Extracted

• • Target
    jaffacakes118_Trojan.MSIL.Crypt.gsio.dbfccb9b4b3a3b9dc3ffa63e4f6e058e
  • Size 912KB
  • SHA256 07d934cae01445f6a220da7b8858755bc8a8e5a12727361787e42878e0266837
  • MD5 dbfccb9b4b3a3b9dc3ffa63e4f6e058e
  • SHA1 3c46c9f42056edfc8c1dc031b6e8ea386525645d
  • SHA512 660422fc3dc15774b2759f5975a9c5c114215fad99c82f0068e914d62916a44c74d0da2585c002e3b8f35fc639159c3b1201f42443b3ff5927402c3a89bab63c
  • SSDEEP 24576:zbQfX/QaMi4VbJ8KLzdjbvJmLP9uYlaL54fDKXZUff:HQfQi+bJ1zdwh/l04f+ZUff
  • TLSH
    T15D1512B37E874834C61D153A2C7651C1F53B578977A9CE0DE4DD2B2C8C2AC0F9786A1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryhawkeyekeyloggerpersistencespywarestealertrojan

  • Family: HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2