MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 517d8b2852f709db4e9899576e5e1b1b848427b7e0829a7f918a6dc8875772b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 517d8b2852f709db4e9899576e5e1b1b848427b7e0829a7f918a6dc8875772b9
SHA3-384 hash: e4ae43e94f47d8442b7e9d4b51e73702be26eb84c2a7312d7889bb41f073e36eb0760acf9f250875d9ee3c0560502dff
SHA1 hash: 9342600fe28f23bbd091016deb388d6b6e37569d
MD5 hash: a1eeeb20ef5d7c2d3393559a84d6a033
humanhash: wisconsin-cola-blossom-orange
File name:nfvwZ5fTwVu1ZFr.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:249'856 bytes
First seen:2020-05-04 13:53:22 UTC
Last seen:2020-05-04 14:43:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:u0spy59CiZCt0y7341vuKTYOYn4wiHFbHaxJSt6YiILAfhmxPk4AQDRAsGg5YMa:+y5wWAT412Kx04weF4JefGWPkXQDRL
Threatray 58 similar samples on MalwareBazaar
TLSH D434E23C2DBD113BC574C6F6CFA6D863F450D9BA3292692944D3A3554263E832AC31BE
Reporter James_inthe_box
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44197.11516.1362.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 11:22:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kf6ywkcs64e5wtuytflw4xq3dociij5x4cbju74rrjw4rb2xok4q._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
0722cedd5a2e4a5a4c94ac988f14800a6a83a8c7147f7ef52b47ae86571384e2
HawkEye
170914b423f415bdf562a5ee3eff48808d4b0731013bcdf870bfdf2bcded8caa
HawkEye
1d98e18806cb0b478899854bf39ff2388225501a109405db1816066643224ce8
HawkEye
1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734
HawkEye
35cca711eeab74520897fa7d78a5228861e9eb0bd2f66e1aa3810784acf4f11c
HawkEye
97b8bdb2c3d831301d68b883fea274703bd497462caa192f6a09130a0f42d10c
HawkEye
b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d
HawkEye
ba783a6dc1161f2de26ff815457e19aa6918ad4d6bc87f048bc00975ea4a210e
HawkEye
e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e
HawkEye
f86be0fe01d3a3fae24c8bf92bb289ec52dd7f6a9461b9ce95f062d162f124c0
HawkEye
+ 48 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger spyware stealer
Link:
https://tria.ge/reports/201109-j6d7rnbyz6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
M00nD3v Logger Payload
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments