hawkeye

General

Target

179b219afa2ac15b14affd399273148b_JaffaCakes118
Size

700KB
Sample

241006-lwzmvasbmb
MD5

179b219afa2ac15b14affd399273148b
SHA1

00c21b3b3400b2296d773966630f5a2a9f325652
SHA256

590397ffebbc978f25e3d0c1faefcd710a6321884f1155f450f148e1fee3062b
SHA512

1ae8c495c1394b6e79887f481699f6b00f9f9209df5beb5732f12bb6adbbc702ade681db5a980d11818621ad5bfaebb16ace58141dd9e4470766fa60cfe8d560
SSDEEP

12288:qFDv2ytr/45N0jZ3D3seqRxQaB7tOHoUvBK:qFyyBQiB3zq3Qu7tOBw

Score

10^/10

Malware Config

Targets

- Target
  
  179b219afa2ac15b14affd399273148b_JaffaCakes118
- Size
  
  700KB
- MD5
  
  179b219afa2ac15b14affd399273148b
- SHA1
  
  00c21b3b3400b2296d773966630f5a2a9f325652
- SHA256
  
  590397ffebbc978f25e3d0c1faefcd710a6321884f1155f450f148e1fee3062b
- SHA512
  
  1ae8c495c1394b6e79887f481699f6b00f9f9209df5beb5732f12bb6adbbc702ade681db5a980d11818621ad5bfaebb16ace58141dd9e4470766fa60cfe8d560
- SSDEEP
  
  12288:qFDv2ytr/45N0jZ3D3seqRxQaB7tOHoUvBK:qFyyBQiB3zq3Qu7tOBw
Score

10^/10

hawkeye collection discovery keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2