MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 205f9a9cd105d2327e4c79ed0d0b9673ce0589782ddc13fbd8bbe93edd7662c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 205f9a9cd105d2327e4c79ed0d0b9673ce0589782ddc13fbd8bbe93edd7662c9
SHA3-384 hash: aab0af8e2588867b44c6eb7080908afe84aac2c0450648944f43b942156c21e7b5dd175a7ec83727dc016e21c6e09ad2
SHA1 hash: b178431195e59eb472146e860aeff0b66fb466b4
MD5 hash: 737a07952e725c07c25b7caf25f789eb
humanhash: fourteen-finch-cat-purple
File name:WSL1960011872.z
Download: download sample
Signature HawkEye
Create hunting rule
File size:705'555 bytes
First seen:2020-08-04 07:30:31 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:z9uYSMCQUa77R0Cbf60uzdfieoCVwBlGvfgBJJe4acsj8LSbDgNoC2:zZJCQUanR0Cbf60KdRHSbGvmbGmSbkd2
TLSH 1AE4233F6C7B802F96CE99F798ECCA6D0549E83EA3427BDF01205E6951C4070F26D569
Reporter abuse_ch
Tags:HawkEye z


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: ns5.de-soft.com
Sending IP: 198.57.255.7
From: Grant Nilsen<GrantNilsen@magnerinternational.com>
Reply-To: Yoanka Aguilar<yaguilar@magnerinternational.com>
Subject: new order
Attachment: WSL1960011872.z (contains "WSL1960011872.exe")

HawkEye SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/205f9a9cd105d2327e4c79ed0d0b9673ce0589782ddc13fbd8bbe93edd7662c9/
Threat name:
Win32.Spyware.HawkEye
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 04:12:13 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebpzvhgraxjde7smphwq2c4wophalclyfxobh66yxput5xlwmleq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/205f9a9cd105d2327e4c79ed0d0b9673ce0589782ddc13fbd8bbe93edd7662c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

z 205f9a9cd105d2327e4c79ed0d0b9673ce0589782ddc13fbd8bbe93edd7662c9

(this sample)

HawkEye

Executable exe c49423c0fce4c71e3bef5bc92441e9510c7f46d54207446df6496128f9780924

  
Dropping
MD5 15fff0ee366388b9d008b30343a8e982
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c49423c0fce4c71e3bef5bc92441e9510c7f46d54207446df6496128f9780924

Comments