MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf4f525ce506d9319790081b55769a928996569d65e9f8da6e4bdfebb4887e9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf4f525ce506d9319790081b55769a928996569d65e9f8da6e4bdfebb4887e9a
SHA3-384 hash: 85a00a845460c83585d3e27a743c5020c4a114a7ece717750f323c7ac077876ffb392fdc38289f834912afd4c7e96c1b
SHA1 hash: 74e398083defdcad984f6f12ea404336f6bc2573
MD5 hash: d17be49e526972ecc3d59eabccbc4387
humanhash: william-enemy-lion-sixteen
File name:Delivery Note - AWD 200038485852- 2349203968876.gz
Download: download sample
Signature HawkEye
Create hunting rule
File size:582'511 bytes
First seen:2020-05-04 21:10:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:Me4blZ2ahr2vM/nj99BO0yzUYkKZGtvH4E5RztBppwiyW:KNh0ojodUYLZ6vH4E37w7W
TLSH C0C4238C2975076FC709D675CA233A5B98FB1E9A904E40305AAED50B4B733CF113BA96
Reporter abuse_ch
Tags:DHL gz HawkEye


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: server.dz-techgroup.it
Sending IP: 217.61.37.47
From: DHL Express <katewright_dhl@gmail.com>
Subject: Failed DHL Delivery Notification
Attachment: Delivery Note - AWD 200038485852- 2349203968876.gz (contains "Delivery Note - AWD 200038485852- 2349203968876.exe")

HawkEye FTP exfil server:
ftp.southeating.com:21

HawkEye FTP exfil user name:
ddd@southeating.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7759529-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Npe
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 21:37:07 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
31 of 48 (64.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5hvexhfa3mtdf4qbanvk5u2skezmvu5mxu7rwtojpp6xneip2na._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

gz bf4f525ce506d9319790081b55769a928996569d65e9f8da6e4bdfebb4887e9a

(this sample)

HawkEye

Executable exe c465e2bc55d216e37231efbfdfeed00eeb244c2f688716a1c9c9d45ca4cc0ac0

  
Dropping
MD5 b7d182b52a2d9e1c06063c1102f02806
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c465e2bc55d216e37231efbfdfeed00eeb244c2f688716a1c9c9d45ca4cc0ac0

Comments