hawkeye_reborn | e164522c80f31c76e6c3abe58f08a708b54c5f1b8ae5437acef6e9ca7940551f

General

Target
2026-11-02_fc45ba965a5bf974cb4c3a5f5ad921dc_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos
Size 2.1MB
Sample261102-vx9nwaxy6m
SHA256 e164522c80f31c76e6c3abe58f08a708b54c5f1b8ae5437acef6e9ca7940551f
MD5 fc45ba965a5bf974cb4c3a5f5ad921dc
SHA1 53fef9296bd73004b9a3510e918bca8e05186399
SHA512 b657dfa1fde89c2d430a4bf3bd71ba93f9ceae1b4ce67979d548bdfb15fe019f749689125b7c494083eb3f1e281e167fa0fa06748aa6746ac3991d9aec3b2762
SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHa0M1z/4udyQ6MplFbLzJtExY76AjgQTASU2JW:dh+ZkldoPK8Ya0l2Jo0Ez7d
TLSH
T1D3A5D1C6A3A980E2FE4677F39E1477874B784A314A32402D236D3D58AE735F5412DAB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol
smtp
Host
smtp.celiascrew.com
Port
587
Username
[email protected]
Password
Computer419

Mutex

32e52d98-86c9-489f-aa24-71f0ae170c83

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Computer419 _EmailPort:587 _EmailSSL:false _EmailServer:smtp.celiascrew.com _EmailUsername:[email protected] _ExecutionDelay:5 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:true _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:5 _MeltFile:false _Mutex:32e52d98-86c9-489f-aa24-71f0ae170c83 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  2026-11-02_fc45ba965a5bf974cb4c3a5f5ad921dc_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos
- Size 2.1MB
- SHA256 e164522c80f31c76e6c3abe58f08a708b54c5f1b8ae5437acef6e9ca7940551f
- MD5 fc45ba965a5bf974cb4c3a5f5ad921dc
- SHA1 53fef9296bd73004b9a3510e918bca8e05186399
- SHA512 b657dfa1fde89c2d430a4bf3bd71ba93f9ceae1b4ce67979d548bdfb15fe019f749689125b7c494083eb3f1e281e167fa0fa06748aa6746ac3991d9aec3b2762
- SSDEEP 24576:KAHnh+eWsN3skA4RV1Hom2KXMmHa0M1z/4udyQ6MplFbLzJtExY76AjgQTASU2JW:dh+ZkldoPK8Ya0l2Jo0Ez7d
- TLSH
  T1D3A5D1C6A3A980E2FE4677F39E1477874B784A314A32402D236D3D58AE735F5412DAB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery hawkeye_reborn m00nd3v_logger infostealer keylogger persistence privilege_escalation spyware stealer trojan
- Family: HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Family: M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables packed with ConfuserEx Mod
- Detects executables referencing many email and collaboration clients. Observed in information steale
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2