b98ff22a487167134c728e20102f

General

Target

efa8a674ec587daa8b27235d35aa88b4_JaffaCakes118
Size

814KB
Sample

240921-m755fazajj
MD5

efa8a674ec587daa8b27235d35aa88b4
SHA1

4201655698c49e0d2a3a657c47db0053faf8ea76
SHA256

33f05806ab5437e453da7fbf2f5b09ccaf62b98ff22a487167134c728e20102f
SHA512

f3372a438ad1d9b81f421b17299f7a28e765bf2a82084e7661b10b7496138bf2a9982a58f1c2bd48580b3d37d6107514f9fc4be5a0afe366c95ef672fd1a9c26
SSDEEP

12288:2QhA458jD9Idir4KOHpcLbVprODAU2/3gItbucXDFXrGCjHMqgA3+UOKOQo:vh5gu+7TrODAVgIlugA16EKn

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Targets

- Target
  
  efa8a674ec587daa8b27235d35aa88b4_JaffaCakes118
- Size
  
  814KB
- MD5
  
  efa8a674ec587daa8b27235d35aa88b4
- SHA1
  
  4201655698c49e0d2a3a657c47db0053faf8ea76
- SHA256
  
  33f05806ab5437e453da7fbf2f5b09ccaf62b98ff22a487167134c728e20102f
- SHA512
  
  f3372a438ad1d9b81f421b17299f7a28e765bf2a82084e7661b10b7496138bf2a9982a58f1c2bd48580b3d37d6107514f9fc4be5a0afe366c95ef672fd1a9c26
- SSDEEP
  
  12288:2QhA458jD9Idir4KOHpcLbVprODAU2/3gItbucXDFXrGCjHMqgA3+UOKOQo:vh5gu+7TrODAVgIlugA16EKn
Score

10^/10

hawkeye_reborn m00nd3v_logger discovery infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

M00nD3v Logger payload

Checks computer location settings

Drops startup file

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2