Extracted

• • Target

    JaffaCakes118_d20844f7f82848085df63514a477428f6e2a1d358baa559e920491ac870e8dc0

  • Size

    752KB

  • MD5

    5cf8a37d6e8b87e7a935189c166a2592

  • SHA1

    074a49d7e1f6d6ac14803f6fa92ae0af482a42ea

  • SHA256

    d20844f7f82848085df63514a477428f6e2a1d358baa559e920491ac870e8dc0

  • SHA512

    477f70b1d1f4b7c597b5cfc63e08368981c8d8055feb293b57f9dc9777cd18ba870bebbdf79ded7e2bb2c04be3b0e9adbcc596e8a2ca58831d469206a77dea49

  • SSDEEP

    12288:GlQtqB5urTIoYWBQk1E+VF9mOx9AAXn5JLlg/wcaDcER90e7pavO:GlQtqBorTlYWBhE+V3mOYu5JxgawEae1

  Score

  10^/10

  hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Hawkeye family

    hawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2