hawkeye | b288adfbd1da93be69b9acd59ca421bfdba59b4dd457c5b457652b61628a9645 | Triage

Submit
Reports

Overview

overview

Static

static

3

Output.exe

windows7-x64

Output.exe

windows10-2004-x64

Sharing

General

Target

Output.exe
Size

17.4MB
Sample

250215-13apmawrfj
MD5

6c5f34449df54c94c0899b79f4e0daf9
SHA1

f37a250a00fb1637e0584853a5aa46af82d8282a
SHA256

b288adfbd1da93be69b9acd59ca421bfdba59b4dd457c5b457652b61628a9645
SHA512

78875fda16cce785e758dd13f861164b212f5a2b5a0c64e59bc0baeaea1d3362c6987a588c19cf7b8c635bc4bccb69e81c02dbe9d0b0fd94670382ca660a5f0f
SSDEEP

393216:JYJK+TcfoYVSvwM5DpxXUpyW68E52KWfLhgB7jn/1Pn6V5J:28Ng8ebXZJRGhghT/1CV5J

Score

10^/10

hawkeye aspackv2 defense_evasion discovery keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Output.exe

Resource

win7-20240903-en

hawkeye aspackv2 defense_evasion discovery keylogger spyware stealer trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

Output.exe

Resource

win10v2004-20250211-en

hawkeye aspackv2 defense_evasion discovery keylogger spyware stealer trojan

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  Output.exe
- Size
  
  17.4MB
- MD5
  
  6c5f34449df54c94c0899b79f4e0daf9
- SHA1
  
  f37a250a00fb1637e0584853a5aa46af82d8282a
- SHA256
  
  b288adfbd1da93be69b9acd59ca421bfdba59b4dd457c5b457652b61628a9645
- SHA512
  
  78875fda16cce785e758dd13f861164b212f5a2b5a0c64e59bc0baeaea1d3362c6987a588c19cf7b8c635bc4bccb69e81c02dbe9d0b0fd94670382ca660a5f0f
- SSDEEP
  
  393216:JYJK+TcfoYVSvwM5DpxXUpyW68E52KWfLhgB7jn/1Pn6V5J:28Ng8ebXZJRGhghT/1CV5J
Score

10^/10

hawkeye aspackv2 defense_evasion discovery keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyeaspackv2defense_evasiondiscoverykeyloggerspywarestealertrojan

behavioral2

hawkeyeaspackv2defense_evasiondiscoverykeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy