MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd966cfd3e9d36ff13df08130bdc22bc8456502a1addb6dfe02d58897f976c91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd966cfd3e9d36ff13df08130bdc22bc8456502a1addb6dfe02d58897f976c91
SHA3-384 hash: 5310d589ecbe98a78e2854670f92e49613be29ed1f2cb87d0ddc0b807e9e05be33a2d1371571078489d213b522139a56
SHA1 hash: 0722ade7d86cdb2c72a21d44c13b7a9f45d3e68d
MD5 hash: 328583386c37c4f460790feda15ec3a5
humanhash: spaghetti-north-apart-arkansas
File name:TT final copy.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:410'015 bytes
First seen:2020-05-04 17:49:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:kmnXNpUaUyxzSKy4D3+sD4gb8lGn57nuv9OSr9P9e8pFmSFe0eklKxPv:km9ZTc6+g43yZIOSfe8/1E02v
TLSH A194236BC0E5AC8F5F8F9C92652B17E0AD65A8DFB67DCB25928388D74CE4C43941E044
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: hosting2.comnet.co.ls
Sending IP: 154.66.108.42
From: Jacek Świderski <jacek.swiderski@finanseplatinum.pl>
Subject: TT final transmit copy
Attachment: TT final copy.zip (contains "TT final copy.pif")

HawkEye SMTP exfil server:
bot.whatismyipaddress.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44195.11176.13097.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 11:52:44 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwlgz7j6tu3p6e67bajqxxbcxscfmubkdlo3nx7afvmis74xnsiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip bd966cfd3e9d36ff13df08130bdc22bc8456502a1addb6dfe02d58897f976c91

(this sample)

HawkEye

Executable exe 170914b423f415bdf562a5ee3eff48808d4b0731013bcdf870bfdf2bcded8caa

  
Dropping
MD5 29552f1095636a883593205bd1e14ec1
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 170914b423f415bdf562a5ee3eff48808d4b0731013bcdf870bfdf2bcded8caa

Comments