MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef68346c67c51f777d244afcb7ea229cd3d4d8b2c246b44198516d8ed1d4b1cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef68346c67c51f777d244afcb7ea229cd3d4d8b2c246b44198516d8ed1d4b1cc
SHA3-384 hash: adee8f0ee02043e082d770d54e5a1ed6f1d74d0e831b4ba11ce76af6395bccefa9079d847b75efc60441cff8cb73cae9
SHA1 hash: 34089ac6f266b70c13a9f383f3a9952ac1da2fa3
MD5 hash: 20b6fb8dab1d417e185f31225df041a3
humanhash: beryllium-aspen-burger-gee
File name:SecuriteInfo.com.MSIL.GenKryptik.EKAR.17476
Download: download sample
Signature HawkEye
Create hunting rule
File size:695'808 bytes
First seen:2020-05-07 08:44:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:GBL7/E1JwFUGhmJZ+l3+V1VJSOnOog2IxP/66BzXzUet1slHaiL2leBSuefI0Q3d:G97s19Cob6B7z1slHKYMrI5gHu
Threatray 1'228 similar samples on MalwareBazaar
TLSH AFE4D09D321072EFCC57D076DEA85C68FA61687A830B4207A12745EDEE4D997DF280F2
Reporter SecuriteInfoCom
Tags:HawkEye

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EKAR.17476.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 06:33:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=55udi3dhyupxo7jejl6lp2rcttj5jwfsyjdliqmykfwy5uouwhga._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
1660cbe9bd7e85ed0a2ad4ca9f793e0ef8b5f889946844e2184b1a8d2fd89ba8
HawkEye
213be9dcf549c1f170df21b37fd93ac8174cae220dc21872bab3bdbfcdcce66e
HawkEye
2ed7bf7fecdd83fb1f01697be1df04cd6dbca8cb56a7b4a200b979fb2bff900c
HawkEye
5b906f526f79a607ad3677bd9873c6a209a9952d93700629a4dd5b7b43ae347b
HawkEye
5ceedeaa99b65c724e1e4356bd44d8ec58b9834e526c223e39e554f93ec25d1b
HawkEye
8a9bcb387cd155170986cd1938beb317ee1ee511bcb6175a6d292bd976cca15b
HawkEye
b9ea5f0f13a8c5d170bf1963a68020c3df25a9ad376e721accfcd96e83a81d08
HawkEye
c465e2bc55d216e37231efbfdfeed00eeb244c2f688716a1c9c9d45ca4cc0ac0
HawkEye
da049203324396b99402d08997483bf22631b61d6b272d9bbe0a7ea35b55e40c
HawkEye
f1cb5ac38489df6bd48129c7b483df8990d0dc8a104f0f49a85842dd1266d163
HawkEye
+ 1'218 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:hawkeye_reborn family:m00nd3v_logger keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-1ptv864w3j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
M00nD3v Logger Payload
HawkEye Reborn
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MAL_HawkEye_Keylogger_Gen_Dec18
Create hunting rule
Author:Florian Roth
Description:Detects HawkEye Keylogger Reborn
Reference:https://twitter.com/James_inthe_box/status/1072116224652324870

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HawkEye

Executable exe ef68346c67c51f777d244afcb7ea229cd3d4d8b2c246b44198516d8ed1d4b1cc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359331/
  
Delivery method
Distributed via web download

Comments