Extracted

• • Target

    d3bb26ad40577d090dff6aa75885be1e29d4ca66d6579d6bd8bc69f51285706b

  • Size

    664KB

  • MD5

    9a84ed89e2a19d23228d415448d78b7d

  • SHA1

    71cb093efeddc214c36c1e3f6ad20d41051c21fa

  • SHA256

    d3bb26ad40577d090dff6aa75885be1e29d4ca66d6579d6bd8bc69f51285706b

  • SHA512

    86d1f36d701af60f82e7de57c0516f7ced8067a186f959c65478602472f46358cd5af6af93af0cfcd94940437e99f8923e4c2a4fee76c9a6133540514125d678

  • SSDEEP

    12288:wcBwhx9C0kfoaHzkHZ+KGo5HwPJRnBNS85CPnhS+p:RBwhx9PoHw+OHwvnBLMPnhS+

  Score

  10^/10

  hawkeyecollectiondiscoverykeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Hawkeye family

    hawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2