Tuesday, May 28, 2024

New Variant of HawkEye Sold on Hacking Forums and Distributed via Excel and DOC Files

Threat actors advertised a new version of the information stealer malware kit HawkEye Reborn v9 that exfiltrates various information from the infected systems.

Talos observed the ongoing campaigns targeting organization leveraging HawkEye Reborn v9 to exfiltrate sensitive information and login credentials.

HawkEye malware kit is active since 2013, it has roboust stealing capabilities, it exfiltrates sensitive information from different applications and sends back to attackers by using FTP, HTTP, and SMTP protocols.

Talos learned a change in ownership of the toolkit at the end of December 2018, after the exchange new version of the toolkit HawkEye Reborn v9 advertised by another threat actor, below is their pricing model.

HawkEye

HawkEye Campaign

The campaign found to be active since 2018 and still ongoing, the current version HawkEye Reborn v9 is heavily obfuscated and it is distributed as invoices, bills of materials, order confirmations, and other corporate functions.

With the current campaign, the malware leverages Microsoft Excel files, RTF and DOC files, file sharing platforms such as Dropbox for distributing the malware.

Another interesting characteristic of the malicious documents is that the metadata associated with the document files themselves also matches that found in many of the malicious documents that were previously being used to spread Remcos, Talos noted.

The infection starts with the malformed Excel sheets that exploit code execution vulnerability CVE-2017-11882 in Microsoft Office.

HawkEye

The malware steals information form common web browsers, Filezilla, Beyluxe Messenger, CoreFTP, video game “Minecraft, copy clipboard functions, records screen, and pictures from webcam.

HawkEye Reborn v9 includes MailPassView and WebBrowserPassView freeware tools to exfiltrate credentials.

Indicators of Compromise

You can hashes for Email attachments here and PE32 executables here.

Domains associated 
tfvn[.]com[.]vn
shirkeswitch[.]net
guideofgeorgia[.]org
gulfclouds[.]site
jhssourcingltd[.]com
kamagra4uk[.]com
pioneerfitting[.]com
positronicsindia[.]com
scseguros[.]pt
spldernet[.]com
toshioco[.]com
www[.]happytohelpyou[.]in

IP addresses associated
112.213.89[.]40
67.23.254[.]61
62.212.33[.]98
153.92.5[.]124
185.117.22[.]197
23.94.188[.]246
67.23.254[.]170
72.52.150[.]218
148.66.136[.]62
107.180.24[.]253
108.179.246[.]138
18.221.35[.]214
94.46.15[.]200
66.23.237[.]186
72.52.150[.]218

URLs
https[:]//a[.]pomf[.]cat/
http[:]//pomf[.]cat/upload[.]php

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Miner Malware Uses Multiple Propagation Methods to Infect Windows Machines and to Drop Monero Miner

Two Hackers of Bayrob Malware Gang Convicted for Infecting more than 400,000 Computers Worldwide

Website

Latest articles

Researchers Exploited Nexus Repository Using Directory Traversal Vulnerability

Hackers target and exploit GitHub repositories for a multitude of reasons and illicit purposes.The...

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles