Play interactive tour

Edit tour

Analysis Report PO_Invoices_pdf.exe

Overview

General Information

Sample Name:	PO_Invoices_pdf.exe
Analysis ID:	347154
MD5:	59d7d8d5dd3e0055e7c0dcc75897f569
SHA1:	b249b28d088d54e971e2d9d8b2688440f8e6d513
SHA256:	ef715cd322f0a805a68840b215c062f2e254977170a11c6800d836eac781fabb
Tags:	exeHawkEyeYahoo
Most interesting Screenshot:

Detection

HawkEye AgentTesla MailPassView Matiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected HawkEye Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected AgentTesla

Yara detected AntiVM_3

Yara detected HawkEye Keylogger

Yara detected MailPassView

Yara detected Matiex Keylogger

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Bypasses PowerShell execution policy

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to log keystrokes (.Net Source)

Drops PE files to the startup folder

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Powershell drops PE file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses process hollowing technique

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

Adds / modifies Windows certificates

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains strange resources

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

PO_Invoices_pdf.exe (PID: 5372 cmdline: 'C:\Users\user\Desktop\PO_Invoices_pdf.exe' MD5: 59D7D8D5DD3E0055E7C0DCC75897F569)

powershell.exe (PID: 5904 cmdline: 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\PO_Invoices_pdf.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 8 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 4888 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

hawkgoods.exe (PID: 3724 cmdline: 'C:\Users\user~1\AppData\Local\Temp\hawkgoods.exe' 0 MD5: FFDB58533D5D1362E896E96FB6F02A95)

dw20.exe (PID: 6684 cmdline: dw20.exe -x -s 2164 MD5: 8D10DA8A3E11747E51F23C882C22BBC3)

vbc.exe (PID: 6852 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 6868 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

WerFault.exe (PID: 7028 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 1996 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

origigoods40.exe (PID: 6172 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods40.exe' 0 MD5: AE36F0D16230B9F41FFECBD3C5B1D660)

Matiexgoods.exe (PID: 6264 cmdline: 'C:\Users\user~1\AppData\Local\Temp\Matiexgoods.exe' 0 MD5: 80C61B903400B534858D047DD0919F0E)

netsh.exe (PID: 1744 cmdline: 'netsh' wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 1200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

origigoods20.exe (PID: 6352 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods20.exe' 0 MD5: 61DC57C6575E1F3F2AE14C1B332AD2FB)

I$s#$lT3ssl.exe (PID: 1808 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' MD5: 59D7D8D5DD3E0055E7C0DCC75897F569)

powershell.exe (PID: 6908 cmdline: 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 4828 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

hawkgoods.exe (PID: 5440 cmdline: 'C:\Users\user~1\AppData\Local\Temp\hawkgoods.exe' 0 MD5: FFDB58533D5D1362E896E96FB6F02A95)

dw20.exe (PID: 5252 cmdline: dw20.exe -x -s 2092 MD5: 8D10DA8A3E11747E51F23C882C22BBC3)

vbc.exe (PID: 5776 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 6108 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

WerFault.exe (PID: 4776 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 940 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

origigoods40.exe (PID: 3080 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods40.exe' 0 MD5: AE36F0D16230B9F41FFECBD3C5B1D660)

Matiexgoods.exe (PID: 6532 cmdline: 'C:\Users\user~1\AppData\Local\Temp\Matiexgoods.exe' 0 MD5: 80C61B903400B534858D047DD0919F0E)

origigoods20.exe (PID: 7160 cmdline: 'C:\Users\user~1\AppData\Local\Temp\origigoods20.exe' 0 MD5: 61DC57C6575E1F3F2AE14C1B332AD2FB)

cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Threatname: Agenttesla

{"Username: ": "", "URL: ": "", "To: ": "", "ByHost: ": "smtp.privateemail.com:587", "Password: ": "", "From: ": ""}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\origigoods20.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
C:\Users\user\AppData\Local\Temp\origigoods40.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
C:\Users\user\AppData\Local\Temp\Matiexgoods.exe	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
dropped/hawkgoods.exe	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
dropped/hawkgoods.exe	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
dropped/hawkgoods.exe	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
dropped/hawkgoods.exe	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
dropped/hawkgoods.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
dropped/hawkgoods.exe	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
C:\Users\user\AppData\Local\Temp\hawkgoods.exe	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000003.273863512.0000000003E4D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000003.285132773.0000000003DE1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000000.423374232.0000000000722000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000003.425880345.0000000003A2D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000023.00000002.465758929.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000012.00000002.308131659.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000007.00000002.445463818.0000000000C32000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.430720019.00000000000E2000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000003.269169616.00000000010E3000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001C.00000002.696128013.0000000003201000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001C.00000002.696128013.0000000003201000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.455680542.0000000002FE1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.455680542.0000000002FE1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000000.419299258.0000000000E22000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.651684392.0000000007F40000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000014.00000002.379809632.0000000005930000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x12df7:$key: HawkEyeKeylogger 0x1503b:$salt: 099u787978786 0x13438:$string1: HawkEye_Keylogger 0x1428b:$string1: HawkEye_Keylogger 0x14f9b:$string1: HawkEye_Keylogger 0x13821:$string2: holdermail.txt 0x13841:$string2: holdermail.txt 0x13763:$string3: wallet.dat 0x1377b:$string3: wallet.dat 0x13791:$string3: wallet.dat 0x14b5f:$string4: Keylog Records 0x14e77:$string4: Keylog Records 0x15093:$string5: do not script --> 0x12ddf:$string6: \pidloc.txt 0x12e6d:$string7: BSPLIT 0x12e7d:$string7: BSPLIT
00000014.00000002.379809632.0000000005930000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000014.00000002.379809632.0000000005930000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x13490:$hawkstr1: HawkEye Keylogger 0x142d1:$hawkstr1: HawkEye Keylogger 0x14600:$hawkstr1: HawkEye Keylogger 0x1475b:$hawkstr1: HawkEye Keylogger 0x148be:$hawkstr1: HawkEye Keylogger 0x14b37:$hawkstr1: HawkEye Keylogger 0x1301e:$hawkstr2: Dear HawkEye Customers! 0x14653:$hawkstr2: Dear HawkEye Customers! 0x147aa:$hawkstr2: Dear HawkEye Customers! 0x14911:$hawkstr2: Dear HawkEye Customers! 0x1313f:$hawkstr3: HawkEye Logger Details:
00000005.00000003.272090410.0000000003B4B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000003.414221299.00000000036C1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000025.00000002.619183539.0000000005360000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x12df7:$key: HawkEyeKeylogger 0x1503b:$salt: 099u787978786 0x13438:$string1: HawkEye_Keylogger 0x1428b:$string1: HawkEye_Keylogger 0x14f9b:$string1: HawkEye_Keylogger 0x13821:$string2: holdermail.txt 0x13841:$string2: holdermail.txt 0x13763:$string3: wallet.dat 0x1377b:$string3: wallet.dat 0x13791:$string3: wallet.dat 0x14b5f:$string4: Keylog Records 0x14e77:$string4: Keylog Records 0x15093:$string5: do not script --> 0x12ddf:$string6: \pidloc.txt 0x12e6d:$string7: BSPLIT 0x12e7d:$string7: BSPLIT
00000025.00000002.619183539.0000000005360000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000025.00000002.619183539.0000000005360000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x13490:$hawkstr1: HawkEye Keylogger 0x142d1:$hawkstr1: HawkEye Keylogger 0x14600:$hawkstr1: HawkEye Keylogger 0x1475b:$hawkstr1: HawkEye Keylogger 0x148be:$hawkstr1: HawkEye Keylogger 0x14b37:$hawkstr1: HawkEye Keylogger 0x1301e:$hawkstr2: Dear HawkEye Customers! 0x14653:$hawkstr2: Dear HawkEye Customers! 0x147aa:$hawkstr2: Dear HawkEye Customers! 0x14911:$hawkstr2: Dear HawkEye Customers! 0x1313f:$hawkstr3: HawkEye Logger Details:
00000005.00000003.276618597.0000000003B4B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000003.286093751.00000000010E3000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000002.703454217.0000000002F71000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001F.00000002.703454217.0000000002F71000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.418225668.0000000000E23000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000003.418385560.000000000372B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000003.427152213.00000000039C1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.651227274.0000000007C90000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000008.00000002.681623451.0000000000F72000.00000002.00020000.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001B.00000000.417887646.0000000000A42000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
0000001B.00000000.417887646.0000000000A42000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001B.00000000.417887646.0000000000A42000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000001B.00000000.417887646.0000000000A42000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000001B.00000000.417887646.0000000000A42000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
00000007.00000000.273140883.0000000000C32000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.642866499.00000000041B1000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001B.00000002.642866499.00000000041B1000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000002.390146582.0000000003A21000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000006.00000002.390146582.0000000003A21000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000A.00000000.281843308.00000000000E2000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001A.00000003.428390015.0000000000E23000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000003.281965972.0000000003BE0000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000003.281965972.0000000003BE0000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000002.383895800.00000000002F2000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
00000006.00000002.383895800.00000000002F2000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000006.00000002.383895800.00000000002F2000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000006.00000002.383895800.00000000002F2000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000006.00000002.383895800.00000000002F2000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
0000001F.00000002.681903640.0000000000722000.00000002.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.454660209.0000000002801000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.454660209.0000000002801000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.284634932.0000000003E4D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.699392963.000000000352E000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.699392963.000000000352E000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.398436711.0000000007540000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000006.00000002.398332656.00000000073F0000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0000001A.00000002.433264598.0000000000403000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ba86:$key: HawkEyeKeylogger 0x7dcca:$salt: 099u787978786 0x7c0c7:$string1: HawkEye_Keylogger 0x7cf1a:$string1: HawkEye_Keylogger 0x7dc2a:$string1: HawkEye_Keylogger 0x7c4b0:$string2: holdermail.txt 0x7c4d0:$string2: holdermail.txt 0x7c3f2:$string3: wallet.dat 0x7c40a:$string3: wallet.dat 0x7c420:$string3: wallet.dat 0x7d7ee:$string4: Keylog Records 0x7db06:$string4: Keylog Records 0x7dd22:$string5: do not script --> 0x7ba6e:$string6: \pidloc.txt 0x7bafc:$string7: BSPLIT 0x7bb0c:$string7: BSPLIT
0000001A.00000002.433264598.0000000000403000.00000040.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001A.00000002.433264598.0000000000403000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001A.00000002.433264598.0000000000403000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000001A.00000002.433264598.0000000000403000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000001A.00000002.433264598.0000000000403000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c11f:$hawkstr1: HawkEye Keylogger 0x7cf60:$hawkstr1: HawkEye Keylogger 0x7d28f:$hawkstr1: HawkEye Keylogger 0x7d3ea:$hawkstr1: HawkEye Keylogger 0x7d54d:$hawkstr1: HawkEye Keylogger 0x7d7c6:$hawkstr1: HawkEye Keylogger 0x7bcad:$hawkstr2: Dear HawkEye Customers! 0x7d2e2:$hawkstr2: Dear HawkEye Customers! 0x7d439:$hawkstr2: Dear HawkEye Customers! 0x7d5a0:$hawkstr2: Dear HawkEye Customers! 0x7bdce:$hawkstr3: HawkEye Logger Details:
00000022.00000002.446713470.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001A.00000003.419784850.000000000372B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001B.00000002.636644097.0000000000A42000.00000002.00020000.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b6c7:$key: HawkEyeKeylogger 0x7d90b:$salt: 099u787978786 0x7bd08:$string1: HawkEye_Keylogger 0x7cb5b:$string1: HawkEye_Keylogger 0x7d86b:$string1: HawkEye_Keylogger 0x7c0f1:$string2: holdermail.txt 0x7c111:$string2: holdermail.txt 0x7c033:$string3: wallet.dat 0x7c04b:$string3: wallet.dat 0x7c061:$string3: wallet.dat 0x7d42f:$string4: Keylog Records 0x7d747:$string4: Keylog Records 0x7d963:$string5: do not script --> 0x7b6af:$string6: \pidloc.txt 0x7b73d:$string7: BSPLIT 0x7b74d:$string7: BSPLIT
0000001B.00000002.636644097.0000000000A42000.00000002.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001B.00000002.636644097.0000000000A42000.00000002.00020000.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000001B.00000002.636644097.0000000000A42000.00000002.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000001B.00000002.636644097.0000000000A42000.00000002.00020000.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd60:$hawkstr1: HawkEye Keylogger 0x7cba1:$hawkstr1: HawkEye Keylogger 0x7ced0:$hawkstr1: HawkEye Keylogger 0x7d02b:$hawkstr1: HawkEye Keylogger 0x7d18e:$hawkstr1: HawkEye Keylogger 0x7d407:$hawkstr1: HawkEye Keylogger 0x7b8ee:$hawkstr2: Dear HawkEye Customers! 0x7cf23:$hawkstr2: Dear HawkEye Customers! 0x7d07a:$hawkstr2: Dear HawkEye Customers! 0x7d1e1:$hawkstr2: Dear HawkEye Customers! 0x7ba0f:$hawkstr3: HawkEye Logger Details:
0000001A.00000003.413803172.0000000000E23000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.296594780.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000001B.00000002.641318198.00000000031B1000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x2d180:$key: HawkEyeKeylogger 0x2d870:$salt: 099u787978786 0x425cc:$string1: HawkEye_Keylogger 0x479a0:$string1: HawkEye_Keylogger 0x45254:$string2: holdermail.txt 0x45284:$string2: holdermail.txt 0x431ae:$string3: wallet.dat 0x431d6:$string3: wallet.dat 0x431fc:$string3: wallet.dat 0x44510:$string4: Keylog Records 0x44846:$string4: Keylog Records 0x31ef4:$string5: do not script --> 0x2d158:$string6: \pidloc.txt 0x2d260:$string7: BSPLIT 0x2d280:$string7: BSPLIT
0000001B.00000002.641318198.00000000031B1000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000001B.00000002.641318198.00000000031B1000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x4265c:$hawkstr1: HawkEye Keylogger 0x434a0:$hawkstr1: HawkEye Keylogger 0x4388c:$hawkstr1: HawkEye Keylogger 0x444e8:$hawkstr1: HawkEye Keylogger 0x479f8:$hawkstr1: HawkEye Keylogger 0x55564:$hawkstr1: HawkEye Keylogger 0x420d4:$hawkstr2: Dear HawkEye Customers! 0x43504:$hawkstr2: Dear HawkEye Customers! 0x438f0:$hawkstr2: Dear HawkEye Customers! 0x555c4:$hawkstr2: Dear HawkEye Customers! 0x42206:$hawkstr3: HawkEye Logger Details:
00000000.00000002.277417941.00000000040A8000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x36c806:$key: HawkEyeKeylogger 0x4cd836:$key: HawkEyeKeylogger 0x62c856:$key: HawkEyeKeylogger 0x36ea4a:$salt: 099u787978786 0x4cfa7a:$salt: 099u787978786 0x62ea9a:$salt: 099u787978786 0x36ce47:$string1: HawkEye_Keylogger 0x36dc9a:$string1: HawkEye_Keylogger 0x36e9aa:$string1: HawkEye_Keylogger 0x4cde77:$string1: HawkEye_Keylogger 0x4cecca:$string1: HawkEye_Keylogger 0x4cf9da:$string1: HawkEye_Keylogger 0x62ce97:$string1: HawkEye_Keylogger 0x62dcea:$string1: HawkEye_Keylogger 0x62e9fa:$string1: HawkEye_Keylogger 0x36d230:$string2: holdermail.txt 0x36d250:$string2: holdermail.txt 0x4ce260:$string2: holdermail.txt 0x4ce280:$string2: holdermail.txt 0x62d280:$string2: holdermail.txt 0x62d2a0:$string2: holdermail.txt
00000000.00000002.277417941.00000000040A8000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000000.00000002.277417941.00000000040A8000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000002.277417941.00000000040A8000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000000.00000002.277417941.00000000040A8000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000002.277417941.00000000040A8000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x36ce9f:$hawkstr1: HawkEye Keylogger 0x36dce0:$hawkstr1: HawkEye Keylogger 0x36e00f:$hawkstr1: HawkEye Keylogger 0x36e16a:$hawkstr1: HawkEye Keylogger 0x36e2cd:$hawkstr1: HawkEye Keylogger 0x36e546:$hawkstr1: HawkEye Keylogger 0x4cdecf:$hawkstr1: HawkEye Keylogger 0x4ced10:$hawkstr1: HawkEye Keylogger 0x4cf03f:$hawkstr1: HawkEye Keylogger 0x4cf19a:$hawkstr1: HawkEye Keylogger 0x4cf2fd:$hawkstr1: HawkEye Keylogger 0x4cf576:$hawkstr1: HawkEye Keylogger 0x62ceef:$hawkstr1: HawkEye Keylogger 0x62dd30:$hawkstr1: HawkEye Keylogger 0x62e05f:$hawkstr1: HawkEye Keylogger 0x62e1ba:$hawkstr1: HawkEye Keylogger 0x62e31d:$hawkstr1: HawkEye Keylogger 0x62e596:$hawkstr1: HawkEye Keylogger 0x36ca2d:$hawkstr2: Dear HawkEye Customers! 0x36e062:$hawkstr2: Dear HawkEye Customers! 0x36e1b9:$hawkstr2: Dear HawkEye Customers!
00000005.00000002.287278765.0000000000403000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ba86:$key: HawkEyeKeylogger 0x7dcca:$salt: 099u787978786 0x7c0c7:$string1: HawkEye_Keylogger 0x7cf1a:$string1: HawkEye_Keylogger 0x7dc2a:$string1: HawkEye_Keylogger 0x7c4b0:$string2: holdermail.txt 0x7c4d0:$string2: holdermail.txt 0x7c3f2:$string3: wallet.dat 0x7c40a:$string3: wallet.dat 0x7c420:$string3: wallet.dat 0x7d7ee:$string4: Keylog Records 0x7db06:$string4: Keylog Records 0x7dd22:$string5: do not script --> 0x7ba6e:$string6: \pidloc.txt 0x7bafc:$string7: BSPLIT 0x7bb0c:$string7: BSPLIT
00000005.00000002.287278765.0000000000403000.00000040.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000005.00000002.287278765.0000000000403000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000005.00000002.287278765.0000000000403000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000005.00000002.287278765.0000000000403000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000005.00000002.287278765.0000000000403000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c11f:$hawkstr1: HawkEye Keylogger 0x7cf60:$hawkstr1: HawkEye Keylogger 0x7d28f:$hawkstr1: HawkEye Keylogger 0x7d3ea:$hawkstr1: HawkEye Keylogger 0x7d54d:$hawkstr1: HawkEye Keylogger 0x7d7c6:$hawkstr1: HawkEye Keylogger 0x7bcad:$hawkstr2: Dear HawkEye Customers! 0x7d2e2:$hawkstr2: Dear HawkEye Customers! 0x7d439:$hawkstr2: Dear HawkEye Customers! 0x7d5a0:$hawkstr2: Dear HawkEye Customers! 0x7bdce:$hawkstr3: HawkEye Logger Details:
0000001A.00000003.424187770.000000000372B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000003.271788096.00000000010E3000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000003.283633869.0000000003B4B000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001E.00000002.681849072.0000000000BD2000.00000002.00020000.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
Process Memory Space: origigoods40.exe PID: 6172	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: origigoods40.exe PID: 6172	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 5904	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 4888	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
Process Memory Space: RegAsm.exe PID: 4888	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: RegAsm.exe PID: 4888	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: RegAsm.exe PID: 4888	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: PO_Invoices_pdf.exe PID: 5372	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
Process Memory Space: PO_Invoices_pdf.exe PID: 5372	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: PO_Invoices_pdf.exe PID: 5372	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: PO_Invoices_pdf.exe PID: 5372	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 99 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
7.0.origigoods40.exe.c30000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
35.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
28.2.origigoods40.exe.e20000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
31.2.origigoods20.exe.720000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.hawkgoods.exe.34fa72.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
10.0.origigoods20.exe.e0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.origigoods20.exe.e0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.hawkgoods.exe.73f0000.10.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.2.hawkgoods.exe.2f9c0d.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.hawkgoods.exe.3a27e00.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.3a27e00.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a40000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
27.2.hawkgoods.exe.a40000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
27.2.hawkgoods.exe.a40000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.a40000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.2.hawkgoods.exe.a40000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a40000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
27.0.hawkgoods.exe.a9fa72.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.34fa72.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.7540000.11.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.0.hawkgoods.exe.34fa72.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc55:$key: HawkEyeKeylogger 0x1fe99:$salt: 099u787978786 0x1e296:$string1: HawkEye_Keylogger 0x1f0e9:$string1: HawkEye_Keylogger 0x1fdf9:$string1: HawkEye_Keylogger 0x1e67f:$string2: holdermail.txt 0x1e69f:$string2: holdermail.txt 0x1e5c1:$string3: wallet.dat 0x1e5d9:$string3: wallet.dat 0x1e5ef:$string3: wallet.dat 0x1f9bd:$string4: Keylog Records 0x1fcd5:$string4: Keylog Records 0x1fef1:$string5: do not script --> 0x1dc3d:$string6: \pidloc.txt 0x1dccb:$string7: BSPLIT 0x1dcdb:$string7: BSPLIT
6.0.hawkgoods.exe.34fa72.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.34fa72.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.0.hawkgoods.exe.34fa72.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2ee:$hawkstr1: HawkEye Keylogger 0x1f12f:$hawkstr1: HawkEye Keylogger 0x1f45e:$hawkstr1: HawkEye Keylogger 0x1f5b9:$hawkstr1: HawkEye Keylogger 0x1f71c:$hawkstr1: HawkEye Keylogger 0x1f995:$hawkstr1: HawkEye Keylogger 0x1de7c:$hawkstr2: Dear HawkEye Customers! 0x1f4b1:$hawkstr2: Dear HawkEye Customers! 0x1f608:$hawkstr2: Dear HawkEye Customers! 0x1f76f:$hawkstr2: Dear HawkEye Customers! 0x1df9d:$hawkstr3: HawkEye Logger Details:
6.0.hawkgoods.exe.2f0000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.0.hawkgoods.exe.2f0000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
6.0.hawkgoods.exe.2f0000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.2f0000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.0.hawkgoods.exe.2f0000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.0.hawkgoods.exe.2f0000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
6.2.hawkgoods.exe.3a40240.6.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.0.hawkgoods.exe.a48208.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
27.0.hawkgoods.exe.a48208.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754bf:$key: HawkEyeKeylogger 0x77703:$salt: 099u787978786 0x75b00:$string1: HawkEye_Keylogger 0x76953:$string1: HawkEye_Keylogger 0x77663:$string1: HawkEye_Keylogger 0x75ee9:$string2: holdermail.txt 0x75f09:$string2: holdermail.txt 0x75e2b:$string3: wallet.dat 0x75e43:$string3: wallet.dat 0x75e59:$string3: wallet.dat 0x77227:$string4: Keylog Records 0x7753f:$string4: Keylog Records 0x7775b:$string5: do not script --> 0x754a7:$string6: \pidloc.txt 0x75535:$string7: BSPLIT 0x75545:$string7: BSPLIT
27.0.hawkgoods.exe.a48208.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.0.hawkgoods.exe.a48208.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.0.hawkgoods.exe.a48208.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.0.hawkgoods.exe.a48208.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b58:$hawkstr1: HawkEye Keylogger 0x76999:$hawkstr1: HawkEye Keylogger 0x76cc8:$hawkstr1: HawkEye Keylogger 0x76e23:$hawkstr1: HawkEye Keylogger 0x76f86:$hawkstr1: HawkEye Keylogger 0x771ff:$hawkstr1: HawkEye Keylogger 0x756e6:$hawkstr2: Dear HawkEye Customers! 0x76d1b:$hawkstr2: Dear HawkEye Customers! 0x76e72:$hawkstr2: Dear HawkEye Customers! 0x76fd9:$hawkstr2: Dear HawkEye Customers! 0x75807:$hawkstr3: HawkEye Logger Details:
8.2.Matiexgoods.exe.f70000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
27.0.hawkgoods.exe.a9fa72.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc55:$key: HawkEyeKeylogger 0x1fe99:$salt: 099u787978786 0x1e296:$string1: HawkEye_Keylogger 0x1f0e9:$string1: HawkEye_Keylogger 0x1fdf9:$string1: HawkEye_Keylogger 0x1e67f:$string2: holdermail.txt 0x1e69f:$string2: holdermail.txt 0x1e5c1:$string3: wallet.dat 0x1e5d9:$string3: wallet.dat 0x1e5ef:$string3: wallet.dat 0x1f9bd:$string4: Keylog Records 0x1fcd5:$string4: Keylog Records 0x1fef1:$string5: do not script --> 0x1dc3d:$string6: \pidloc.txt 0x1dccb:$string7: BSPLIT 0x1dcdb:$string7: BSPLIT
27.0.hawkgoods.exe.a9fa72.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.0.hawkgoods.exe.a9fa72.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.0.hawkgoods.exe.a9fa72.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2ee:$hawkstr1: HawkEye Keylogger 0x1f12f:$hawkstr1: HawkEye Keylogger 0x1f45e:$hawkstr1: HawkEye Keylogger 0x1f5b9:$hawkstr1: HawkEye Keylogger 0x1f71c:$hawkstr1: HawkEye Keylogger 0x1f995:$hawkstr1: HawkEye Keylogger 0x1de7c:$hawkstr2: Dear HawkEye Customers! 0x1f4b1:$hawkstr2: Dear HawkEye Customers! 0x1f608:$hawkstr2: Dear HawkEye Customers! 0x1f76f:$hawkstr2: Dear HawkEye Customers! 0x1df9d:$hawkstr3: HawkEye Logger Details:
6.2.hawkgoods.exe.2f9c0d.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73aba:$key: HawkEyeKeylogger 0x75cfe:$salt: 099u787978786 0x740fb:$string1: HawkEye_Keylogger 0x74f4e:$string1: HawkEye_Keylogger 0x75c5e:$string1: HawkEye_Keylogger 0x744e4:$string2: holdermail.txt 0x74504:$string2: holdermail.txt 0x74426:$string3: wallet.dat 0x7443e:$string3: wallet.dat 0x74454:$string3: wallet.dat 0x75822:$string4: Keylog Records 0x75b3a:$string4: Keylog Records 0x75d56:$string5: do not script --> 0x73aa2:$string6: \pidloc.txt 0x73b30:$string7: BSPLIT 0x73b40:$string7: BSPLIT
6.2.hawkgoods.exe.2f9c0d.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.2f9c0d.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.2.hawkgoods.exe.2f9c0d.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.hawkgoods.exe.2f9c0d.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74153:$hawkstr1: HawkEye Keylogger 0x74f94:$hawkstr1: HawkEye Keylogger 0x752c3:$hawkstr1: HawkEye Keylogger 0x7541e:$hawkstr1: HawkEye Keylogger 0x75581:$hawkstr1: HawkEye Keylogger 0x757fa:$hawkstr1: HawkEye Keylogger 0x73ce1:$hawkstr2: Dear HawkEye Customers! 0x75316:$hawkstr2: Dear HawkEye Customers! 0x7546d:$hawkstr2: Dear HawkEye Customers! 0x755d4:$hawkstr2: Dear HawkEye Customers! 0x73e02:$hawkstr3: HawkEye Logger Details:
27.2.hawkgoods.exe.41d0240.6.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a49c0d.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73aba:$key: HawkEyeKeylogger 0x75cfe:$salt: 099u787978786 0x740fb:$string1: HawkEye_Keylogger 0x74f4e:$string1: HawkEye_Keylogger 0x75c5e:$string1: HawkEye_Keylogger 0x744e4:$string2: holdermail.txt 0x74504:$string2: holdermail.txt 0x74426:$string3: wallet.dat 0x7443e:$string3: wallet.dat 0x74454:$string3: wallet.dat 0x75822:$string4: Keylog Records 0x75b3a:$string4: Keylog Records 0x75d56:$string5: do not script --> 0x73aa2:$string6: \pidloc.txt 0x73b30:$string7: BSPLIT 0x73b40:$string7: BSPLIT
27.2.hawkgoods.exe.a49c0d.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.a49c0d.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.2.hawkgoods.exe.a49c0d.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a49c0d.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74153:$hawkstr1: HawkEye Keylogger 0x74f94:$hawkstr1: HawkEye Keylogger 0x752c3:$hawkstr1: HawkEye Keylogger 0x7541e:$hawkstr1: HawkEye Keylogger 0x75581:$hawkstr1: HawkEye Keylogger 0x757fa:$hawkstr1: HawkEye Keylogger 0x73ce1:$hawkstr2: Dear HawkEye Customers! 0x75316:$hawkstr2: Dear HawkEye Customers! 0x7546d:$hawkstr2: Dear HawkEye Customers! 0x755d4:$hawkstr2: Dear HawkEye Customers! 0x73e02:$hawkstr3: HawkEye Logger Details:
27.2.hawkgoods.exe.41b7e00.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.41b7e00.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
30.0.Matiexgoods.exe.bd0000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
27.0.hawkgoods.exe.a49c0d.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73aba:$key: HawkEyeKeylogger 0x75cfe:$salt: 099u787978786 0x740fb:$string1: HawkEye_Keylogger 0x74f4e:$string1: HawkEye_Keylogger 0x75c5e:$string1: HawkEye_Keylogger 0x744e4:$string2: holdermail.txt 0x74504:$string2: holdermail.txt 0x74426:$string3: wallet.dat 0x7443e:$string3: wallet.dat 0x74454:$string3: wallet.dat 0x75822:$string4: Keylog Records 0x75b3a:$string4: Keylog Records 0x75d56:$string5: do not script --> 0x73aa2:$string6: \pidloc.txt 0x73b30:$string7: BSPLIT 0x73b40:$string7: BSPLIT
27.0.hawkgoods.exe.a49c0d.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.0.hawkgoods.exe.a49c0d.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.0.hawkgoods.exe.a49c0d.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.0.hawkgoods.exe.a49c0d.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74153:$hawkstr1: HawkEye Keylogger 0x74f94:$hawkstr1: HawkEye Keylogger 0x752c3:$hawkstr1: HawkEye Keylogger 0x7541e:$hawkstr1: HawkEye Keylogger 0x75581:$hawkstr1: HawkEye Keylogger 0x757fa:$hawkstr1: HawkEye Keylogger 0x73ce1:$hawkstr2: Dear HawkEye Customers! 0x75316:$hawkstr2: Dear HawkEye Customers! 0x7546d:$hawkstr2: Dear HawkEye Customers! 0x755d4:$hawkstr2: Dear HawkEye Customers! 0x73e02:$hawkstr3: HawkEye Logger Details:
6.0.hawkgoods.exe.2f9c0d.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
26.2.RegAsm.exe.4031bf.2.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
26.2.RegAsm.exe.4031bf.2.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ac7:$key: HawkEyeKeylogger 0x7bd0b:$salt: 099u787978786 0x7a108:$string1: HawkEye_Keylogger 0x7af5b:$string1: HawkEye_Keylogger 0x7bc6b:$string1: HawkEye_Keylogger 0x7a4f1:$string2: holdermail.txt 0x7a511:$string2: holdermail.txt 0x7a433:$string3: wallet.dat 0x7a44b:$string3: wallet.dat 0x7a461:$string3: wallet.dat 0x7b82f:$string4: Keylog Records 0x7bb47:$string4: Keylog Records 0x7bd63:$string5: do not script --> 0x79aaf:$string6: \pidloc.txt 0x79b3d:$string7: BSPLIT 0x79b4d:$string7: BSPLIT
26.2.RegAsm.exe.4031bf.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
26.2.RegAsm.exe.4031bf.2.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
26.2.RegAsm.exe.4031bf.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
26.2.RegAsm.exe.4031bf.2.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a160:$hawkstr1: HawkEye Keylogger 0x7afa1:$hawkstr1: HawkEye Keylogger 0x7b2d0:$hawkstr1: HawkEye Keylogger 0x7b42b:$hawkstr1: HawkEye Keylogger 0x7b58e:$hawkstr1: HawkEye Keylogger 0x7b807:$hawkstr1: HawkEye Keylogger 0x79cee:$hawkstr2: Dear HawkEye Customers! 0x7b323:$hawkstr2: Dear HawkEye Customers! 0x7b47a:$hawkstr2: Dear HawkEye Customers! 0x7b5e1:$hawkstr2: Dear HawkEye Customers! 0x79e0f:$hawkstr3: HawkEye Logger Details:
27.2.hawkgoods.exe.41d0240.6.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a9fa72.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.a9fa72.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc55:$key: HawkEyeKeylogger 0x1fe99:$salt: 099u787978786 0x1e296:$string1: HawkEye_Keylogger 0x1f0e9:$string1: HawkEye_Keylogger 0x1fdf9:$string1: HawkEye_Keylogger 0x1e67f:$string2: holdermail.txt 0x1e69f:$string2: holdermail.txt 0x1e5c1:$string3: wallet.dat 0x1e5d9:$string3: wallet.dat 0x1e5ef:$string3: wallet.dat 0x1f9bd:$string4: Keylog Records 0x1fcd5:$string4: Keylog Records 0x1fef1:$string5: do not script --> 0x1dc3d:$string6: \pidloc.txt 0x1dccb:$string7: BSPLIT 0x1dcdb:$string7: BSPLIT
27.2.hawkgoods.exe.a9fa72.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.a9fa72.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.2.hawkgoods.exe.a9fa72.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2ee:$hawkstr1: HawkEye Keylogger 0x1f12f:$hawkstr1: HawkEye Keylogger 0x1f45e:$hawkstr1: HawkEye Keylogger 0x1f5b9:$hawkstr1: HawkEye Keylogger 0x1f71c:$hawkstr1: HawkEye Keylogger 0x1f995:$hawkstr1: HawkEye Keylogger 0x1de7c:$hawkstr2: Dear HawkEye Customers! 0x1f4b1:$hawkstr2: Dear HawkEye Customers! 0x1f608:$hawkstr2: Dear HawkEye Customers! 0x1f76f:$hawkstr2: Dear HawkEye Customers! 0x1df9d:$hawkstr3: HawkEye Logger Details:
8.2.Matiexgoods.exe.f9277c.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
27.2.hawkgoods.exe.41b7e00.7.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.7c90000.10.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.2.hawkgoods.exe.2f8208.2.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.2.hawkgoods.exe.2f8208.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754bf:$key: HawkEyeKeylogger 0x77703:$salt: 099u787978786 0x75b00:$string1: HawkEye_Keylogger 0x76953:$string1: HawkEye_Keylogger 0x77663:$string1: HawkEye_Keylogger 0x75ee9:$string2: holdermail.txt 0x75f09:$string2: holdermail.txt 0x75e2b:$string3: wallet.dat 0x75e43:$string3: wallet.dat 0x75e59:$string3: wallet.dat 0x77227:$string4: Keylog Records 0x7753f:$string4: Keylog Records 0x7775b:$string5: do not script --> 0x754a7:$string6: \pidloc.txt 0x75535:$string7: BSPLIT 0x75545:$string7: BSPLIT
6.2.hawkgoods.exe.2f8208.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.2f8208.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.2.hawkgoods.exe.2f8208.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.hawkgoods.exe.2f8208.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b58:$hawkstr1: HawkEye Keylogger 0x76999:$hawkstr1: HawkEye Keylogger 0x76cc8:$hawkstr1: HawkEye Keylogger 0x76e23:$hawkstr1: HawkEye Keylogger 0x76f86:$hawkstr1: HawkEye Keylogger 0x771ff:$hawkstr1: HawkEye Keylogger 0x756e6:$hawkstr2: Dear HawkEye Customers! 0x76d1b:$hawkstr2: Dear HawkEye Customers! 0x76e72:$hawkstr2: Dear HawkEye Customers! 0x76fd9:$hawkstr2: Dear HawkEye Customers! 0x75807:$hawkstr3: HawkEye Logger Details:
28.0.origigoods40.exe.e20000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.hawkgoods.exe.2f0000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.2.hawkgoods.exe.2f0000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
6.2.hawkgoods.exe.2f0000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.2f0000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.2.hawkgoods.exe.2f0000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.hawkgoods.exe.2f0000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
34.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.2f8208.2.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.0.hawkgoods.exe.2f8208.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754bf:$key: HawkEyeKeylogger 0x77703:$salt: 099u787978786 0x75b00:$string1: HawkEye_Keylogger 0x76953:$string1: HawkEye_Keylogger 0x77663:$string1: HawkEye_Keylogger 0x75ee9:$string2: holdermail.txt 0x75f09:$string2: holdermail.txt 0x75e2b:$string3: wallet.dat 0x75e43:$string3: wallet.dat 0x75e59:$string3: wallet.dat 0x77227:$string4: Keylog Records 0x7753f:$string4: Keylog Records 0x7775b:$string5: do not script --> 0x754a7:$string6: \pidloc.txt 0x75535:$string7: BSPLIT 0x75545:$string7: BSPLIT
6.0.hawkgoods.exe.2f8208.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.2f8208.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.0.hawkgoods.exe.2f8208.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.0.hawkgoods.exe.2f8208.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b58:$hawkstr1: HawkEye Keylogger 0x76999:$hawkstr1: HawkEye Keylogger 0x76cc8:$hawkstr1: HawkEye Keylogger 0x76e23:$hawkstr1: HawkEye Keylogger 0x76f86:$hawkstr1: HawkEye Keylogger 0x771ff:$hawkstr1: HawkEye Keylogger 0x756e6:$hawkstr2: Dear HawkEye Customers! 0x76d1b:$hawkstr2: Dear HawkEye Customers! 0x76e72:$hawkstr2: Dear HawkEye Customers! 0x76fd9:$hawkstr2: Dear HawkEye Customers! 0x75807:$hawkstr3: HawkEye Logger Details:
6.2.hawkgoods.exe.3a40240.6.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
7.2.origigoods40.exe.c30000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
30.2.Matiexgoods.exe.bd0000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
31.0.origigoods20.exe.720000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
23.2.I$s#$lT3ssl.exe.4158f3f.3.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
23.2.I$s#$lT3ssl.exe.4158f3f.3.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ac7:$key: HawkEyeKeylogger 0x7bd0b:$salt: 099u787978786 0x7a108:$string1: HawkEye_Keylogger 0x7af5b:$string1: HawkEye_Keylogger 0x7bc6b:$string1: HawkEye_Keylogger 0x7a4f1:$string2: holdermail.txt 0x7a511:$string2: holdermail.txt 0x7a433:$string3: wallet.dat 0x7a44b:$string3: wallet.dat 0x7a461:$string3: wallet.dat 0x7b82f:$string4: Keylog Records 0x7bb47:$string4: Keylog Records 0x7bd63:$string5: do not script --> 0x79aaf:$string6: \pidloc.txt 0x79b3d:$string7: BSPLIT 0x79b4d:$string7: BSPLIT
23.2.I$s#$lT3ssl.exe.4158f3f.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
23.2.I$s#$lT3ssl.exe.4158f3f.3.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
23.2.I$s#$lT3ssl.exe.4158f3f.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
23.2.I$s#$lT3ssl.exe.4158f3f.3.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a160:$hawkstr1: HawkEye Keylogger 0x7afa1:$hawkstr1: HawkEye Keylogger 0x7b2d0:$hawkstr1: HawkEye Keylogger 0x7b42b:$hawkstr1: HawkEye Keylogger 0x7b58e:$hawkstr1: HawkEye Keylogger 0x7b807:$hawkstr1: HawkEye Keylogger 0x79cee:$hawkstr2: Dear HawkEye Customers! 0x7b323:$hawkstr2: Dear HawkEye Customers! 0x7b47a:$hawkstr2: Dear HawkEye Customers! 0x7b5e1:$hawkstr2: Dear HawkEye Customers! 0x79e0f:$hawkstr3: HawkEye Logger Details:
8.0.Matiexgoods.exe.f9277c.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
5.2.RegAsm.exe.4031bf.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.RegAsm.exe.4031bf.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
5.2.RegAsm.exe.4031bf.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
5.2.RegAsm.exe.4031bf.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.RegAsm.exe.4031bf.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.RegAsm.exe.4031bf.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.RegAsm.exe.4031bf.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
5.2.RegAsm.exe.40afcc.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.7f40000.11.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
8.0.Matiexgoods.exe.f70000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
26.2.RegAsm.exe.40afcc.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
35.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.2.hawkgoods.exe.3a27e00.7.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.0.hawkgoods.exe.a40000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
27.0.hawkgoods.exe.a40000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
27.0.hawkgoods.exe.a40000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.0.hawkgoods.exe.a40000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.0.hawkgoods.exe.a40000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.0.hawkgoods.exe.a40000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
5.2.RegAsm.exe.4031bf.1.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.RegAsm.exe.4031bf.1.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ac7:$key: HawkEyeKeylogger 0x7bd0b:$salt: 099u787978786 0x7a108:$string1: HawkEye_Keylogger 0x7af5b:$string1: HawkEye_Keylogger 0x7bc6b:$string1: HawkEye_Keylogger 0x7a4f1:$string2: holdermail.txt 0x7a511:$string2: holdermail.txt 0x7a433:$string3: wallet.dat 0x7a44b:$string3: wallet.dat 0x7a461:$string3: wallet.dat 0x7b82f:$string4: Keylog Records 0x7bb47:$string4: Keylog Records 0x7bd63:$string5: do not script --> 0x79aaf:$string6: \pidloc.txt 0x79b3d:$string7: BSPLIT 0x79b4d:$string7: BSPLIT
5.2.RegAsm.exe.4031bf.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.RegAsm.exe.4031bf.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.RegAsm.exe.4031bf.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.RegAsm.exe.4031bf.1.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a160:$hawkstr1: HawkEye Keylogger 0x7afa1:$hawkstr1: HawkEye Keylogger 0x7b2d0:$hawkstr1: HawkEye Keylogger 0x7b42b:$hawkstr1: HawkEye Keylogger 0x7b58e:$hawkstr1: HawkEye Keylogger 0x7b807:$hawkstr1: HawkEye Keylogger 0x79cee:$hawkstr2: Dear HawkEye Customers! 0x7b323:$hawkstr2: Dear HawkEye Customers! 0x7b47a:$hawkstr2: Dear HawkEye Customers! 0x7b5e1:$hawkstr2: Dear HawkEye Customers! 0x79e0f:$hawkstr3: HawkEye Logger Details:
34.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.0.hawkgoods.exe.a49c0d.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a48208.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
27.2.hawkgoods.exe.a48208.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754bf:$key: HawkEyeKeylogger 0x77703:$salt: 099u787978786 0x75b00:$string1: HawkEye_Keylogger 0x76953:$string1: HawkEye_Keylogger 0x77663:$string1: HawkEye_Keylogger 0x75ee9:$string2: holdermail.txt 0x75f09:$string2: holdermail.txt 0x75e2b:$string3: wallet.dat 0x75e43:$string3: wallet.dat 0x75e59:$string3: wallet.dat 0x77227:$string4: Keylog Records 0x7753f:$string4: Keylog Records 0x7775b:$string5: do not script --> 0x754a7:$string6: \pidloc.txt 0x75535:$string7: BSPLIT 0x75545:$string7: BSPLIT
27.2.hawkgoods.exe.a48208.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
27.2.hawkgoods.exe.a48208.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.2.hawkgoods.exe.a48208.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.a48208.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b58:$hawkstr1: HawkEye Keylogger 0x76999:$hawkstr1: HawkEye Keylogger 0x76cc8:$hawkstr1: HawkEye Keylogger 0x76e23:$hawkstr1: HawkEye Keylogger 0x76f86:$hawkstr1: HawkEye Keylogger 0x771ff:$hawkstr1: HawkEye Keylogger 0x756e6:$hawkstr2: Dear HawkEye Customers! 0x76d1b:$hawkstr2: Dear HawkEye Customers! 0x76e72:$hawkstr2: Dear HawkEye Customers! 0x76fd9:$hawkstr2: Dear HawkEye Customers! 0x75807:$hawkstr3: HawkEye Logger Details:
18.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
27.2.hawkgoods.exe.31f8c9c.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
6.0.hawkgoods.exe.2f9c0d.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73aba:$key: HawkEyeKeylogger 0x75cfe:$salt: 099u787978786 0x740fb:$string1: HawkEye_Keylogger 0x74f4e:$string1: HawkEye_Keylogger 0x75c5e:$string1: HawkEye_Keylogger 0x744e4:$string2: holdermail.txt 0x74504:$string2: holdermail.txt 0x74426:$string3: wallet.dat 0x7443e:$string3: wallet.dat 0x74454:$string3: wallet.dat 0x75822:$string4: Keylog Records 0x75b3a:$string4: Keylog Records 0x75d56:$string5: do not script --> 0x73aa2:$string6: \pidloc.txt 0x73b30:$string7: BSPLIT 0x73b40:$string7: BSPLIT
6.0.hawkgoods.exe.2f9c0d.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.0.hawkgoods.exe.2f9c0d.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.0.hawkgoods.exe.2f9c0d.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
6.0.hawkgoods.exe.2f9c0d.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74153:$hawkstr1: HawkEye Keylogger 0x74f94:$hawkstr1: HawkEye Keylogger 0x752c3:$hawkstr1: HawkEye Keylogger 0x7541e:$hawkstr1: HawkEye Keylogger 0x75581:$hawkstr1: HawkEye Keylogger 0x757fa:$hawkstr1: HawkEye Keylogger 0x73ce1:$hawkstr2: Dear HawkEye Customers! 0x75316:$hawkstr2: Dear HawkEye Customers! 0x7546d:$hawkstr2: Dear HawkEye Customers! 0x755d4:$hawkstr2: Dear HawkEye Customers! 0x73e02:$hawkstr3: HawkEye Logger Details:
17.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.PO_Invoices_pdf.exe.4398f3f.4.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79ac7:$key: HawkEyeKeylogger 0x7bd0b:$salt: 099u787978786 0x7a108:$string1: HawkEye_Keylogger 0x7af5b:$string1: HawkEye_Keylogger 0x7bc6b:$string1: HawkEye_Keylogger 0x7a4f1:$string2: holdermail.txt 0x7a511:$string2: holdermail.txt 0x7a433:$string3: wallet.dat 0x7a44b:$string3: wallet.dat 0x7a461:$string3: wallet.dat 0x7b82f:$string4: Keylog Records 0x7bb47:$string4: Keylog Records 0x7bd63:$string5: do not script --> 0x79aaf:$string6: \pidloc.txt 0x79b3d:$string7: BSPLIT 0x79b4d:$string7: BSPLIT
0.2.PO_Invoices_pdf.exe.4398f3f.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a160:$hawkstr1: HawkEye Keylogger 0x7afa1:$hawkstr1: HawkEye Keylogger 0x7b2d0:$hawkstr1: HawkEye Keylogger 0x7b42b:$hawkstr1: HawkEye Keylogger 0x7b58e:$hawkstr1: HawkEye Keylogger 0x7b807:$hawkstr1: HawkEye Keylogger 0x79cee:$hawkstr2: Dear HawkEye Customers! 0x7b323:$hawkstr2: Dear HawkEye Customers! 0x7b47a:$hawkstr2: Dear HawkEye Customers! 0x7b5e1:$hawkstr2: Dear HawkEye Customers! 0x79e0f:$hawkstr3: HawkEye Logger Details:
30.2.Matiexgoods.exe.bf277c.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
26.2.RegAsm.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x990e:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
26.2.RegAsm.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ddb2:$key: HawkEyeKeylogger 0x7fff6:$salt: 099u787978786 0x7e3f3:$string1: HawkEye_Keylogger 0x7f246:$string1: HawkEye_Keylogger 0x7ff56:$string1: HawkEye_Keylogger 0x7e7dc:$string2: holdermail.txt 0x7e7fc:$string2: holdermail.txt 0x7e71e:$string3: wallet.dat 0x7e736:$string3: wallet.dat 0x7e74c:$string3: wallet.dat 0x7fb1a:$string4: Keylog Records 0x7fe32:$string4: Keylog Records 0x8004e:$string5: do not script --> 0x7dd9a:$string6: \pidloc.txt 0x7de28:$string7: BSPLIT 0x7de38:$string7: BSPLIT
26.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
26.2.RegAsm.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
26.2.RegAsm.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
26.2.RegAsm.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
26.2.RegAsm.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7e44b:$hawkstr1: HawkEye Keylogger 0x7f28c:$hawkstr1: HawkEye Keylogger 0x7f5bb:$hawkstr1: HawkEye Keylogger 0x7f716:$hawkstr1: HawkEye Keylogger 0x7f879:$hawkstr1: HawkEye Keylogger 0x7faf2:$hawkstr1: HawkEye Keylogger 0x7dfd9:$hawkstr2: Dear HawkEye Customers! 0x7f60e:$hawkstr2: Dear HawkEye Customers! 0x7f765:$hawkstr2: Dear HawkEye Customers! 0x7f8cc:$hawkstr2: Dear HawkEye Customers! 0x7e0fa:$hawkstr3: HawkEye Logger Details:
27.2.hawkgoods.exe.a49c0d.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
18.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
30.0.Matiexgoods.exe.bf277c.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
6.2.hawkgoods.exe.34fa72.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc55:$key: HawkEyeKeylogger 0x1fe99:$salt: 099u787978786 0x1e296:$string1: HawkEye_Keylogger 0x1f0e9:$string1: HawkEye_Keylogger 0x1fdf9:$string1: HawkEye_Keylogger 0x1e67f:$string2: holdermail.txt 0x1e69f:$string2: holdermail.txt 0x1e5c1:$string3: wallet.dat 0x1e5d9:$string3: wallet.dat 0x1e5ef:$string3: wallet.dat 0x1f9bd:$string4: Keylog Records 0x1fcd5:$string4: Keylog Records 0x1fef1:$string5: do not script --> 0x1dc3d:$string6: \pidloc.txt 0x1dccb:$string7: BSPLIT 0x1dcdb:$string7: BSPLIT
6.2.hawkgoods.exe.34fa72.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
6.2.hawkgoods.exe.34fa72.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
6.2.hawkgoods.exe.34fa72.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e2ee:$hawkstr1: HawkEye Keylogger 0x1f12f:$hawkstr1: HawkEye Keylogger 0x1f45e:$hawkstr1: HawkEye Keylogger 0x1f5b9:$hawkstr1: HawkEye Keylogger 0x1f71c:$hawkstr1: HawkEye Keylogger 0x1f995:$hawkstr1: HawkEye Keylogger 0x1de7c:$hawkstr2: Dear HawkEye Customers! 0x1f4b1:$hawkstr2: Dear HawkEye Customers! 0x1f608:$hawkstr2: Dear HawkEye Customers! 0x1f76f:$hawkstr2: Dear HawkEye Customers! 0x1df9d:$hawkstr3: HawkEye Logger Details:
26.2.RegAsm.exe.4095c7.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
26.2.RegAsm.exe.4095c7.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754bf:$key: HawkEyeKeylogger 0x77703:$salt: 099u787978786 0x75b00:$string1: HawkEye_Keylogger 0x76953:$string1: HawkEye_Keylogger 0x77663:$string1: HawkEye_Keylogger 0x75ee9:$string2: holdermail.txt 0x75f09:$string2: holdermail.txt 0x75e2b:$string3: wallet.dat 0x75e43:$string3: wallet.dat 0x75e59:$string3: wallet.dat 0x77227:$string4: Keylog Records 0x7753f:$string4: Keylog Records 0x7775b:$string5: do not script --> 0x754a7:$string6: \pidloc.txt 0x75535:$string7: BSPLIT 0x75545:$string7: BSPLIT
26.2.RegAsm.exe.4095c7.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
26.2.RegAsm.exe.4095c7.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
26.2.RegAsm.exe.4095c7.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
26.2.RegAsm.exe.4095c7.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
26.2.RegAsm.exe.4095c7.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b58:$hawkstr1: HawkEye Keylogger 0x76999:$hawkstr1: HawkEye Keylogger 0x76cc8:$hawkstr1: HawkEye Keylogger 0x76e23:$hawkstr1: HawkEye Keylogger 0x76f86:$hawkstr1: HawkEye Keylogger 0x771ff:$hawkstr1: HawkEye Keylogger 0x756e6:$hawkstr2: Dear HawkEye Customers! 0x76d1b:$hawkstr2: Dear HawkEye Customers! 0x76e72:$hawkstr2: Dear HawkEye Customers! 0x76fd9:$hawkstr2: Dear HawkEye Customers! 0x75807:$hawkstr3: HawkEye Logger Details:
5.2.RegAsm.exe.4095c7.2.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.RegAsm.exe.4095c7.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x754bf:$key: HawkEyeKeylogger 0x77703:$salt: 099u787978786 0x75b00:$string1: HawkEye_Keylogger 0x76953:$string1: HawkEye_Keylogger 0x77663:$string1: HawkEye_Keylogger 0x75ee9:$string2: holdermail.txt 0x75f09:$string2: holdermail.txt 0x75e2b:$string3: wallet.dat 0x75e43:$string3: wallet.dat 0x75e59:$string3: wallet.dat 0x77227:$string4: Keylog Records 0x7753f:$string4: Keylog Records 0x7775b:$string5: do not script --> 0x754a7:$string6: \pidloc.txt 0x75535:$string7: BSPLIT 0x75545:$string7: BSPLIT
5.2.RegAsm.exe.4095c7.2.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
5.2.RegAsm.exe.4095c7.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.RegAsm.exe.4095c7.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.RegAsm.exe.4095c7.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.RegAsm.exe.4095c7.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b58:$hawkstr1: HawkEye Keylogger 0x76999:$hawkstr1: HawkEye Keylogger 0x76cc8:$hawkstr1: HawkEye Keylogger 0x76e23:$hawkstr1: HawkEye Keylogger 0x76f86:$hawkstr1: HawkEye Keylogger 0x771ff:$hawkstr1: HawkEye Keylogger 0x756e6:$hawkstr2: Dear HawkEye Customers! 0x76d1b:$hawkstr2: Dear HawkEye Customers! 0x76e72:$hawkstr2: Dear HawkEye Customers! 0x76fd9:$hawkstr2: Dear HawkEye Customers! 0x75807:$hawkstr3: HawkEye Logger Details:
5.2.RegAsm.exe.40afcc.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73aba:$key: HawkEyeKeylogger 0x75cfe:$salt: 099u787978786 0x740fb:$string1: HawkEye_Keylogger 0x74f4e:$string1: HawkEye_Keylogger 0x75c5e:$string1: HawkEye_Keylogger 0x744e4:$string2: holdermail.txt 0x74504:$string2: holdermail.txt 0x74426:$string3: wallet.dat 0x7443e:$string3: wallet.dat 0x74454:$string3: wallet.dat 0x75822:$string4: Keylog Records 0x75b3a:$string4: Keylog Records 0x75d56:$string5: do not script --> 0x73aa2:$string6: \pidloc.txt 0x73b30:$string7: BSPLIT 0x73b40:$string7: BSPLIT
5.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
5.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.RegAsm.exe.40afcc.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74153:$hawkstr1: HawkEye Keylogger 0x74f94:$hawkstr1: HawkEye Keylogger 0x752c3:$hawkstr1: HawkEye Keylogger 0x7541e:$hawkstr1: HawkEye Keylogger 0x75581:$hawkstr1: HawkEye Keylogger 0x757fa:$hawkstr1: HawkEye Keylogger 0x73ce1:$hawkstr2: Dear HawkEye Customers! 0x75316:$hawkstr2: Dear HawkEye Customers! 0x7546d:$hawkstr2: Dear HawkEye Customers! 0x755d4:$hawkstr2: Dear HawkEye Customers! 0x73e02:$hawkstr3: HawkEye Logger Details:
6.2.hawkgoods.exe.2a689b0.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.RegAsm.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x990e:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
5.2.RegAsm.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7ddb2:$key: HawkEyeKeylogger 0x7fff6:$salt: 099u787978786 0x7e3f3:$string1: HawkEye_Keylogger 0x7f246:$string1: HawkEye_Keylogger 0x7ff56:$string1: HawkEye_Keylogger 0x7e7dc:$string2: holdermail.txt 0x7e7fc:$string2: holdermail.txt 0x7e71e:$string3: wallet.dat 0x7e736:$string3: wallet.dat 0x7e74c:$string3: wallet.dat 0x7fb1a:$string4: Keylog Records 0x7fe32:$string4: Keylog Records 0x8004e:$string5: do not script --> 0x7dd9a:$string6: \pidloc.txt 0x7de28:$string7: BSPLIT 0x7de38:$string7: BSPLIT
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
5.2.RegAsm.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
5.2.RegAsm.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7e44b:$hawkstr1: HawkEye Keylogger 0x7f28c:$hawkstr1: HawkEye Keylogger 0x7f5bb:$hawkstr1: HawkEye Keylogger 0x7f716:$hawkstr1: HawkEye Keylogger 0x7f879:$hawkstr1: HawkEye Keylogger 0x7faf2:$hawkstr1: HawkEye Keylogger 0x7dfd9:$hawkstr2: Dear HawkEye Customers! 0x7f60e:$hawkstr2: Dear HawkEye Customers! 0x7f765:$hawkstr2: Dear HawkEye Customers! 0x7f8cc:$hawkstr2: Dear HawkEye Customers! 0x7e0fa:$hawkstr3: HawkEye Logger Details:
26.2.RegAsm.exe.40afcc.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73aba:$key: HawkEyeKeylogger 0x75cfe:$salt: 099u787978786 0x740fb:$string1: HawkEye_Keylogger 0x74f4e:$string1: HawkEye_Keylogger 0x75c5e:$string1: HawkEye_Keylogger 0x744e4:$string2: holdermail.txt 0x74504:$string2: holdermail.txt 0x74426:$string3: wallet.dat 0x7443e:$string3: wallet.dat 0x74454:$string3: wallet.dat 0x75822:$string4: Keylog Records 0x75b3a:$string4: Keylog Records 0x75d56:$string5: do not script --> 0x73aa2:$string6: \pidloc.txt 0x73b30:$string7: BSPLIT 0x73b40:$string7: BSPLIT
26.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
26.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
26.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
26.2.RegAsm.exe.40afcc.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
26.2.RegAsm.exe.40afcc.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x74153:$hawkstr1: HawkEye Keylogger 0x74f94:$hawkstr1: HawkEye Keylogger 0x752c3:$hawkstr1: HawkEye Keylogger 0x7541e:$hawkstr1: HawkEye Keylogger 0x75581:$hawkstr1: HawkEye Keylogger 0x757fa:$hawkstr1: HawkEye Keylogger 0x73ce1:$hawkstr2: Dear HawkEye Customers! 0x75316:$hawkstr2: Dear HawkEye Customers! 0x7546d:$hawkstr2: Dear HawkEye Customers! 0x755d4:$hawkstr2: Dear HawkEye Customers! 0x73e02:$hawkstr3: HawkEye Logger Details:
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x890e:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7cdb2:$key: HawkEyeKeylogger 0x7eff6:$salt: 099u787978786 0x7d3f3:$string1: HawkEye_Keylogger 0x7e246:$string1: HawkEye_Keylogger 0x7ef56:$string1: HawkEye_Keylogger 0x7d7dc:$string2: holdermail.txt 0x7d7fc:$string2: holdermail.txt 0x7d71e:$string3: wallet.dat 0x7d736:$string3: wallet.dat 0x7d74c:$string3: wallet.dat 0x7eb1a:$string4: Keylog Records 0x7ee32:$string4: Keylog Records 0x7f04e:$string5: do not script --> 0x7cd9a:$string6: \pidloc.txt 0x7ce28:$string7: BSPLIT 0x7ce38:$string7: BSPLIT
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7d44b:$hawkstr1: HawkEye Keylogger 0x7e28c:$hawkstr1: HawkEye Keylogger 0x7e5bb:$hawkstr1: HawkEye Keylogger 0x7e716:$hawkstr1: HawkEye Keylogger 0x7e879:$hawkstr1: HawkEye Keylogger 0x7eaf2:$hawkstr1: HawkEye Keylogger 0x7cfd9:$hawkstr2: Dear HawkEye Customers! 0x7e60e:$hawkstr2: Dear HawkEye Customers! 0x7e765:$hawkstr2: Dear HawkEye Customers! 0x7e8cc:$hawkstr2: Dear HawkEye Customers! 0x7d0fa:$hawkstr3: HawkEye Logger Details:
26.2.RegAsm.exe.4031bf.2.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
26.2.RegAsm.exe.4031bf.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x7c233:$string3: wallet.dat 0x7c24b:$string3: wallet.dat 0x7c261:$string3: wallet.dat 0x7d62f:$string4: Keylog Records 0x7d947:$string4: Keylog Records 0x7db63:$string5: do not script --> 0x7b8af:$string6: \pidloc.txt 0x7b93d:$string7: BSPLIT 0x7b94d:$string7: BSPLIT
26.2.RegAsm.exe.4031bf.2.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
27.2.hawkgoods.exe.31d8e20.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x20e97:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
27.2.hawkgoods.exe.31d8e20.4.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x5360:$key: HawkEyeKeylogger 0x5a50:$salt: 099u787978786 0x1a7ac:$string1: HawkEye_Keylogger 0x1fb80:$string1: HawkEye_Keylogger 0x1d434:$string2: holdermail.txt 0x1d464:$string2: holdermail.txt 0x1b38e:$string3: wallet.dat 0x1b3b6:$string3: wallet.dat 0x1b3dc:$string3: wallet.dat 0x1c6f0:$string4: Keylog Records 0x1ca26:$string4: Keylog Records 0xa0d4:$string5: do not script --> 0x5338:$string6: \pidloc.txt 0x5440:$string7: BSPLIT 0x5460:$string7: BSPLIT
27.2.hawkgoods.exe.31d8e20.4.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
27.2.hawkgoods.exe.31d8e20.4.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1a83c:$hawkstr1: HawkEye Keylogger 0x1b680:$hawkstr1: HawkEye Keylogger 0x1ba6c:$hawkstr1: HawkEye Keylogger 0x1c6c8:$hawkstr1: HawkEye Keylogger 0x1fbd8:$hawkstr1: HawkEye Keylogger 0x2d744:$hawkstr1: HawkEye Keylogger 0x1a2b4:$hawkstr2: Dear HawkEye Customers! 0x1b6e4:$hawkstr2: Dear HawkEye Customers! 0x1bad0:$hawkstr2: Dear HawkEye Customers! 0x2d7a4:$hawkstr2: Dear HawkEye Customers! 0x1a3e6:$hawkstr3: HawkEye Logger Details:
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x890e:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7cdb2:$key: HawkEyeKeylogger 0x7eff6:$salt: 099u787978786 0x7d3f3:$string1: HawkEye_Keylogger 0x7e246:$string1: HawkEye_Keylogger 0x7ef56:$string1: HawkEye_Keylogger 0x7d7dc:$string2: holdermail.txt 0x7d7fc:$string2: holdermail.txt 0x7d71e:$string3: wallet.dat 0x7d736:$string3: wallet.dat 0x7d74c:$string3: wallet.dat 0x7eb1a:$string4: Keylog Records 0x7ee32:$string4: Keylog Records 0x7f04e:$string5: do not script --> 0x7cd9a:$string6: \pidloc.txt 0x7ce28:$string7: BSPLIT 0x7ce38:$string7: BSPLIT
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.PO_Invoices_pdf.exe.4396d80.5.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7d44b:$hawkstr1: HawkEye Keylogger 0x7e28c:$hawkstr1: HawkEye Keylogger 0x7e5bb:$hawkstr1: HawkEye Keylogger 0x7e716:$hawkstr1: HawkEye Keylogger 0x7e879:$hawkstr1: HawkEye Keylogger 0x7eaf2:$hawkstr1: HawkEye Keylogger 0x7cfd9:$hawkstr2: Dear HawkEye Customers! 0x7e60e:$hawkstr2: Dear HawkEye Customers! 0x7e765:$hawkstr2: Dear HawkEye Customers! 0x7e8cc:$hawkstr2: Dear HawkEye Customers! 0x7d0fa:$hawkstr3: HawkEye Logger Details:
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x95e2:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x16a612:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x2c9632:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7da86:$key: HawkEyeKeylogger 0x1deab6:$key: HawkEyeKeylogger 0x33dad6:$key: HawkEyeKeylogger 0x7fcca:$salt: 099u787978786 0x1e0cfa:$salt: 099u787978786 0x33fd1a:$salt: 099u787978786 0x7e0c7:$string1: HawkEye_Keylogger 0x7ef1a:$string1: HawkEye_Keylogger 0x7fc2a:$string1: HawkEye_Keylogger 0x1df0f7:$string1: HawkEye_Keylogger 0x1dff4a:$string1: HawkEye_Keylogger 0x1e0c5a:$string1: HawkEye_Keylogger 0x33e117:$string1: HawkEye_Keylogger 0x33ef6a:$string1: HawkEye_Keylogger 0x33fc7a:$string1: HawkEye_Keylogger 0x7e4b0:$string2: holdermail.txt 0x7e4d0:$string2: holdermail.txt 0x1df4e0:$string2: holdermail.txt 0x1df500:$string2: holdermail.txt 0x33e500:$string2: holdermail.txt 0x33e520:$string2: holdermail.txt
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
23.2.I$s#$lT3ssl.exe.4156d80.4.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7e11f:$hawkstr1: HawkEye Keylogger 0x7ef60:$hawkstr1: HawkEye Keylogger 0x7f28f:$hawkstr1: HawkEye Keylogger 0x7f3ea:$hawkstr1: HawkEye Keylogger 0x7f54d:$hawkstr1: HawkEye Keylogger 0x7f7c6:$hawkstr1: HawkEye Keylogger 0x1df14f:$hawkstr1: HawkEye Keylogger 0x1dff90:$hawkstr1: HawkEye Keylogger 0x1e02bf:$hawkstr1: HawkEye Keylogger 0x1e041a:$hawkstr1: HawkEye Keylogger 0x1e057d:$hawkstr1: HawkEye Keylogger 0x1e07f6:$hawkstr1: HawkEye Keylogger 0x33e16f:$hawkstr1: HawkEye Keylogger 0x33efb0:$hawkstr1: HawkEye Keylogger 0x33f2df:$hawkstr1: HawkEye Keylogger 0x33f43a:$hawkstr1: HawkEye Keylogger 0x33f59d:$hawkstr1: HawkEye Keylogger 0x33f816:$hawkstr1: HawkEye Keylogger 0x7dcad:$hawkstr2: Dear HawkEye Customers! 0x7f2e2:$hawkstr2: Dear HawkEye Customers! 0x7f439:$hawkstr2: Dear HawkEye Customers!
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x168453:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x2c7473:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x1dc8f7:$key: HawkEyeKeylogger 0x33b917:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x1deb3b:$salt: 099u787978786 0x33db5b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x1dcf38:$string1: HawkEye_Keylogger 0x1ddd8b:$string1: HawkEye_Keylogger 0x1dea9b:$string1: HawkEye_Keylogger 0x33bf58:$string1: HawkEye_Keylogger 0x33cdab:$string1: HawkEye_Keylogger 0x33dabb:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x1dd321:$string2: holdermail.txt 0x1dd341:$string2: holdermail.txt 0x33c341:$string2: holdermail.txt 0x33c361:$string2: holdermail.txt
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.PO_Invoices_pdf.exe.4398f3f.4.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x1dcf90:$hawkstr1: HawkEye Keylogger 0x1dddd1:$hawkstr1: HawkEye Keylogger 0x1de100:$hawkstr1: HawkEye Keylogger 0x1de25b:$hawkstr1: HawkEye Keylogger 0x1de3be:$hawkstr1: HawkEye Keylogger 0x1de637:$hawkstr1: HawkEye Keylogger 0x33bfb0:$hawkstr1: HawkEye Keylogger 0x33cdf1:$hawkstr1: HawkEye Keylogger 0x33d120:$hawkstr1: HawkEye Keylogger 0x33d27b:$hawkstr1: HawkEye Keylogger 0x33d3de:$hawkstr1: HawkEye Keylogger 0x33d657:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers!
23.2.I$s#$lT3ssl.exe.4158f3f.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x168453:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x2c7473:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x2f6e52:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x457e82:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x5b6ea2:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x36b2f6:$key: HawkEyeKeylogger 0x4cc326:$key: HawkEyeKeylogger 0x62b346:$key: HawkEyeKeylogger 0x36d53a:$salt: 099u787978786 0x4ce56a:$salt: 099u787978786 0x62d58a:$salt: 099u787978786 0x36b937:$string1: HawkEye_Keylogger 0x36c78a:$string1: HawkEye_Keylogger 0x36d49a:$string1: HawkEye_Keylogger 0x4cc967:$string1: HawkEye_Keylogger 0x4cd7ba:$string1: HawkEye_Keylogger 0x4ce4ca:$string1: HawkEye_Keylogger 0x62b987:$string1: HawkEye_Keylogger 0x62c7da:$string1: HawkEye_Keylogger 0x62d4ea:$string1: HawkEye_Keylogger 0x36bd20:$string2: holdermail.txt 0x36bd40:$string2: holdermail.txt 0x4ccd50:$string2: holdermail.txt 0x4ccd70:$string2: holdermail.txt 0x62bd70:$string2: holdermail.txt 0x62bd90:$string2: holdermail.txt
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.2.PO_Invoices_pdf.exe.40a9510.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x36b98f:$hawkstr1: HawkEye Keylogger 0x36c7d0:$hawkstr1: HawkEye Keylogger 0x36caff:$hawkstr1: HawkEye Keylogger 0x36cc5a:$hawkstr1: HawkEye Keylogger 0x36cdbd:$hawkstr1: HawkEye Keylogger 0x36d036:$hawkstr1: HawkEye Keylogger 0x4cc9bf:$hawkstr1: HawkEye Keylogger 0x4cd800:$hawkstr1: HawkEye Keylogger 0x4cdb2f:$hawkstr1: HawkEye Keylogger 0x4cdc8a:$hawkstr1: HawkEye Keylogger 0x4cdded:$hawkstr1: HawkEye Keylogger 0x4ce066:$hawkstr1: HawkEye Keylogger 0x62b9df:$hawkstr1: HawkEye Keylogger 0x62c820:$hawkstr1: HawkEye Keylogger 0x62cb4f:$hawkstr1: HawkEye Keylogger 0x62ccaa:$hawkstr1: HawkEye Keylogger 0x62ce0d:$hawkstr1: HawkEye Keylogger 0x62d086:$hawkstr1: HawkEye Keylogger 0x36b51d:$hawkstr2: Dear HawkEye Customers! 0x36cb52:$hawkstr2: Dear HawkEye Customers! 0x36cca9:$hawkstr2: Dear HawkEye Customers!
26.2.RegAsm.exe.4031bf.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
26.2.RegAsm.exe.4031bf.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
26.2.RegAsm.exe.4031bf.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
26.2.RegAsm.exe.4031bf.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf60:$hawkstr1: HawkEye Keylogger 0x7cda1:$hawkstr1: HawkEye Keylogger 0x7d0d0:$hawkstr1: HawkEye Keylogger 0x7d22b:$hawkstr1: HawkEye Keylogger 0x7d38e:$hawkstr1: HawkEye Keylogger 0x7d607:$hawkstr1: HawkEye Keylogger 0x7baee:$hawkstr2: Dear HawkEye Customers! 0x7d123:$hawkstr2: Dear HawkEye Customers! 0x7d27a:$hawkstr2: Dear HawkEye Customers! 0x7d3e1:$hawkstr2: Dear HawkEye Customers! 0x7bc0f:$hawkstr3: HawkEye Logger Details:
23.2.I$s#$lT3ssl.exe.4158f3f.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b8c7:$key: HawkEyeKeylogger 0x1dc8f7:$key: HawkEyeKeylogger 0x33b917:$key: HawkEyeKeylogger 0x7db0b:$salt: 099u787978786 0x1deb3b:$salt: 099u787978786 0x33db5b:$salt: 099u787978786 0x7bf08:$string1: HawkEye_Keylogger 0x7cd5b:$string1: HawkEye_Keylogger 0x7da6b:$string1: HawkEye_Keylogger 0x1dcf38:$string1: HawkEye_Keylogger 0x1ddd8b:$string1: HawkEye_Keylogger 0x1dea9b:$string1: HawkEye_Keylogger 0x33bf58:$string1: HawkEye_Keylogger 0x33cdab:$string1: HawkEye_Keylogger 0x33dabb:$string1: HawkEye_Keylogger 0x7c2f1:$string2: holdermail.txt 0x7c311:$string2: holdermail.txt 0x1dd321:$string2: holdermail.txt 0x1dd341:$string2: holdermail.txt 0x33c341:$string2: holdermail.txt 0x33c361:$string2: holdermail.txt
23.2.I$s#$lT3ssl.exe.4158f3f.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PO_Invoices_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: HawkEye

Threatname: Agenttesla

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs