Categories: Backdoor

Backdoor.HawkEyeKeyLogger (file analysis)

The Backdoor.HawkEyeKeyLogger is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.HawkEyeKeyLogger virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Steals private information from local Internet browsers
Exhibits behavior characteristic of Pony malware
Collects information about installed applications
Harvests credentials from local FTP client softwares
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.HawkEyeKeyLogger?


File Info:
crc32: BE3F6FB1md5: ec3badf6a8587f29f1cd4a74ac981324name: EC3BADF6A8587F29F1CD4A74AC981324.mlwsha1: 8027e790fd8cd43054f20f76728eb0fb0e2428fasha256: ad0499d408c24f5d8378f809cc3c7b6f340331761139d124b4630f5ba88a87c6sha512: 84d1cbeee794da26fa697d3ded27b71e1de7f06877bd5c5a9bbaa009105fdb4ec2aa10f9d83bcac2bac1fbc55ff71e5fe8a70092e8de4ee4dbe816d3acab8130ssdeep: 24576:olX5ZSOxori2fKIas9zwXkkaO1MbGaB1r4gYgXUxza1OYd9Mf749anlSefjtrR:ojZJurJNaozwX7aOYGWNK5COsWccn4entype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xc2xa91999-2015 Jonathan Bennett & AutoIt TeamInternalName: Au3Info.exeFileVersion: 3, 3, 14, 2CompanyName: AutoIt TeamComments: http://www.autoitscript.com/autoit3/ProductName: Au3InfoProductVersion: 3, 3, 14, 2FileDescription: Au3InfoOriginalFilename: Au3Info.exeTranslation: 0x0809 0x04b0

Backdoor.HawkEyeKeyLogger also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0051c1c11 )
Lionic	Trojan.MSIL.Generic.m!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.17779
Cynet	Malicious (score: 100)
CAT-QuickHeal	Backdoor.MsilIH.S18501285
ALYac	Trojan.Agent.CQIT
Cylance	Unsafe
Zillya	Backdoor.Androm.Win32.47659
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:Win32/Lokibot.51b505fa
K7GW	Trojan ( 0051c1c11 )
Cybereason	malicious.6a8587
Cyren	W32/Fareit.LQES-9106
Symantec	Infostealer.Lokibot!13
ESET-NOD32	a variant of Win32/Injector.DTOX
Zoner	Trojan.Win32.66296
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Cqit-6999290-0
Kaspersky	HEUR:Backdoor.MSIL.Generic
BitDefender	Trojan.Agent.CQIT
NANO-Antivirus	Trojan.Win32.Androm.euzlbn
ViRobot	Trojan.Win32.Agent.679936.V
MicroWorld-eScan	Trojan.Agent.CQIT
Tencent	Malware.Win32.Gencirc.10b3b410
Ad-Aware	Trojan.Agent.CQIT
Sophos	Mal/Generic-R + Troj/Fareit-DWG
Comodo	Malware@#18xgan0afq555
F-Secure	Heuristic.HEUR/AGEN.1121814
BitDefenderTheta	AI:Packer.5033DB1116
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_NOON.AC
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
FireEye	Generic.mg.ec3badf6a8587f29
Emsisoft	Trojan.Agent.CQIT (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan-Spy.Noon.c
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1121814
eGambit	Generic.Malware
Antiy-AVL	Trojan/Generic.ASMalwS.22A8DA5
Microsoft	Trojan:Win32/Lokibot.JES!MTB
Gridinsoft	Trojan.Win32.Injector.bot!s1
Arcabit	Trojan.Agent.CQIT
GData	Trojan.Agent.CQIT
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
McAfee	Trojan-FOGX!EC3BADF6A858
MAX	malware (ai score=100)
VBA32	TScope.Trojan.Delf
Malwarebytes	Backdoor.HawkEyeKeyLogger
Panda	Trj/CI.A
TrendMicro-HouseCall	TSPY_NOON.AC
Rising	Trojan.Injector!1.AF18 (CLASSIC)
Yandex	Trojan.GenAsa!eUxE4ruS6fs
Ikarus	Trojan-Spy.Fareit
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.DTAI!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.Generic.HwUBAdsA