hawkeye | c2abd4c787d043e8268b5dff5d3fb1147b3be0a061b15953bf8c7d9a7a9d7054 | Triage

Sharing

General

Target

JaffaCakes118_ccd63ea9dc74839a5488ff48fbb8ccf5
Size

416KB
Sample

250209-jh4zasznay
MD5

ccd63ea9dc74839a5488ff48fbb8ccf5
SHA1

d0aa39de25116388abd875d8e0fb497cebc98e31
SHA256

c2abd4c787d043e8268b5dff5d3fb1147b3be0a061b15953bf8c7d9a7a9d7054
SHA512

2444fa1629a6a40ef6ed256a9f37ac57e3b74260ec8c754b86999fc3c57183df87d6a47e99a29e3aba7b012f1488af7bc09073215db72101b1f9b56f86f7933f
SSDEEP

6144:ZsdwnDc8Yh83U9v57vHfR0i56nqy3d9CaQ4ppFMwJNDreoIJap2:ZsunOf373RHNaQ4ppdJN9IJap2

Score

10^/10

hawkeye discovery keylogger spyware stealer trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_ccd63ea9dc74839a5488ff48fbb8ccf5
- Size
  
  416KB
- MD5
  
  ccd63ea9dc74839a5488ff48fbb8ccf5
- SHA1
  
  d0aa39de25116388abd875d8e0fb497cebc98e31
- SHA256
  
  c2abd4c787d043e8268b5dff5d3fb1147b3be0a061b15953bf8c7d9a7a9d7054
- SHA512
  
  2444fa1629a6a40ef6ed256a9f37ac57e3b74260ec8c754b86999fc3c57183df87d6a47e99a29e3aba7b012f1488af7bc09073215db72101b1f9b56f86f7933f
- SSDEEP
  
  6144:ZsdwnDc8Yh83U9v57vHfR0i56nqy3d9CaQ4ppFMwJNDreoIJap2:ZsunOf373RHNaQ4ppdJN9IJap2
Score

10^/10

hawkeye discovery keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyediscoverykeyloggerspywarestealertrojan

behavioral2

hawkeyediscoverykeyloggerspywarestealertrojan