hawkeye

General

Target

bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118
Size

488KB
Sample

241204-apdagssje1
MD5

bff16109db65192d6e3fff0cebb1fa5e
SHA1

a75c7bcb37fcca2d33604fd7356dbd983b38e586
SHA256

7ae95e4755b985d74dea31bf4c7e8e4d9dc825c358c3b4ec55882ed7ac206538
SHA512

fa03aa08a54590b2b7d712d8c745a6969b94fb83093fa6ba7ba5b1b38a7b95ed0e7eaed4b9edbb68a35a6414e9943d9b989f73b95381fade486501911d23fe07
SSDEEP

12288:rUlqSgqhJvfke4HU5K+Dy6lSC8u8yN0sqpwRc+EPW2Oh:rq9RvQqu6lSIjNlqFfe26

Score

10^/10

Malware Config

Targets

- Target
  
  bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118
- Size
  
  488KB
- MD5
  
  bff16109db65192d6e3fff0cebb1fa5e
- SHA1
  
  a75c7bcb37fcca2d33604fd7356dbd983b38e586
- SHA256
  
  7ae95e4755b985d74dea31bf4c7e8e4d9dc825c358c3b4ec55882ed7ac206538
- SHA512
  
  fa03aa08a54590b2b7d712d8c745a6969b94fb83093fa6ba7ba5b1b38a7b95ed0e7eaed4b9edbb68a35a6414e9943d9b989f73b95381fade486501911d23fe07
- SSDEEP
  
  12288:rUlqSgqhJvfke4HU5K+Dy6lSC8u8yN0sqpwRc+EPW2Oh:rq9RvQqu6lSIjNlqFfe26
Score

10^/10

hawkeye collection discovery keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Hawkeye family

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Uses the VBS compiler for execution

Accesses Microsoft Outlook accounts

Drops desktop.ini file(s)

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2