Extracted

• • Target

    JaffaCakes118_c5dd5ba625b942dcad80736365e058c985beb641f2d3f69c09a35c95a5c956e1

  • Size

    520KB

  • MD5

    f6803d370eee188ce5344d21a28fe01b

  • SHA1

    547e8079d8f8b5e4d3a2cab261c97806b87365da

  • SHA256

    c5dd5ba625b942dcad80736365e058c985beb641f2d3f69c09a35c95a5c956e1

  • SHA512

    eb60821819a7c5268046db7f5e64cbfb9663bd6be26640d4a8bf6c4e36d28012f2c24f1fef6184fab2d85f4f7a86f9a4a223c9b0d408941427e72d4c1795fab5

  • SSDEEP

    6144:1uXqlpm1bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9S:Dm1QtqB5urTIoYWBQk1E+VF9mOx9JiR

  Score

  10^/10

  hawkeyecollectiondiscoverykeyloggerspywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Hawkeye family

    hawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2