MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e5861ed6a17036fc582174c31c373fcfa464a6c24a2beab96c540f7883e24ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e5861ed6a17036fc582174c31c373fcfa464a6c24a2beab96c540f7883e24ba
SHA3-384 hash: 62eed2094d3688cd08980b046022a84ce4c4371d43c0937e6cbd49c388838513f4801bd78577edf2dd799be2962ef9db
SHA1 hash: 2310bb6fbc0d5ac219dd748258fbd4bed083d18d
MD5 hash: 053d8594109a6575e8ff892f6f35123a
humanhash: minnesota-idaho-arkansas-social
File name:PO 75410085_Pdf_______________.gz
Download: download sample
Signature HawkEye
Create hunting rule
File size:675'744 bytes
First seen:2020-05-12 15:51:12 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:l1fiODR4ur0aMkGhkaNSIn5vPOp7wvRTaBCKPjlNsBkqUnwx+q57sBwIP3ISU1:fNR4lh3Jn5ep7oRhKPzMUnMKDQSU1
TLSH BAE433B302E942B195C635C08DE6F7DB7F0EA54910469BF04D8A9EF229D06D53409EFE
Reporter abuse_ch
Tags:gz HawkEye


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: slmarketing.com.my
Sending IP: 209.58.149.66
From: Huy Cường <jbsales@slmarketing.com.my>
Subject: Purchase Order 75410085
Attachment: PO 75410085_Pdf_______________.gz (contains "PO 75410085_Pdf_______________.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 03:07:13 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzmgd3lkc4bw7rmcc5gddq3t7t5emstmesrl5k4wyvappcb6es5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

gz 4e5861ed6a17036fc582174c31c373fcfa464a6c24a2beab96c540f7883e24ba

(this sample)

HawkEye

Executable exe 623088f292f9cda615bded9d1d9990dfbb3f03943b570054e92d7d6f5a992b3a

  
Dropping
MD5 4cf536a025295e6c6360c749b32c9b07
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 623088f292f9cda615bded9d1d9990dfbb3f03943b570054e92d7d6f5a992b3a

Comments