Extracted

• • Target

    9c9076bf7875c42873d4f1e05e11717b9313bfbb5cd947de24b59f8dda320d8bN

  • Size

    520KB

  • MD5

    9a0ded7bd7eb2b4924980415aa0d91e0

  • SHA1

    ba0be5ce193aeadcc66c5aa766644b093b5d369b

  • SHA256

    9c9076bf7875c42873d4f1e05e11717b9313bfbb5cd947de24b59f8dda320d8b

  • SHA512

    1be673310a0cbbf0d1f3187998aae3820e8fa23030b26e7bc40f74f8419c67b6b2b5ee01b53d6c6c8aa2be2e417f9c466d7333344171775f3b1fa5f043c7aae0

  • SSDEEP

    6144:Euuqk0fhubS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnxE:vhuQtqB5urTIoYWBQk1E+VF9mOx9Ni

  Score

  10^/10

  hawkeyecollectiondiscoverykeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2