hawkeye | d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b | Triage

Submit
Reports

Overview

overview

Static

static

1

test.txt

windows11-21h2-x64

Resubmissions

11/03/2025, 15:04

250311-sfzq8swmt5 8

11/03/2025, 14:20

250311-rnmwzavmx7 8

11/03/2025, 13:45

250311-q2pr2svyby 8

10/03/2025, 19:09

250310-xtytbavzcs 8

10/03/2025, 19:01

250310-xplyysvxhz 8

10/03/2025, 18:29

250310-w42ghstps7 8

10/03/2025, 15:21

250310-srpqeazshz 4

10/03/2025, 14:53

250310-r9d6ysyxdv 8

10/03/2025, 14:46

250310-r5e8fsywes 6

09/03/2025, 18:14

250309-wvp25axvd1 10

Sharing

General

Target

test.txt
Size

18B
Sample

250302-p5hmgavvft
MD5

5b3f97d48c8751bd031b7ea53545bdb6
SHA1

88be3374c62f23406ec83bb11279f8423bd3f88d
SHA256

d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
SHA512

ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

Score

10^/10

hawkeye defense_evasion discovery keylogger motw phishing spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

test.txt

Resource

win11-20250217-en

hawkeye defense_evasion discovery keylogger motw phishing spyware stealer trojan

windows11-21h2-x64

35 signatures

900 seconds

Malware Config

Targets

- Target
  
  test.txt
- Size
  
  18B
- MD5
  
  5b3f97d48c8751bd031b7ea53545bdb6
- SHA1
  
  88be3374c62f23406ec83bb11279f8423bd3f88d
- SHA256
  
  d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
- SHA512
  
  ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6
Score

10^/10

hawkeye defense_evasion discovery keylogger motw phishing spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- UAC bypass
  defense_evasion trojan
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyedefense_evasiondiscoverykeyloggermotwphishingspywarestealertrojan

© 2018-2025

Terms | Privacy