MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 344e84c22b21fc2196797e3da995c667e3d33fa821f93a02bc086a941a27b41f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 344e84c22b21fc2196797e3da995c667e3d33fa821f93a02bc086a941a27b41f
SHA3-384 hash: 01cd51f1c83e05edaefa0d00d5b6c3a2bb117deb64ae055faa5e5b79932098db47ae317e824ccf15757d5ef442eb71c2
SHA1 hash: ce2073ecc560e32bd91e2483808c1c7b86657de5
MD5 hash: 9a37cf97090d69e4a9474ce39af963d1
humanhash: venus-delaware-five-tennis
File name:0000000347034555_06052020.7z
Download: download sample
Signature HawkEye
Create hunting rule
File size:686'083 bytes
First seen:2020-05-06 16:59:39 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:VyWWmAqucn1KXj+6lS1neW2nwmF+Eiwud5XoZZ4iDSBajF7Fi0z:ZAquuEXj+6lIerdXWTXoZZRDSYjri0z
TLSH A4E423FD5AA0D7417E3933396781ABB918058F418213C6C972B0A6A3F1315FDDA847F4
Reporter abuse_ch
Tags:7z geo HawkEye HUN


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: mail.synch.hu
Sending IP: 193.39.14.202
From: Jubith Pataki <jubithpataki2@freemail.hu>
Subject: Átvételi másolatok
Attachment: 0000000347034555_06052020.7z (contains "0000000347034555_06052020.exe")

HawkEye FTP exfil server:
ftp.airbiast.com:21

HawkEye FTP exfil username:
GHOST@airbiast.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 17:36:28 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=grhijqrleh6cdftzpy62tfogm7r5gp5ieh4tuav4bbvjigrhwqpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

7z 344e84c22b21fc2196797e3da995c667e3d33fa821f93a02bc086a941a27b41f

(this sample)

HawkEye

Executable exe 5024c970c93f71f337a7a013d96a40d0c74870f1b6b25480bd5a507b70580cf1

  
Dropping
MD5 47b0196de05f2982f986ad83c571729b
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5024c970c93f71f337a7a013d96a40d0c74870f1b6b25480bd5a507b70580cf1

Comments