BreachExchange mailing list archives
New Variant of HawkEye Sold on Hacking Forums and Distributed via Excel and DOC Files
From: Destry Winant <destry () riskbasedsecurity com>
Date: Thu, 18 Apr 2019 09:09:21 -0500
https://gbhackers.com/hawkeye-distributed-excel/ Threat actors advertised a new version of the information stealer malware kit HawkEye Reborn v9 that exfiltrates various information from the infected systems. Talos observed the ongoing campaigns targeting organization leveraging HawkEye Reborn v9 to exfiltrate sensitive information and login credentials. HawkEye malware kit is active since 2013, it has roboust stealing capabilities, it exfiltrates sensitive information from different applications and sends back to attackers by using FTP, HTTP, and SMTP protocols. Talos learned a change in ownership of the toolkit at the end of December 2018, after the exchange new version of the toolkit HawkEye Reborn v9 advertised by another threat actor, below is their pricing model. HawkEye Campaign The campaign found to be active since 2018 and still ongoing, the current version HawkEye Reborn v9 is heavily obfuscated and it is distributed as invoices, bills of materials, order confirmations, and other corporate functions. With the current campaign, the malware leverages Microsoft Excel files, RTF and DOC files, file sharing platforms such as Dropbox for distributing the malware. Another interesting characteristic of the malicious documents is that the metadata associated with the document files themselves also matches that found in many of the malicious documents that were previously being used to spread Remcos, Talos noted. The infection starts with the malformed Excel sheets that exploit code execution vulnerability CVE-2017-11882 in Microsoft Office. The malware steals information form common web browsers, Filezilla, Beyluxe Messenger, CoreFTP, video game “Minecraft, copy clipboard functions, records screen, and pictures from webcam. HawkEye Reborn v9 includes MailPassView and WebBrowserPassView freeware tools to exfiltrate credentials. Indicators of Compromise You can hashes for Email attachments here and PE32 executables here. Domains associated tfvn[.]com[.]vn shirkeswitch[.]net guideofgeorgia[.]org gulfclouds[.]site jhssourcingltd[.]com kamagra4uk[.]com pioneerfitting[.]com positronicsindia[.]com scseguros[.]pt spldernet[.]com toshioco[.]com www[.]happytohelpyou[.]in IP addresses associated 112.213.89[.]40 67.23.254[.]61 62.212.33[.]98 153.92.5[.]124 185.117.22[.]197 23.94.188[.]246 67.23.254[.]170 72.52.150[.]218 148.66.136[.]62 107.180.24[.]253 108.179.246[.]138 18.221.35[.]214 94.46.15[.]200 66.23.237[.]186 72.52.150[.]218 URLs https[:]//a[.]pomf[.]cat/ http[:]//pomf[.]cat/upload[.]php _______________________________________________ BreachExchange mailing list sponsored by Risk Based Security BreachExchange () lists riskbasedsecurity com If you wish to Edit your membership or Unsubscribe you can do so at the following link: https://lists.riskbasedsecurity.com/listinfo/breachexchange
Current thread:
- New Variant of HawkEye Sold on Hacking Forums and Distributed via Excel and DOC Files Destry Winant (Apr 18)