hawkeye

General

Target

JaffaCakes118_79635f274f10f11f651e485da73462f0
Size

484KB
Sample

250104-nd2qlayrfr
MD5

79635f274f10f11f651e485da73462f0
SHA1

81a5b79e5cb67715d54f00a262dd9e59a87e35a0
SHA256

b4bc7d798f7c8d6c3242f8aa1f480ceb803523b92123af289b9c1898a9e707ed
SHA512

ff4b41f2aabc7c549b2731ab9cb0cec3804d919b31d7e2e2548ec70774d0675f7b716c954aca8d8321bd935040e7a0ee97acd3009f83b2726612df50544b8730
SSDEEP

12288:JrEp/yXGsCHqzhpSFqiKQ3XViksMG41N5LhWu98sUA6uAK:ilJsZtpSk8XVRUG+u98sMK

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_79635f274f10f11f651e485da73462f0
- Size
  
  484KB
- MD5
  
  79635f274f10f11f651e485da73462f0
- SHA1
  
  81a5b79e5cb67715d54f00a262dd9e59a87e35a0
- SHA256
  
  b4bc7d798f7c8d6c3242f8aa1f480ceb803523b92123af289b9c1898a9e707ed
- SHA512
  
  ff4b41f2aabc7c549b2731ab9cb0cec3804d919b31d7e2e2548ec70774d0675f7b716c954aca8d8321bd935040e7a0ee97acd3009f83b2726612df50544b8730
- SSDEEP
  
  12288:JrEp/yXGsCHqzhpSFqiKQ3XViksMG41N5LhWu98sUA6uAK:ilJsZtpSk8XVRUG+u98sMK
Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2