Extracted

• • Target
    order03JUL2020309557.exe
  • Size 1.1MB
  • SHA256 fd25d39f3f2eeec2ecf1db20ea303f7389a1ed1b703ab6991e656d13811af1a2
  • MD5 5754534eda26fd7f7595d0494e827794
  • SHA1 585cacd7daa152151182763522d89185e6020b93
  • SHA512 eb48c4c3e9f37cb4f617fc0cba22827e921ec958790f6bfbc3374ceb57fc0e6c4afe4a48f05ed446280e5257312d37befc330ee1645416e88343d8564b686cd5
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggertrojanstealerspywarehawkeyepersistence

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Uses the VBS compiler for execution

  • Adds Run entry to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2