Extracted

• • Target

    4625e41f7ccbd1ab169d665121034752_JaffaCakes118

  • Size

    577KB

  • MD5

    4625e41f7ccbd1ab169d665121034752

  • SHA1

    06a854a453a6bb5d64df476044140d1428fd35f9

  • SHA256

    ff573280232ed2fb078b7ac91b816d2d847e6955f321a9afc8ad4e0cc6bd7793

  • SHA512

    9556bf88284b9fa6fd00ec168303fec197a9ff2ff1981cd008f2f0ea7e70f13ee9f61959e82fd5a428753b3f6affa9de0b98df9bc93f428d1f55836c2574bbaf

  • SSDEEP

    12288:IAhIUe6GgzZ9mlpJHMaxqh1w4KiHWq/79mgPADXApwGq:IAhIHPoZ9EJsaxaRHvHlwGq

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerdefense_evasiondiscoveryinfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2