Overview

overview

10

Static

static

3

f6464616fa...18.exe

windows7-x64

10

f6464616fa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240925-sgjrea1hpr

  • MD5

    f6464616fa6ee2ebcea4a17cf2730417

  • SHA1

    7a8dfdde3b459d5c825509016f238a77eb091bb8

  • SHA256

    072359d782aa0985d459ab4d1082babd289fce5621171ae610637a23790415b3

  • SHA512

    1516b48c0087a3687974187db9d8d038ace19d55957721eacb11b480976286b4ba383b1c7e3a97bb2b5ef0de4ef429bd802d5dfd75ba5b4ddba5264365df9fe1

  • SSDEEP

    24576:EQk4tlz3Vby3FtfnVNSperrOUj6k7ZqC30jzyZFdvugct8+SU2OJbmDGEc:EQk4tlz3Vby3FtfnVN+k7ZxYzUF5ugcd

Score
10/10
hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118

    • Size

      1.1MB

    • MD5

      f6464616fa6ee2ebcea4a17cf2730417

    • SHA1

      7a8dfdde3b459d5c825509016f238a77eb091bb8

    • SHA256

      072359d782aa0985d459ab4d1082babd289fce5621171ae610637a23790415b3

    • SHA512

      1516b48c0087a3687974187db9d8d038ace19d55957721eacb11b480976286b4ba383b1c7e3a97bb2b5ef0de4ef429bd802d5dfd75ba5b4ddba5264365df9fe1

    • SSDEEP

      24576:EQk4tlz3Vby3FtfnVNSperrOUj6k7ZqC30jzyZFdvugct8+SU2OJbmDGEc:EQk4tlz3Vby3FtfnVN+k7ZxYzUF5ugcd

    Score
    10/10
    hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks