Extracted

• • Target

    ef962b6dc96472a374447fc8c2e4409c44532d1a446646f3dcd262b95143d0cb.exe

  • Size

    1.0MB

  • MD5

    019a689dcc5128d85718bd043197b311

  • SHA1

    dfed1ea66306d5f8e5e6ac4d6b91b06e4adfeb0b

  • SHA256

    ef962b6dc96472a374447fc8c2e4409c44532d1a446646f3dcd262b95143d0cb

  • SHA512

    6cd55fe3d4c830845317dc9d02783b5616f65f2e10864c52518d75af66f57b02f7d1975bc125cfe916168418a19337960eaa9485622ca8f70da5884b83b09d61

  • SSDEEP

    24576:4WAq81e5JEJFQWvtYG7KddInBz87zqNI++9rY/2uOM/dnuVtfO:8bevEJOWvt37KddIn5872+9M/2JM/dnh

  Score

  10^/10

  hawkeyediscoverykeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2