Extracted

• • Target

    0a2f6501a36c1b13532139e3c1843109_JaffaCakes118

  • Size

    870KB

  • MD5

    0a2f6501a36c1b13532139e3c1843109

  • SHA1

    53695f3d912a2a8e3a86791f53e770a0d442fde7

  • SHA256

    890dbc0b99a385173acf639cf13a47544d4041f11ddc0f4df199db6daab9fa86

  • SHA512

    24609d4fd3633d880d8208349f2f729d19b97e91c3d413f8ecab92e809a7ad277e5f76e009034aee1bf13dfc1b8cd9fba8086025e2a08337da9b1d1e27804707

  • SSDEEP

    12288:ILtS8rkT/tKqQYx176wRgQmx/xfk3twIrHzGQsi8BVPr/Brp:IL+T/t2Yz6wRAWKIrTevPrJ

  Score

  10^/10

  hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2