Overview

overview

10

Static

static

3

016pdf.exe

windows7-x64

10

016pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5b200188fe6aa42ef0ebac6ce41e3bf_JaffaCakes118

  • Size

    923KB

  • Sample

    240925-lcd7ssxdrk

  • MD5

    f5b200188fe6aa42ef0ebac6ce41e3bf

  • SHA1

    dfa28c8bc38498a90d5697b2c4c5d8d2ae3cdf2b

  • SHA256

    690189704c2a288bc42ebf2f3b01bf3cc8a1f4d32da49db7ef7e8bcea024aed6

  • SHA512

    739b861951cd42408457692506b731a6b7e2fe09241d0ac1a304693bf7c555d5bfb3925c91487d7b901ee72200a977b71a535eb5af09761ca17b1803a920807f

  • SSDEEP

    24576:2twT0iccYJc1j3z4UXDjdbQ/ZfFQISMAWi2:+wT0iccYJwD4UXDjdbQ//ep2

Score
10/10
hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.1and1.it
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Wako2j22#

Targets

    • Target

      016pdf.exe

    • Size

      965KB

    • MD5

      6b9f05dcb104affe823d856978f70259

    • SHA1

      02e964e74c2c6715cdd06720d471189fd65bf3c1

    • SHA256

      3b02f861b2b13b5f5c3225fbfbdc82bb5848df6435a3a86ef6c0729ab16332ce

    • SHA512

      87aaff3e85110c082c57655391ea039586f0653c2e36df0ae4ea898617b6a67aab972b75578078c6b3387430d93ce714ebe67fd6f3fda738e8b1cb412460dc36

    • SSDEEP

      24576:bQj+XperrOUj6k7ZqC303O4f/YBCbeIbalTUr9geoGL:bQok7ZxsNfgMqIelTUr9geo

    Score
    10/10
    hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks