hawkeye_reborn | 572f51e149ac61321c96e85d1f88e17ff4269ea68c02b968ca86779b22ecd542

General

Target
jaffacakes118_Trojan-Dropper.Win32.Autit.cam.ecdbaba92e550eeb96a91c2baa92995a
Size 2.1MB
Sample261009-v21xjasx2m
SHA256 572f51e149ac61321c96e85d1f88e17ff4269ea68c02b968ca86779b22ecd542
MD5 ecdbaba92e550eeb96a91c2baa92995a
SHA1 1832ddee4f88723a7f7c490d8182df0081e8cff6
SHA512 10701c90a72b1c053b7bc43aff3bd7f9e7ec431b98c93ed36c3f7f879431a7bf66eafdfd8b28c58e73e4b584303b24c7ea4d1390721353df59d954c155b11cf5
SSDEEP 24576:zCdxte/80jYLT3U1jfsWauCXCYfmj/gCZ/4u5KG6X0AqKp6hpKNi+Q:aw80cTsjkWauZt06Oa
TLSH
T1DAA5D0D6A39D82E1CD157AF2FD2827835F3A59324A3430193F5A2D5D9E231B2412DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
unlimitedmoney2019@

Mutex

f5b72013-3c74-465c-8a70-83f417b1e4d4

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:unlimitedmoney2019@ _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f5b72013-3c74-465c-8a70-83f417b1e4d4 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  jaffacakes118_Trojan-Dropper.Win32.Autit.cam.ecdbaba92e550eeb96a91c2baa92995a
- Size 2.1MB
- SHA256 572f51e149ac61321c96e85d1f88e17ff4269ea68c02b968ca86779b22ecd542
- MD5 ecdbaba92e550eeb96a91c2baa92995a
- SHA1 1832ddee4f88723a7f7c490d8182df0081e8cff6
- SHA512 10701c90a72b1c053b7bc43aff3bd7f9e7ec431b98c93ed36c3f7f879431a7bf66eafdfd8b28c58e73e4b584303b24c7ea4d1390721353df59d954c155b11cf5
- SSDEEP 24576:zCdxte/80jYLT3U1jfsWauCXCYfmj/gCZ/4u5KG6X0AqKp6hpKNi+Q:aw80cTsjkWauZt06Oa
- TLSH
  T1DAA5D0D6A39D82E1CD157AF2FD2827835F3A59324A3430193F5A2D5D9E231B2412DEB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery hawkeye_reborn m00nd3v_logger infostealer keylogger persistence privilege_escalation spyware stealer trojan
- Family: HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Family: M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2