[BreachExchange] New Variant of HawkEye Sold on Hacking Forums and Distributed via Excel and DOC Files

[Destry Winant]

https://gbhackers.com/hawkeye-distributed-excel/

Threat actors advertised a new version of the information stealer
malware kit HawkEye Reborn v9 that exfiltrates various information
from the infected systems.

Talos observed the ongoing campaigns targeting organization leveraging
HawkEye Reborn v9 to exfiltrate sensitive information and login
credentials.

HawkEye malware kit is active since 2013, it has roboust stealing
capabilities, it exfiltrates sensitive information from different
applications and sends back to attackers by using FTP, HTTP, and SMTP
protocols.

Talos learned a change in ownership of the toolkit at the end of
December 2018, after the exchange new version of the toolkit HawkEye
Reborn v9 advertised by another threat actor, below is their pricing
model.

HawkEye Campaign

The campaign found to be active since 2018 and still ongoing, the
current version HawkEye Reborn v9 is heavily obfuscated and it is
distributed as invoices, bills of materials, order confirmations, and
other corporate functions.

With the current campaign, the malware leverages Microsoft Excel
files, RTF and DOC files, file sharing platforms such as Dropbox for
distributing the malware.

Another interesting characteristic of the malicious documents is that
the metadata associated with the document files themselves also
matches that found in many of the malicious documents that were
previously being used to spread Remcos, Talos noted.

The infection starts with the malformed Excel sheets that exploit code
execution vulnerability CVE-2017-11882 in Microsoft Office.

The malware steals information form common web browsers, Filezilla,
Beyluxe Messenger, CoreFTP, video game “Minecraft, copy clipboard
functions, records screen, and pictures from webcam.

HawkEye Reborn v9 includes MailPassView and WebBrowserPassView
freeware tools to exfiltrate credentials.

Indicators of Compromise

You can hashes for Email attachments here and PE32 executables here.

Domains associated
tfvn[.]com[.]vn
shirkeswitch[.]net
guideofgeorgia[.]org
gulfclouds[.]site
jhssourcingltd[.]com
kamagra4uk[.]com
pioneerfitting[.]com
positronicsindia[.]com
scseguros[.]pt
spldernet[.]com
toshioco[.]com
www[.]happytohelpyou[.]in

IP addresses associated
112.213.89[.]40
67.23.254[.]61
62.212.33[.]98
153.92.5[.]124
185.117.22[.]197
23.94.188[.]246
67.23.254[.]170
72.52.150[.]218
148.66.136[.]62
107.180.24[.]253
108.179.246[.]138
18.221.35[.]214
94.46.15[.]200
66.23.237[.]186
72.52.150[.]218

URLs
https[:]//a[.]pomf[.]cat/
http[:]//pomf[.]cat/upload[.]php