MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3876a26f12c421029582584630654343a61b849df2ad186c46aa5088e57ad919. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3876a26f12c421029582584630654343a61b849df2ad186c46aa5088e57ad919
SHA3-384 hash: c0fbc6b97231b95930e1061e3559e0e15e6f0700aed93541485d622df9aca83d3c4107ec429b63c05d5696421ba84168
SHA1 hash: 879968e5c54e8721c3d03431a2a59c79765bcec8
MD5 hash: 6e8c359ef1c706c4af9271ad31244012
humanhash: lamp-helium-mobile-johnny
File name:SPECIFICATION.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:187'844 bytes
First seen:2020-05-04 17:43:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:m7bUqLnKS+SmS+sOoTVQT+QVP2BDSnd+lrD/xoxDEIDklAzSY8yACxLBe9q47Jlp:UbUqLpuyzQV2ptl/PIDklSYyACH2BtZ9
TLSH BA0412540C5931D6BCA7786313E3F03FD9A5A88A33E98D4D38B38CA5A858E79570C94F
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: combytellc.com
Sending IP: 37.49.230.36
From: Kevin Alex <sandeepgill@combytellc.com>
Reply-To: Email ADMIN <noreply@domain-admin.com>
Subject: RFQ iNPIPE PRODUCTS™ are approved supplier for pigs & pigging solutions in MENA for ADNOC, PDO, KOC,QP etc
Attachment: SPECIFICATION.zip (contains "New Inquiry.pif")

HawkEye SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44252.25368.23324.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 05:22:34 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hb3ke3ysyqqqffmclbddazkdiotbxbe56kwrq3cgvjiirzl23emq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 3876a26f12c421029582584630654343a61b849df2ad186c46aa5088e57ad919

(this sample)

HawkEye

Executable exe b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d

  
Dropping
MD5 45ec5d63516319155ce9d9b40dde3700
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d

Comments