hawkeye_reborn | 923a10cd5a45810a4f50fd88d630835d7476183ff53e2056e7e2b71cbc488684

General

Target

fccd0412b43c70093795a08fe43a7d31_JaffaCakes118
Size

908KB
Sample

240928-v4a4wszgpf
MD5

fccd0412b43c70093795a08fe43a7d31
SHA1

3bfd27edafa752ac7b3ecf1337b3ff49ad586d4b
SHA256

923a10cd5a45810a4f50fd88d630835d7476183ff53e2056e7e2b71cbc488684
SHA512

afed0e9cc6b456dd8709b790889a0d76a059c365309dcf6d60879851b13af898be24aa72c2ee59618a751e138089fd2e158412ae52a21cf44f8d563a815464e7
SSDEEP

24576:0Km0WEP4Ta9RSCNnLGoptNYfnZLEHueU4lAI:bmtzTarSFc

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.strutnfittings.com
Port:
587
Username:
exports@strutnfittings.com
Password:
goingtocanada@123

Mutex

0a4e8db0-c3ae-49d8-8c2a-5d959cbbdeff

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:goingtocanada@123 _EmailPort:587 _EmailSSL:true _EmailServer:mail.strutnfittings.com _EmailUsername:exports@strutnfittings.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:0a4e8db0-c3ae-49d8-8c2a-5d959cbbdeff _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  fccd0412b43c70093795a08fe43a7d31_JaffaCakes118
- Size
  
  908KB
- MD5
  
  fccd0412b43c70093795a08fe43a7d31
- SHA1
  
  3bfd27edafa752ac7b3ecf1337b3ff49ad586d4b
- SHA256
  
  923a10cd5a45810a4f50fd88d630835d7476183ff53e2056e7e2b71cbc488684
- SHA512
  
  afed0e9cc6b456dd8709b790889a0d76a059c365309dcf6d60879851b13af898be24aa72c2ee59618a751e138089fd2e158412ae52a21cf44f8d563a815464e7
- SSDEEP
  
  24576:0Km0WEP4Ta9RSCNnLGoptNYfnZLEHueU4lAI:bmtzTarSFc
Score

10^/10

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger spyware stealer trojan
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Drops startup file
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

HawkEye Reborn

M00nd3v_Logger

Detected Nirsoft tools

M00nD3v Logger payload

NirSoft MailPassView

NirSoft WebBrowserPassView

Drops startup file

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.