hawkeye | 40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745 | Triage

Submit
Reports

Overview

overview

Static

static

3

40bdc01698...45.exe

windows7-x64

40bdc01698...45.exe

windows10-2004-x64

Sharing

General

Target

40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745.exe
Size

610KB
Sample

250131-vlhq1stmgk
MD5

cbff403de61e81792b6a6985d113f588
SHA1

ca2b0aa201eb717b506df77c180cec5717eb3a9e
SHA256

40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745
SHA512

5c3b4b2a17de18008ca313fd374472bfd00b4818d3f2157ab703261ae89601a4d656d34081d21758eeac8e1438a838ae74db43cc29cb0306ad5bd70d666aa80a
SSDEEP

12288:iDfY2d53bC+BSPRrZ9hh0LTAw1wQSRQqw/b3JuvQxoAPDKCn9AMxg:+fgFrih1wQbH4QxoAPF

Score

10^/10

hawkeye collection discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745.exe

Resource

win7-20240903-en

hawkeye collection discovery keylogger spyware stealer trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745.exe

Resource

win10v2004-20250129-en

hawkeye collection discovery keylogger spyware stealer trojan

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745.exe
- Size
  
  610KB
- MD5
  
  cbff403de61e81792b6a6985d113f588
- SHA1
  
  ca2b0aa201eb717b506df77c180cec5717eb3a9e
- SHA256
  
  40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745
- SHA512
  
  5c3b4b2a17de18008ca313fd374472bfd00b4818d3f2157ab703261ae89601a4d656d34081d21758eeac8e1438a838ae74db43cc29cb0306ad5bd70d666aa80a
- SSDEEP
  
  12288:iDfY2d53bC+BSPRrZ9hh0LTAw1wQSRQqw/b3JuvQxoAPDKCn9AMxg:+fgFrih1wQbH4QxoAPF
Score

10^/10

hawkeye collection discovery keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectiondiscoverykeyloggerspywarestealertrojan

behavioral2

hawkeyecollectiondiscoverykeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy