MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c84d0a9a9ee6556b5bb064012e81e18dd510127e531b00f995b0ace01165d15d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c84d0a9a9ee6556b5bb064012e81e18dd510127e531b00f995b0ace01165d15d
SHA3-384 hash: 84a29157ddc4cc4bb1418406e2b921113e598dacbd19b91b1f4cc752483cc6a7f09232836adeab09d0f614a8bf79da3a
SHA1 hash: e0a5e83632395b8fbe1bb6ff10f57c01c2b5790e
MD5 hash: 07380a0b14e408931a11d285ce6f72be
humanhash: georgia-fourteen-blue-monkey
File name:c84d0a9a9ee6556b5bb064012e81e18dd510127e531b00f995b0ace01165d15d
Download: download sample
Signature HawkEye
Create hunting rule
File size:697'856 bytes
First seen:2020-03-24 07:30:52 UTC
Last seen:2020-03-24 09:50:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Scc24g81elYI8DEG2T4mel0SZAO18R3LX8mq1CCMVPG8SN:kT3elnyqXUR/IMmqMhVPG8SN
Threatray 6'624 similar samples on MalwareBazaar
TLSH 31E4BE3DDFE8863EC277CD39DACA4603F869491B221DE94E58D363B352221927CA315D
Reporter Marco_Ramilli
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
2
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.626320.31390.10002.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 00:35:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zbgqvgu64zkwww5qmqas5apbrxkraet6kmnqb6mvwcwoaelf2foq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
1d492bc6d7dd22a0ff5c75a3cff6a19629a0179b27b15045bb7893439fd91ca3
HawkEye
2e00a231db5268aabbf82259fb2f25b541b7877a5d8be339b107dfab1e896338
HawkEye
3dd0e88a93b6d4fa561f0ece77fee607262c53a5ecb7164b64c29505b88083a8
HawkEye
5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb
HawkEye
7c0f66eed3a2fc7c90ab5db03483aada693894a77a1480e22521ccf422a08ba3
HawkEye
95dce20d910cf373ff2b72697282c344313dd3bf7ffd09c4ece59cd9f58c8972
HawkEye
bbf613ce1f6850b2b62c6f55082ab7b9bcc7f92db0a8ec8f0b495e29cb4988ae
HawkEye
beaee29c11566ce99ec0fb9ddbb2e1df84530ea5b6f88cb099f63bbb0da5c7b8
HawkEye
cb8d412bcde5007a389cfbf650e356fc4aca9c56499594af40306234e85c52db
HawkEye
e842dbdc4b41d7516d87ccc21fa365b93c4c94ce5a75dc6f06321f90efa19e29
HawkEye
+ 6'614 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HawkEye

Executable exe c84d0a9a9ee6556b5bb064012e81e18dd510127e531b00f995b0ace01165d15d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/318907/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments