MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e00a231db5268aabbf82259fb2f25b541b7877a5d8be339b107dfab1e896338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

HawkEye

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	2e00a231db5268aabbf82259fb2f25b541b7877a5d8be339b107dfab1e896338
SHA3-384 hash:	16a56c73ac0d23f30aac9a39bc0914218ccdc5bfa81a14ab4197d45102c3de0bd0e65ea4e86b638506d7740bd3bdc335
SHA1 hash:	704543747163e5b2ce8dc703e865159bb5e36963
MD5 hash:	cc98bde70f95fc961a1f8086de2ed197
humanhash:	winner-london-april-autumn
File name:	royalp.exe
Download:	download sample
Signature	HawkEye Create hunting rule
File size:	1'288'704 bytes
First seen:	2020-04-02 11:13:05 UTC
Last seen:	2020-04-02 11:36:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9838de482e5c72f1ec745619bda341ba (4 x AgentTesla, 1 x FormBook, 1 x HawkEye)
ssdeep	24576:qaaIvYitt1sB/eLKVOJPyPbdf7qlGkbuPKraKuENHsKuJATvSLk+PoIUP:qWt1sd9sJPyPb9acPKZHRSSdIUP
Threatray	7'002 similar samples on MalwareBazaar
TLSH	A855D026F1814C37C1A31A3DDD0B6358B82ABE512E2865476BF81D7C9F3E6513B2A1C7
Reporter	oppimaniac
Tags:	HawkEye

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Fareit.tc.26775.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-04-02 11:35:37 UTC

File Type:

PE (Exe)

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fyakemo3kjukvo7yejm7wlzfwva3pb32lwf6gonra7p2whujmm4a._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HawkEye

exe 2e00a231db5268aabbf82259fb2f25b541b7877a5d8be339b107dfab1e896338

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/333895/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteExA shell32.dll::ShellExecuteA shell32.dll::SHGetFileInfoA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::VirtualAllocEx kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_BASE_USER_API	Retrieves Account Information	kernel32.dll::GetComputerNameA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample