Hawkeye

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Type
Keylogger
Origin
Unknown
First seen
1 January, 2013
Last seen
17 January, 2020
Also known as
Predator Pain
HawkEye Reborn
Global rank
7
Week rank
9
Month rank
11
IOCs
1265

What is Hawkeye malware?

Hawkeye, also known as Predator Pain is a dangerous trojan and keylogger - a malware used to steal information from PCs. It has very advanced detection evasion and information stealing functionality. Hawkeye can be combined with other malicious software to steal passwords from email clients and web browsers.

Available as a service on the dark web, Hawkeye can be used even by non-technically savvy attackers. In addition, this malware is known to have been advertised for some time in the general internet on its own website which today is unavailable. What’s more, creators of Hawkeye have developed a unique business model in which intermediaries are used for reselling the malware.

General description of Hawkeye

Hawkeye keylogger is capable of stealing a variety of information from the victim's PC, including passwords from mail clients and web browsers and bitcoin wallet information. Furthermore, this malware can take screenshots, has a keylogger functionality and can retrieve data from Internet download manager as employ JDownloader to steal passwords.

Predator Pain targets victims worldwide, but it’s attacks are being registered most often in the countries with the wealthiest economies according to the GPD data, such as the USA, Canda, Italy, and others.

Hawkeye keylogger employs a sophisticated technique to stay hidden from the antiviruses called process hollowing. In essence, the Trojan generates a new instance of a harmless process to subsequently swap the native code with a malicious one. The 8 version of Hawkeye keylogger is different from previous iterations of the malware in that instead of running the main malicious code as new process, the latest build injects the payload into MSBuild.exe, RegAsm.exe, and VBC.exe, which are a part of the .NET framework, enabling the virus to further disguises itself as a real and harmless process.

Another difference of the newest Predator Pain version from the older ones is that instead of being written in C, it now uses .NET and calls the native Windows API directly.

The primary function of Hawkeye keylogger is to record the key and mouse presses along with window context and clipboard data. In addition, the malware has special modules that allow it to derive information from certain applications, including a popular video game Minecraft, the FTP client FileZilla and others.

Somewhat standardly, Predator Pain utilizes real BrowserPassView and MailPassView tools to save data from browsers and emails. In addition, the malware is able to activate and take control of the webcam, if the infected machine has one connected.

To prevent detection and analysis, Hawkeye comes equipped with a series of anti-evasion tools besides processes hollowing. For instance, the malware is able to set a delay before being executed which helps it trick some of the automated sandbox analysis tools. It also comes equipped with a technique which targets specific antivirus processes and stops them from executing and blocks access to several domains used by antivirus programs for updating.

What’s more, the malware takes active steps to prevent the victim from disabling its own processes by taking control over command prompt, registry editor, and task manager. At the same time, Hawkeye constantly scans the computer for other malicious programs and instantly deletes them, if found.

Hawkeye keylogger malware analysis

The execution process of the Predator Pain keylogger can be reviewed in a lot of detail in a video recorded in the ANY.RUN malware hunting service

hawkeye execution process graph

Figure 1. a visual process graph generated by ANY.RUN allows to quickly review the lifecycle of the Hawkeye

text report of the hawkeye malware analysis

Figure 2. ANY.RUN also allows researchers to generate customizable text reports which are a great way to present the analysis results

Hawkeye execution process

hawkeye execution process tree

Figure 3. Execution processes of Hawkeye as displayed by the ANY.RUN malware hunting service

Hawkeye keylogger usually reaches users' devices through phishing emails, most commonly as a malicious Microsoft Office file, such as Docx file. After the user opens the downloaded file it either asks the user to enable macros or uses vulnerabilities to download and execute the main payload. In most cases, it downloads itself into the %AppData% folder. To maintain its presence, the malware adds itself to the autorun registry. It also uses process hollowing to hide its code in legitimate processes. The 8 version of Hawkeye, which is presented in the video from our simulation, injects itself either into MSBuild.exe, RegAsm.exe, or VBC.exe. Before sending information to the control server, Hawkeye saves stolen data in Tmp files which are placed into the %Temp% folder. Usually, these Tmp files are deleted after the information is sent to a control server.

stolen by hawkeye data saved in tmp file

Figure 4. Information saved in .TMP file

How to avoid infection by Hawkeye?

Following some common online hygiene guidelines is a good way to stay safe from getting infected with Hawkeye. Users should be careful when downloading free software from unknown or suspicious websites and carefully check the URLs when downloading any software in general.

In addition, after receiving a suspicious email or an email from an unidentified sender, users should be very careful when downloading attachments. If when opened, the document prompts the user to enable macros or activate the editing, users must never follow these instructions as they most likely indicate the malicious nature of the file.

Distribution of Hawkeye

Hawkeye trojan uses multiple distribution methods including packaging within free downloadable programs or being disguised as legitimate software. Hawkeye can also be installed to the victim’s PC manually if the attacker gains either remote or physical access to the machine.

However, the most commonly used distribution method is email phishing, where the malware is distributed as a malicious attachment, usually a Microsoft Word document. Known phishing campaigns usually revolve around notifications regarding an issue with a real product, quotation requests, payment orders or random or personal, disturbing topics which were aimed at tricking the victim to download the attachment.

In most cases, the Microsoft Office opens the document with a warning and Hawkeye displays a message prompting to enable editing, which the user must interact with in order for the trojan to start the execution process. In some other cases hower, the malware uses Microsoft Office exploits, allowing Hawkeye to start the execution without any user interaction.

How to detect Hawkeye using ANY.RUN?

This malware creates files which allow to analysts say for sure that this is Hawkeye. Click on the malicious process in the process tree and then click "More info" button. On the upper-right corner of the "Events" panel switch from "Friendly" to "Raw". Now you see all operations with files that were performed by a chosen process. Often this malware family creates files with "Reborn" in their names and based on that you can determine that it is Hawkeye.

files created by hawkeye Figure 5: Files created by Hawkeye

Conclusion

Carrying extremely advanced anti-evasion techniques and robust info-stealing functionality, Hawkeye presents a serious danger to corporations and individuals all around the globe. Unfortunately, the distribution of malware as a service allows even non-technically savvy cybercriminals to set up effective attack campaigns, contributing to the overall popularity of the virus.

Furthermore, Hawkeye trojan uses a set of special techniques to complicate the analysis and in particular – trick automated analysis services and complicating the development of countermeasures.

However, interactive analysis services like ANY.RUN gives researchers the ability to examine malware even as elusive as Hawkeye is and conduct effective studies.

IOCs

IP addresses
66.171.248.178
103.21.58.156
162.241.148.33
103.21.59.28
209.237.134.156
108.179.194.93
104.16.154.36
104.16.155.36
104.153.45.242
185.193.52.212
185.101.95.28
162.210.70.9
88.99.251.203
162.222.225.59
162.222.225.57
107.6.154.186
160.153.162.10
204.11.58.87
209.99.16.42
199.188.201.105
Hashes
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
dd1df8bd90d1fdb854c25d555c7b4b32a71c8bcd3cd87786b4be2e04f5526e34
4a7bd3594606895313a16b448a69fd563801564681946bc293ea33cd133b4cf6
32b60d7bba22cc1682f4ba651d86c9fb357bdc82e9a284ab9668e5446bd24bb3
b592d65ad2bd3e7bcb93bcdd0cfce74fdb5718b604b60257f1bd941d1dc59e34
3c0764a9b15831a9cbe41293f701c5bc5d5a56559076102df2a8005924e6a883
969dd023e726f7fc0f3d39451c46d7fd32912d5c9a66ad3fe8e017f4642da1f8
e51c2707e59a63a97631adfdb85af38a10628f9528497717975eb2b6ff0b83f5
4f4ae09809e38edd73ea7acb9aae90fbc127c58099bda3c31ab50365c9bec1d9
97bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
ea1c3c0965e6adfa869536b871fb2bd3d497f946597df59f9668aebce8cff1fb
e13d06a13ea86758c637bcd656e92dbed8a313fd36bf868de2c08851fef33742
ad076239cc85d808d8ece748fd62976b5917dca0b59462bf5c65b60579d4c39b
4e0e0ebb3931f4f549f006f8c4a3a91d26255cd265c57c297bcecb241633bb41
cf197d0fc59ca65df36d98006c0a929ab3053bd3ea3b3dc04dbbce7306ab4e50
9fb242a4adc557d4eb4f638c7815f58dd590fbd20e4132dbc358eadae42fe44d
3eb85214c777bc9b173684ee6cf0de3c415bff66e06bb0d96e11937509aee552
a03f19bc4d7fdbf006b41c3e3641efdd87a5925f0ca0c04204223563cf67c2c7
b869c101e71a258fd51ef63b5f987888a50ee7a1f2b3e023708ca97af9e961c9
e80b0ca3c0d551b6301b573720d08eef6b0e00ac681308cf2f60b53488ff9fff
Domains
smtp.tradels-co.com
qxq.ddns.net
thuocnam.tk
majul.com
m-onetrading-jp.com
krupskaya.com
isns.net
smtp.safewaypm.ae
smtp.ganeshstone.in
smtp.iconic-qrp.com
mail.classic-logistics.com
indiasanitationcoalition.org
ftp.tashipta.com
ftp.testproeg.com
smtp.bioaccentonline.us
mail.crdd.mx
smtp.bulkyfundz.com
smtp.nutritionauctores.com
smtp.pbrend.com
smtp.ageatiainc.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More
Dridex screenshot
Dridex
dridex trojan banker
Dridex is a very evasive and technically complex banking Trojan. Despite being based on a relatively old malware code, it was substantially updated over the years and became capable of using very effective infiltration techniques that make this malware especially dangerous.
Read More