Play interactive tour

Edit tour

Windows Analysis Report ypBoHI5G3x

Overview

General Information

Sample Name:	ypBoHI5G3x (renamed file extension from none to exe)
Analysis ID:	454641
MD5:	08d679d4b9a12137756cc9244bd6f017
SHA1:	580c29bc356057d76873c9c453ed466e1024b7f2
SHA256:	047f33e6f83796d9fc056d7006a6e8ef69696d63eceb29fb1592bb13a62e79bf
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

HawkEye MailPassView

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected HawkEye Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected HawkEye Keylogger

Yara detected MailPassView

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected WebBrowserPassView password recovery tool

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

ypBoHI5G3x.exe (PID: 6504 cmdline: 'C:\Users\user\Desktop\ypBoHI5G3x.exe' MD5: 08D679D4B9A12137756CC9244BD6F017)

InstallUtil.exe (PID: 6456 cmdline: C:\Users\user\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

vbc.exe (PID: 5560 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 5432 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)

cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x37e24:$hawkstr1: HawkEye Keylogger 0x3b150:$hawkstr1: HawkEye Keylogger 0x3b4d0:$hawkstr1: HawkEye Keylogger 0x3d994:$hawkstr1: HawkEye Keylogger 0x378dc:$hawkstr2: Dear HawkEye Customers! 0x3b1b0:$hawkstr2: Dear HawkEye Customers! 0x3b530:$hawkstr2: Dear HawkEye Customers! 0x37a0a:$hawkstr3: HawkEye Logger Details:
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0xfdd61:$key: HawkEyeKeylogger 0x17fe1f:$key: HawkEyeKeylogger 0x2022ff:$key: HawkEyeKeylogger 0xfff5f:$salt: 099u787978786 0x18201d:$salt: 099u787978786 0x2044fd:$salt: 099u787978786 0xfe37a:$string1: HawkEye_Keylogger 0xff1cd:$string1: HawkEye_Keylogger 0xffebf:$string1: HawkEye_Keylogger 0x180438:$string1: HawkEye_Keylogger 0x18128b:$string1: HawkEye_Keylogger 0x181f7d:$string1: HawkEye_Keylogger 0x202918:$string1: HawkEye_Keylogger 0x20376b:$string1: HawkEye_Keylogger 0x20445d:$string1: HawkEye_Keylogger 0xfe763:$string2: holdermail.txt 0xfe783:$string2: holdermail.txt 0x180821:$string2: holdermail.txt 0x180841:$string2: holdermail.txt 0x202d01:$string2: holdermail.txt 0x202d21:$string2: holdermail.txt
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xfe3d2:$hawkstr1: HawkEye Keylogger 0xff213:$hawkstr1: HawkEye Keylogger 0xff542:$hawkstr1: HawkEye Keylogger 0xff69d:$hawkstr1: HawkEye Keylogger 0xff800:$hawkstr1: HawkEye Keylogger 0xffa79:$hawkstr1: HawkEye Keylogger 0x180490:$hawkstr1: HawkEye Keylogger 0x1812d1:$hawkstr1: HawkEye Keylogger 0x181600:$hawkstr1: HawkEye Keylogger 0x18175b:$hawkstr1: HawkEye Keylogger 0x1818be:$hawkstr1: HawkEye Keylogger 0x181b37:$hawkstr1: HawkEye Keylogger 0x202970:$hawkstr1: HawkEye Keylogger 0x2037b1:$hawkstr1: HawkEye Keylogger 0x203ae0:$hawkstr1: HawkEye Keylogger 0x203c3b:$hawkstr1: HawkEye Keylogger 0x203d9e:$hawkstr1: HawkEye Keylogger 0x204017:$hawkstr1: HawkEye Keylogger 0xfdf60:$hawkstr2: Dear HawkEye Customers! 0xff595:$hawkstr2: Dear HawkEye Customers! 0xff6ec:$hawkstr2: Dear HawkEye Customers!
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b697:$key: HawkEyeKeylogger 0x7d895:$salt: 099u787978786 0x7bcb0:$string1: HawkEye_Keylogger 0x7cb03:$string1: HawkEye_Keylogger 0x7d7f5:$string1: HawkEye_Keylogger 0x7c099:$string2: holdermail.txt 0x7c0b9:$string2: holdermail.txt 0x7bfdb:$string3: wallet.dat 0x7bff3:$string3: wallet.dat 0x7c009:$string3: wallet.dat 0x7d3d7:$string4: Keylog Records 0x7d6ef:$string4: Keylog Records 0x7d8ed:$string5: do not script --> 0x7b67f:$string6: \pidloc.txt 0x7b6e5:$string7: BSPLIT 0x7b6f5:$string7: BSPLIT
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bd08:$hawkstr1: HawkEye Keylogger 0x7cb49:$hawkstr1: HawkEye Keylogger 0x7ce78:$hawkstr1: HawkEye Keylogger 0x7cfd3:$hawkstr1: HawkEye Keylogger 0x7d136:$hawkstr1: HawkEye Keylogger 0x7d3af:$hawkstr1: HawkEye Keylogger 0x7b896:$hawkstr2: Dear HawkEye Customers! 0x7cecb:$hawkstr2: Dear HawkEye Customers! 0x7d022:$hawkstr2: Dear HawkEye Customers! 0x7d189:$hawkstr2: Dear HawkEye Customers! 0x7b9b7:$hawkstr3: HawkEye Logger Details:
00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000000C.00000002.612974883.0000000007750000.00000004.00000001.sdmp	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000C.00000002.606739235.0000000003B31000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7c181:$key: HawkEyeKeylogger 0x7e37f:$salt: 099u787978786 0x7c79a:$string1: HawkEye_Keylogger 0x7d5ed:$string1: HawkEye_Keylogger 0x7e2df:$string1: HawkEye_Keylogger 0x7cb83:$string2: holdermail.txt 0x7cba3:$string2: holdermail.txt 0x7cac5:$string3: wallet.dat 0x7cadd:$string3: wallet.dat 0x7caf3:$string3: wallet.dat 0x7dec1:$string4: Keylog Records 0x7e1d9:$string4: Keylog Records 0x7e3d7:$string5: do not script --> 0x7c169:$string6: \pidloc.txt 0x7c1cf:$string7: BSPLIT 0x7c1df:$string7: BSPLIT
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7c7f2:$hawkstr1: HawkEye Keylogger 0x7d633:$hawkstr1: HawkEye Keylogger 0x7d962:$hawkstr1: HawkEye Keylogger 0x7dabd:$hawkstr1: HawkEye Keylogger 0x7dc20:$hawkstr1: HawkEye Keylogger 0x7de99:$hawkstr1: HawkEye Keylogger 0x7c380:$hawkstr2: Dear HawkEye Customers! 0x7d9b5:$hawkstr2: Dear HawkEye Customers! 0x7db0c:$hawkstr2: Dear HawkEye Customers! 0x7dc73:$hawkstr2: Dear HawkEye Customers! 0x7c4a1:$hawkstr3: HawkEye Logger Details:
Process Memory Space: ypBoHI5G3x.exe PID: 6504	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: ypBoHI5G3x.exe PID: 6504	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: ypBoHI5G3x.exe PID: 6504	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 5560	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 5432	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: InstallUtil.exe PID: 6456	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: InstallUtil.exe PID: 6456	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 6456	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.InstallUtil.exe.7750000.11.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.2b6ec2c.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.3b39930.7.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.45fa72.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.3b39930.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.3b39930.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.45fa72.2.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x1dc25:$key: HawkEyeKeylogger 0x1fe23:$salt: 099u787978786 0x1e23e:$string1: HawkEye_Keylogger 0x1f091:$string1: HawkEye_Keylogger 0x1fd83:$string1: HawkEye_Keylogger 0x1e627:$string2: holdermail.txt 0x1e647:$string2: holdermail.txt 0x1e569:$string3: wallet.dat 0x1e581:$string3: wallet.dat 0x1e597:$string3: wallet.dat 0x1f965:$string4: Keylog Records 0x1fc7d:$string4: Keylog Records 0x1fe7b:$string5: do not script --> 0x1dc0d:$string6: \pidloc.txt 0x1dc73:$string7: BSPLIT 0x1dc83:$string7: BSPLIT
12.2.InstallUtil.exe.45fa72.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.45fa72.2.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.45fa72.2.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x1e296:$hawkstr1: HawkEye Keylogger 0x1f0d7:$hawkstr1: HawkEye Keylogger 0x1f406:$hawkstr1: HawkEye Keylogger 0x1f561:$hawkstr1: HawkEye Keylogger 0x1f6c4:$hawkstr1: HawkEye Keylogger 0x1f93d:$hawkstr1: HawkEye Keylogger 0x1de24:$hawkstr2: Dear HawkEye Customers! 0x1f459:$hawkstr2: Dear HawkEye Customers! 0x1f5b0:$hawkstr2: Dear HawkEye Customers! 0x1f717:$hawkstr2: Dear HawkEye Customers! 0x1df45:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.41a36f7.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.409c0d.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b897:$key: HawkEyeKeylogger 0x7da95:$salt: 099u787978786 0x7beb0:$string1: HawkEye_Keylogger 0x7cd03:$string1: HawkEye_Keylogger 0x7d9f5:$string1: HawkEye_Keylogger 0x7c299:$string2: holdermail.txt 0x7c2b9:$string2: holdermail.txt 0x7c1db:$string3: wallet.dat 0x7c1f3:$string3: wallet.dat 0x7c209:$string3: wallet.dat 0x7d5d7:$string4: Keylog Records 0x7d8ef:$string4: Keylog Records 0x7daed:$string5: do not script --> 0x7b87f:$string6: \pidloc.txt 0x7b8e5:$string7: BSPLIT 0x7b8f5:$string7: BSPLIT
12.2.InstallUtil.exe.400000.0.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.400000.0.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf08:$hawkstr1: HawkEye Keylogger 0x7cd49:$hawkstr1: HawkEye Keylogger 0x7d078:$hawkstr1: HawkEye Keylogger 0x7d1d3:$hawkstr1: HawkEye Keylogger 0x7d336:$hawkstr1: HawkEye Keylogger 0x7d5af:$hawkstr1: HawkEye Keylogger 0x7ba96:$hawkstr2: Dear HawkEye Customers! 0x7d0cb:$hawkstr2: Dear HawkEye Customers! 0x7d222:$hawkstr2: Dear HawkEye Customers! 0x7d389:$hawkstr2: Dear HawkEye Customers! 0x7bbb7:$hawkstr3: HawkEye Logger Details:
12.2.InstallUtil.exe.3b51b50.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.8110000.12.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x149a7:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0xdb84:$hawkstr1: HawkEye Keylogger 0x10eb0:$hawkstr1: HawkEye Keylogger 0x11230:$hawkstr1: HawkEye Keylogger 0x136f4:$hawkstr1: HawkEye Keylogger 0xd63c:$hawkstr2: Dear HawkEye Customers! 0x10f10:$hawkstr2: Dear HawkEye Customers! 0x11290:$hawkstr2: Dear HawkEye Customers! 0xd76a:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7548f:$key: HawkEyeKeylogger 0x7768d:$salt: 099u787978786 0x75aa8:$string1: HawkEye_Keylogger 0x768fb:$string1: HawkEye_Keylogger 0x775ed:$string1: HawkEye_Keylogger 0x75e91:$string2: holdermail.txt 0x75eb1:$string2: holdermail.txt 0x75dd3:$string3: wallet.dat 0x75deb:$string3: wallet.dat 0x75e01:$string3: wallet.dat 0x771cf:$string4: Keylog Records 0x774e7:$string4: Keylog Records 0x776e5:$string5: do not script --> 0x75477:$string6: \pidloc.txt 0x754dd:$string7: BSPLIT 0x754ed:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b00:$hawkstr1: HawkEye Keylogger 0x76941:$hawkstr1: HawkEye Keylogger 0x76c70:$hawkstr1: HawkEye Keylogger 0x76dcb:$hawkstr1: HawkEye Keylogger 0x76f2e:$hawkstr1: HawkEye Keylogger 0x771a7:$hawkstr1: HawkEye Keylogger 0x7568e:$hawkstr2: Dear HawkEye Customers! 0x76cc3:$hawkstr2: Dear HawkEye Customers! 0x76e1a:$hawkstr2: Dear HawkEye Customers! 0x76f81:$hawkstr2: Dear HawkEye Customers! 0x757af:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79a97:$key: HawkEyeKeylogger 0x7bc95:$salt: 099u787978786 0x7a0b0:$string1: HawkEye_Keylogger 0x7af03:$string1: HawkEye_Keylogger 0x7bbf5:$string1: HawkEye_Keylogger 0x7a499:$string2: holdermail.txt 0x7a4b9:$string2: holdermail.txt 0x7a3db:$string3: wallet.dat 0x7a3f3:$string3: wallet.dat 0x7a409:$string3: wallet.dat 0x7b7d7:$string4: Keylog Records 0x7baef:$string4: Keylog Records 0x7bced:$string5: do not script --> 0x79a7f:$string6: \pidloc.txt 0x79ae5:$string7: BSPLIT 0x79af5:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a108:$hawkstr1: HawkEye Keylogger 0x7af49:$hawkstr1: HawkEye Keylogger 0x7b278:$hawkstr1: HawkEye Keylogger 0x7b3d3:$hawkstr1: HawkEye Keylogger 0x7b536:$hawkstr1: HawkEye Keylogger 0x7b7af:$hawkstr1: HawkEye Keylogger 0x79c96:$hawkstr2: Dear HawkEye Customers! 0x7b2cb:$hawkstr2: Dear HawkEye Customers! 0x7b422:$hawkstr2: Dear HawkEye Customers! 0x7b589:$hawkstr2: Dear HawkEye Customers! 0x79db7:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.439c2d7.6.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
18.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
18.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7548f:$key: HawkEyeKeylogger 0x7768d:$salt: 099u787978786 0x75aa8:$string1: HawkEye_Keylogger 0x768fb:$string1: HawkEye_Keylogger 0x775ed:$string1: HawkEye_Keylogger 0x75e91:$string2: holdermail.txt 0x75eb1:$string2: holdermail.txt 0x75dd3:$string3: wallet.dat 0x75deb:$string3: wallet.dat 0x75e01:$string3: wallet.dat 0x771cf:$string4: Keylog Records 0x774e7:$string4: Keylog Records 0x776e5:$string5: do not script --> 0x75477:$string6: \pidloc.txt 0x754dd:$string7: BSPLIT 0x754ed:$string7: BSPLIT
12.2.InstallUtil.exe.408208.1.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
12.2.InstallUtil.exe.408208.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.408208.1.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b00:$hawkstr1: HawkEye Keylogger 0x76941:$hawkstr1: HawkEye Keylogger 0x76c70:$hawkstr1: HawkEye Keylogger 0x76dcb:$hawkstr1: HawkEye Keylogger 0x76f2e:$hawkstr1: HawkEye Keylogger 0x771a7:$hawkstr1: HawkEye Keylogger 0x7568e:$hawkstr2: Dear HawkEye Customers! 0x76cc3:$hawkstr2: Dear HawkEye Customers! 0x76e1a:$hawkstr2: Dear HawkEye Customers! 0x76f81:$hawkstr2: Dear HawkEye Customers! 0x757af:$hawkstr3: HawkEye Logger Details:
12.2.InstallUtil.exe.3b51b50.8.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x79a97:$key: HawkEyeKeylogger 0x7bc95:$salt: 099u787978786 0x7a0b0:$string1: HawkEye_Keylogger 0x7af03:$string1: HawkEye_Keylogger 0x7bbf5:$string1: HawkEye_Keylogger 0x7a499:$string2: holdermail.txt 0x7a4b9:$string2: holdermail.txt 0x7a3db:$string3: wallet.dat 0x7a3f3:$string3: wallet.dat 0x7a409:$string3: wallet.dat 0x7b7d7:$string4: Keylog Records 0x7baef:$string4: Keylog Records 0x7bced:$string5: do not script --> 0x79a7f:$string6: \pidloc.txt 0x79ae5:$string7: BSPLIT 0x79af5:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x5623:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7a108:$hawkstr1: HawkEye Keylogger 0x7af49:$hawkstr1: HawkEye Keylogger 0x7b278:$hawkstr1: HawkEye Keylogger 0x7b3d3:$hawkstr1: HawkEye Keylogger 0x7b536:$hawkstr1: HawkEye Keylogger 0x7b7af:$hawkstr1: HawkEye Keylogger 0x79c96:$hawkstr2: Dear HawkEye Customers! 0x7b2cb:$hawkstr2: Dear HawkEye Customers! 0x7b422:$hawkstr2: Dear HawkEye Customers! 0x7b589:$hawkstr2: Dear HawkEye Customers! 0x79db7:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b897:$key: HawkEyeKeylogger 0x7da95:$salt: 099u787978786 0x7beb0:$string1: HawkEye_Keylogger 0x7cd03:$string1: HawkEye_Keylogger 0x7d9f5:$string1: HawkEye_Keylogger 0x7c299:$string2: holdermail.txt 0x7c2b9:$string2: holdermail.txt 0x7c1db:$string3: wallet.dat 0x7c1f3:$string3: wallet.dat 0x7c209:$string3: wallet.dat 0x7d5d7:$string4: Keylog Records 0x7d8ef:$string4: Keylog Records 0x7daed:$string5: do not script --> 0x7b87f:$string6: \pidloc.txt 0x7b8e5:$string7: BSPLIT 0x7b8f5:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf08:$hawkstr1: HawkEye Keylogger 0x7cd49:$hawkstr1: HawkEye Keylogger 0x7d078:$hawkstr1: HawkEye Keylogger 0x7d1d3:$hawkstr1: HawkEye Keylogger 0x7d336:$hawkstr1: HawkEye Keylogger 0x7d5af:$hawkstr1: HawkEye Keylogger 0x7ba96:$hawkstr2: Dear HawkEye Customers! 0x7d0cb:$hawkstr2: Dear HawkEye Customers! 0x7d222:$hawkstr2: Dear HawkEye Customers! 0x7d389:$hawkstr2: Dear HawkEye Customers! 0x7bbb7:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73a8a:$key: HawkEyeKeylogger 0x75c88:$salt: 099u787978786 0x740a3:$string1: HawkEye_Keylogger 0x74ef6:$string1: HawkEye_Keylogger 0x75be8:$string1: HawkEye_Keylogger 0x7448c:$string2: holdermail.txt 0x744ac:$string2: holdermail.txt 0x743ce:$string3: wallet.dat 0x743e6:$string3: wallet.dat 0x743fc:$string3: wallet.dat 0x757ca:$string4: Keylog Records 0x75ae2:$string4: Keylog Records 0x75ce0:$string5: do not script --> 0x73a72:$string6: \pidloc.txt 0x73ad8:$string7: BSPLIT 0x73ae8:$string7: BSPLIT
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x740fb:$hawkstr1: HawkEye Keylogger 0x74f3c:$hawkstr1: HawkEye Keylogger 0x7526b:$hawkstr1: HawkEye Keylogger 0x753c6:$hawkstr1: HawkEye Keylogger 0x75529:$hawkstr1: HawkEye Keylogger 0x757a2:$hawkstr1: HawkEye Keylogger 0x73c89:$hawkstr2: Dear HawkEye Customers! 0x752be:$hawkstr2: Dear HawkEye Customers! 0x75415:$hawkstr2: Dear HawkEye Customers! 0x7557c:$hawkstr2: Dear HawkEye Customers! 0x73daa:$hawkstr3: HawkEye Logger Details:
12.2.InstallUtil.exe.409c0d.3.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73a8a:$key: HawkEyeKeylogger 0x75c88:$salt: 099u787978786 0x740a3:$string1: HawkEye_Keylogger 0x74ef6:$string1: HawkEye_Keylogger 0x75be8:$string1: HawkEye_Keylogger 0x7448c:$string2: holdermail.txt 0x744ac:$string2: holdermail.txt 0x743ce:$string3: wallet.dat 0x743e6:$string3: wallet.dat 0x743fc:$string3: wallet.dat 0x757ca:$string4: Keylog Records 0x75ae2:$string4: Keylog Records 0x75ce0:$string5: do not script --> 0x73a72:$string6: \pidloc.txt 0x73ad8:$string7: BSPLIT 0x73ae8:$string7: BSPLIT
12.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
12.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
12.2.InstallUtil.exe.409c0d.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
12.2.InstallUtil.exe.409c0d.3.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x740fb:$hawkstr1: HawkEye Keylogger 0x74f3c:$hawkstr1: HawkEye Keylogger 0x7526b:$hawkstr1: HawkEye Keylogger 0x753c6:$hawkstr1: HawkEye Keylogger 0x75529:$hawkstr1: HawkEye Keylogger 0x757a2:$hawkstr1: HawkEye Keylogger 0x73c89:$hawkstr2: Dear HawkEye Customers! 0x752be:$hawkstr2: Dear HawkEye Customers! 0x75415:$hawkstr2: Dear HawkEye Customers! 0x7557c:$hawkstr2: Dear HawkEye Customers! 0x73daa:$hawkstr3: HawkEye Logger Details:
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7b897:$key: HawkEyeKeylogger 0xfd955:$key: HawkEyeKeylogger 0x17fe35:$key: HawkEyeKeylogger 0x7da95:$salt: 099u787978786 0xffb53:$salt: 099u787978786 0x182033:$salt: 099u787978786 0x7beb0:$string1: HawkEye_Keylogger 0x7cd03:$string1: HawkEye_Keylogger 0x7d9f5:$string1: HawkEye_Keylogger 0xfdf6e:$string1: HawkEye_Keylogger 0xfedc1:$string1: HawkEye_Keylogger 0xffab3:$string1: HawkEye_Keylogger 0x18044e:$string1: HawkEye_Keylogger 0x1812a1:$string1: HawkEye_Keylogger 0x181f93:$string1: HawkEye_Keylogger 0x7c299:$string2: holdermail.txt 0x7c2b9:$string2: holdermail.txt 0xfe357:$string2: holdermail.txt 0xfe377:$string2: holdermail.txt 0x180837:$string2: holdermail.txt 0x180857:$string2: holdermail.txt
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x7423:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x894e1:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x10b9c1:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x7bf08:$hawkstr1: HawkEye Keylogger 0x7cd49:$hawkstr1: HawkEye Keylogger 0x7d078:$hawkstr1: HawkEye Keylogger 0x7d1d3:$hawkstr1: HawkEye Keylogger 0x7d336:$hawkstr1: HawkEye Keylogger 0x7d5af:$hawkstr1: HawkEye Keylogger 0xfdfc6:$hawkstr1: HawkEye Keylogger 0xfee07:$hawkstr1: HawkEye Keylogger 0xff136:$hawkstr1: HawkEye Keylogger 0xff291:$hawkstr1: HawkEye Keylogger 0xff3f4:$hawkstr1: HawkEye Keylogger 0xff66d:$hawkstr1: HawkEye Keylogger 0x1804a6:$hawkstr1: HawkEye Keylogger 0x1812e7:$hawkstr1: HawkEye Keylogger 0x181616:$hawkstr1: HawkEye Keylogger 0x181771:$hawkstr1: HawkEye Keylogger 0x1818d4:$hawkstr1: HawkEye Keylogger 0x181b4d:$hawkstr1: HawkEye Keylogger 0x7ba96:$hawkstr2: Dear HawkEye Customers! 0x7d0cb:$hawkstr2: Dear HawkEye Customers! 0x7d222:$hawkstr2: Dear HawkEye Customers!
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x73a8a:$key: HawkEyeKeylogger 0xf5b48:$key: HawkEyeKeylogger 0x178028:$key: HawkEyeKeylogger 0x75c88:$salt: 099u787978786 0xf7d46:$salt: 099u787978786 0x17a226:$salt: 099u787978786 0x740a3:$string1: HawkEye_Keylogger 0x74ef6:$string1: HawkEye_Keylogger 0x75be8:$string1: HawkEye_Keylogger 0xf6161:$string1: HawkEye_Keylogger 0xf6fb4:$string1: HawkEye_Keylogger 0xf7ca6:$string1: HawkEye_Keylogger 0x178641:$string1: HawkEye_Keylogger 0x179494:$string1: HawkEye_Keylogger 0x17a186:$string1: HawkEye_Keylogger 0x7448c:$string2: holdermail.txt 0x744ac:$string2: holdermail.txt 0xf654a:$string2: holdermail.txt 0xf656a:$string2: holdermail.txt 0x178a2a:$string2: holdermail.txt 0x178a4a:$string2: holdermail.txt
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x816d4:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x103bb4:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x740fb:$hawkstr1: HawkEye Keylogger 0x74f3c:$hawkstr1: HawkEye Keylogger 0x7526b:$hawkstr1: HawkEye Keylogger 0x753c6:$hawkstr1: HawkEye Keylogger 0x75529:$hawkstr1: HawkEye Keylogger 0x757a2:$hawkstr1: HawkEye Keylogger 0xf61b9:$hawkstr1: HawkEye Keylogger 0xf6ffa:$hawkstr1: HawkEye Keylogger 0xf7329:$hawkstr1: HawkEye Keylogger 0xf7484:$hawkstr1: HawkEye Keylogger 0xf75e7:$hawkstr1: HawkEye Keylogger 0xf7860:$hawkstr1: HawkEye Keylogger 0x178699:$hawkstr1: HawkEye Keylogger 0x1794da:$hawkstr1: HawkEye Keylogger 0x179809:$hawkstr1: HawkEye Keylogger 0x179964:$hawkstr1: HawkEye Keylogger 0x179ac7:$hawkstr1: HawkEye Keylogger 0x179d40:$hawkstr1: HawkEye Keylogger 0x73c89:$hawkstr2: Dear HawkEye Customers! 0x752be:$hawkstr2: Dear HawkEye Customers! 0x75415:$hawkstr2: Dear HawkEye Customers!
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	RAT_HawkEye	Detects HawkEye RAT	Kevin Breen <kevin@techanarchy.net>	0x7548f:$key: HawkEyeKeylogger 0xf754d:$key: HawkEyeKeylogger 0x179a2d:$key: HawkEyeKeylogger 0x7768d:$salt: 099u787978786 0xf974b:$salt: 099u787978786 0x17bc2b:$salt: 099u787978786 0x75aa8:$string1: HawkEye_Keylogger 0x768fb:$string1: HawkEye_Keylogger 0x775ed:$string1: HawkEye_Keylogger 0xf7b66:$string1: HawkEye_Keylogger 0xf89b9:$string1: HawkEye_Keylogger 0xf96ab:$string1: HawkEye_Keylogger 0x17a046:$string1: HawkEye_Keylogger 0x17ae99:$string1: HawkEye_Keylogger 0x17bb8b:$string1: HawkEye_Keylogger 0x75e91:$string2: holdermail.txt 0x75eb1:$string2: holdermail.txt 0xf7f4f:$string2: holdermail.txt 0xf7f6f:$string2: holdermail.txt 0x17a42f:$string2: holdermail.txt 0x17a44f:$string2: holdermail.txt
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	HKTL_NET_GUID_Stealer	Detects c# red/black-team tools via typelibguid	Arnim Rupp	0x101b:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x830d9:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df 0x1055b9:$typelibguid0: 8fcd4931-91a2-4e18-849b-70de34ab75df
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack	Hawkeye	detect HawkEye in memory	JPCERT/CC Incident Response Group	0x75b00:$hawkstr1: HawkEye Keylogger 0x76941:$hawkstr1: HawkEye Keylogger 0x76c70:$hawkstr1: HawkEye Keylogger 0x76dcb:$hawkstr1: HawkEye Keylogger 0x76f2e:$hawkstr1: HawkEye Keylogger 0x771a7:$hawkstr1: HawkEye Keylogger 0xf7bbe:$hawkstr1: HawkEye Keylogger 0xf89ff:$hawkstr1: HawkEye Keylogger 0xf8d2e:$hawkstr1: HawkEye Keylogger 0xf8e89:$hawkstr1: HawkEye Keylogger 0xf8fec:$hawkstr1: HawkEye Keylogger 0xf9265:$hawkstr1: HawkEye Keylogger 0x17a09e:$hawkstr1: HawkEye Keylogger 0x17aedf:$hawkstr1: HawkEye Keylogger 0x17b20e:$hawkstr1: HawkEye Keylogger 0x17b369:$hawkstr1: HawkEye Keylogger 0x17b4cc:$hawkstr1: HawkEye Keylogger 0x17b745:$hawkstr1: HawkEye Keylogger 0x7568e:$hawkstr2: Dear HawkEye Customers! 0x76cc3:$hawkstr2: Dear HawkEye Customers! 0x76e1a:$hawkstr2: Dear HawkEye Customers!
Click to see the 82 entries

Sigma Overview

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, CommandLine: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ParentCommandLine: 'C:\Users\user\Desktop\ypBoHI5G3x.exe' , ParentImage: C:\Users\user\Desktop\ypBoHI5G3x.exe, ParentProcessId: 6504, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\InstallUtil.exe, ProcessId: 6456

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: ypBoHI5G3x.exe.6504.1.memstr

Malware Configuration Extractor: HawkEye {"Modules": ["WebBrowserPassView", "mailpv", "Mail PassView"], "Version": ""}

Multi AV Scanner detection for submitted file

Show sources

Source: ypBoHI5G3x.exe	Virustotal: Detection: 28%			Perma Link
Source: ypBoHI5G3x.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: ypBoHI5G3x.exe

Joe Sandbox ML: detected

Source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack	Avira: Label: TR/Inject.vcoldi
Source: 12.2.InstallUtil.exe.400000.0.unpack	Avira: Label: TR/AD.MExecute.lzrac
Source: 12.2.InstallUtil.exe.400000.0.unpack	Avira: Label: SPR/Tool.MailPassView.473
Source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack	Avira: Label: TR/Inject.vcoldi

Source: ypBoHI5G3x.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.6:49723 version: TLS 1.0

Source: ypBoHI5G3x.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.613574939.0000000008110000.00000004.00000001.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599966159.00000000008B2000.00000002.00020000.sdmp, InstallUtil.exe.1.dr
Source:	Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe
Source:	Binary string: InstallUtil.pdb source: ypBoHI5G3x.exe, 00000001.00000002.463314966.000000000768B000.00000004.00000001.sdmp, InstallUtil.exe, InstallUtil.exe.1.dr

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: autorun.inf
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp	Binary or memory string: [autorun]
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	Binary or memory string: autorun.inf
Source: InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	Binary or memory string: [autorun]

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,	18_2_00408441
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 18_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,	18_2_00407E0E
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,	19_2_00406EC3

Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	1_2_05FFC130
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	1_2_05FF9648
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-24h]	1_2_05FFA0D8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	1_2_05FFA0D8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-24h]	1_2_05FFA0CC
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	1_2_05FFA0CC
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then xor edx, edx	1_2_05FFA010
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then xor edx, edx	1_2_05FFA004
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	1_2_05FFC37D
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-20h]	1_2_05FF9DB8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	1_2_05FF9DB8
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then push dword ptr [ebp-20h]	1_2_05FF9DAD
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	1_2_05FF9DAD
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then jmp 05FF51E0h	1_2_05FF4968
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then jmp 05FF51E0h	1_2_05FF4959
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	1_2_05FF98D5
Source: C:\Users\user\Desktop\ypBoHI5G3x.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	1_2_05FFA828
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then jmp 0516A630h	12_2_0516A559
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then jmp 0516A630h	12_2_0516A568
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	12_2_05169EF5
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	12_2_05162B75
Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	12_2_05169A2D

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2020410 ET TROJAN HawkEye Keylogger FTP 192.168.2.6:49759 -> 45.141.152.18:21

Source: global traffic

TCP traffic: 192.168.2.6:49760 -> 45.141.152.18:62998

Source: Joe Sandbox View	IP Address: 45.141.152.18 45.141.152.18
Source: Joe Sandbox View	IP Address: 45.141.152.18 45.141.152.18

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

FTP traffic detected: 45.141.152.18:21 -> 192.168.2.6:49759 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 8 of 50 allowed.220-Local time is now 05:13. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown

HTTPS traffic detected: 142.250.185.196:443 -> 192.168.2.6:49723 version: TLS 1.0

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, vbc.exe, 00000012.00000002.493947169.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: InstallUtil.exe, 0000000C.00000002.602869141.0000000002BF3000.00000004.00000001.sdmp	String found in binary or memory: http://ftp.vngpack.com
Source: ypBoHI5G3x.exe, 00000001.00000003.347743311.000000000736F000.00000004.00000001.sdmp, ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1
Source: ypBoHI5G3x.exe, 00000001.00000003.347743311.000000000736F000.00000004.00000001.sdmp, ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: ypBoHI5G3x.exe, 00000001.00000003.446695266.0000000007376000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g%%N
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: ypBoHI5G3x.exe, 00000001.00000002.448077774.0000000003167000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ypBoHI5G3x.exe, 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://whatismyipaddress.com/-
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com-sM
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com.F
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comou
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comro
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comue
Source: InstallUtil.exe, 0000000C.00000003.455801076.0000000005D48000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comva
Source: InstallUtil.exe, 0000000C.00000003.455586589.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comw
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFD
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comay
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdR
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgrito
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comitu
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coml1
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: InstallUtil.exe, 0000000C.00000003.461734038.0000000005D4B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm(
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: InstallUtil.exe, 0000000C.00000003.470360983.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comu
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnhic
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cno
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnomp$
Source: InstallUtil.exe, 0000000C.00000003.454846783.0000000005D46000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cntra:
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: InstallUtil.exe, 0000000C.00000003.456469435.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/D
Source: InstallUtil.exe, 0000000C.00000003.456469435.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/G
Source: InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/R
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Verdk
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/adnl
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/cs-c
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: InstallUtil.exe, 0000000C.00000003.456756762.0000000005D4A000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/settR
Source: InstallUtil.exe, 0000000C.00000003.457320751.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/wuR
Source: InstallUtil.exe, 0000000C.00000003.457780221.0000000005D49000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/wvR
Source: InstallUtil.exe, 0000000C.00000003.468375972.0000000005D70000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.S
Source: vbc.exe, vbc.exe, 00000013.00000002.491218277.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: InstallUtil.exe, 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp	String found in binary or memory: http://www.site.com/logs.php
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: InstallUtil.exe, 0000000C.00000002.612022947.0000000006F52000.00000004.00000001.sdmp, InstallUtil.exe, 0000000C.00000003.455377795.0000000005D47000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: InstallUtil.exe, 0000000C.00000003.455377795.0000000005D47000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnm
Source: vbc.exe, 00000012.00000003.493497095.00000000022DC000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activi
Source: vbc.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: ypBoHI5G3x.exe, 00000001.00000002.447965365.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/
Source: vbc.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin

Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 12.2.InstallUtil.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.2b5b2a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a1cf2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.408208.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.419b8ea.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.41a36f7.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.InstallUtil.exe.409c0d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.43944ca.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439c2d7.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ypBoHI5G3x.exe.439a8d2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.602473757.0000000002B31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455567208.0000000004312000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.599637682.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.455392795.000000000419B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ypBoHI5G3x.exe PID: 6504, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6456, type: MEMORY

Contains functionality to log keystrokes (.Net Source)

Show sources

Source: 12.2.InstallUtil.exe.400000.0.unpack, Form1.cs

.Net Code: HookKeyboard

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 18_2_0040D674 OpenClipboard,GetLastError,DeleteFileW,

18_2_0040D674

System Summary:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ypBoHI5G3x

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: HawkEye

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary: