MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3e23a1867df6b2aebe2c2147de72833f24eebb7ad203bd5ab404a3e65e75c83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3e23a1867df6b2aebe2c2147de72833f24eebb7ad203bd5ab404a3e65e75c83
SHA3-384 hash: cf2f99a941903ef60d3a97a57ff084933a3ba18a7773d172e28aed5b446d4c0b6fe047103db4e9b2b04abd735fef8f58
SHA1 hash: 6ac57d4bca3a0bf8495607d1e18958b8d1b86383
MD5 hash: 17776b2bd3a1f2fbe340e2a90029d7c6
humanhash: ten-hot-march-seven
File name:e3e23a1867df6b2aebe2c2147de72833f24eebb7ad203bd5ab404a3e65e75c83
Download: download sample
Signature HawkEye
Create hunting rule
File size:952'320 bytes
First seen:2020-03-23 16:24:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 46116a2f8090728368dbf9ef96584273 (1 x AgentTesla, 1 x HawkEye)
ssdeep 24576:zmQFzDFCRUg2VxU3QKEeXRQhLEZtDFfRFntMKCsCq:BJdzUvbhqEZvfn1
Threatray 3'022 similar samples on MalwareBazaar
TLSH C415D026E2A14833C163167C8C0B539CA51BFE512D2899776FE8DC4C9F3D681753A2BB
Reporter Marco_Ramilli
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Tspy-7001517-0
Create hunting rule

Win.Malware.Tspy-7001893-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.23680.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Hpfareit
Create hunting rule
Status:
Malicious
First seen:
2019-06-26 03:18:55 UTC
AV detection:
43 of 47 (91.49%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
005149b4a8d817af2e11f4aa505878fcb9e7ea38ce96364734ebdc6109fb544b
HawkEye
05b449bf4042b771a25d8d1b850e942325516196b73aba7a70e99f80b996ab2c
HawkEye
0927a3a49404b9de1a120157dc89f931ac98f765a0a452d2c71a7d8daf7a42ff
HawkEye
18a40f97d649fd2106faeddba94fc124beff44f69b713dbf4b88614f151b6f25
HawkEye
1c8e7015a2423c7a1ca5e7c5cdbb0b7eaf175e2b5983269281bfe9d1c8ee9985
HawkEye
3b2850cd8a54bfdb4c52c45f541c4d97047a28b19d034bbec609389b19019094
HawkEye
c49423c0fce4c71e3bef5bc92441e9510c7f46d54207446df6496128f9780924
HawkEye
c9880b54eff052551b910427ebe39f02e2af781c99336b9f5bbb1a9ba41e0e19
HawkEye
e30457394a1155cb80d2c51170f98be3c246f716010d8ee7441a4971c2b8103d
HawkEye
ef55158b4fe6a2d1094c1978f3c27fab2b0fed72b2f1f15e8a574c79a067ec74
HawkEye
+ 3'012 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HawkEye

Executable exe e3e23a1867df6b2aebe2c2147de72833f24eebb7ad203bd5ab404a3e65e75c83

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/211902/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowA
user32.dll::OpenClipboard
user32.dll::PeekMessageA

Comments