Rewterz Threat Alert – HawkEye Infostealer – Active IOCs

Severity

Medium

Analysis Summary

HawkEye, primarily an infostealer, has additional capabilities such as bypassing of AV systems and keylogging. A spear-phishing campaign is detected using malicious RTF documents sent via corona-themed emails to distribute the HawkEye keylogger. While most malicious RTF documents use exploits to trigger Object Linking and Embedding (OLE) calls, in this case, the documents use the \objupdate switch. A victim would need to enable macros for the infection process to begin. The embedded OLE objects, five of them in this case, appear to be macro-enabled Excel sheets. PowerShell is used to execute .NET code which downloads and executes the Hawkeye payload.

Impact

• Information Theft
• Credential Theft
• Antivirus Bypass

Indicators of Compromise

MD5

• 580fb3e80b85fc1c6ddbaca71fa7197f

SHA-256

• d341fd3ce2b2dd5d252b5e8c65d8c78b387e88af8d736ff13af3592cf2cfb55b

SHA-1

• b264e9094edfbf2076730c959d81f8f8840f61e1

Remediation

• Search for IOCs in your environment.
• Block all threat indications at their respective controls.