MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef21624aed491ceef74b4552d9e8c069a4e7ea140b176a4da64652fb51a1120c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef21624aed491ceef74b4552d9e8c069a4e7ea140b176a4da64652fb51a1120c
SHA3-384 hash: e34739845ecb55e365ce6e41ed4ba4a180fa4a190137d9e0d3d21477e0aa11c38f882816c8f8b43d088f68e6a7dad9fe
SHA1 hash: b5823a5918863e180bdb8ad081897dd04bd4e485
MD5 hash: 2921caa3f988185ea7e2b5b296615278
humanhash: pizza-diet-massachusetts-oregon
File name:order no. #7962011665 20200504 ,xlsx.rar
Download: download sample
Signature HawkEye
Create hunting rule
File size:324'397 bytes
First seen:2020-05-04 09:40:46 UTC
Last seen:2020-05-04 12:40:21 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:572jcpBi3JTAuyiCIjtxxg+Wa0BH0wajITcDFlyFz5EFK2:M7khIi+WHRa6cWGK2
TLSH 3F6423A986E11B80830029FB4A6F8A56B79C16B82B7397B143DF7F5574C70E06C8F14E
Reporter cocaman
Tags:HawkEye rar


Avatar
cocaman
Malicious email
From: "Charlotte" <sales@hondvomold.com>
Received: from hondvomold.com (unknown [103.133.111.162])
Date: 4 May 2020 02:38:08 -0700
Subject: PURCHASE ORDER 7962011665/20200503/4117
Attachment: order no. #7962011665 20200504 ,xlsx.rar

Intelligence

File Origin
# of uploads :
3
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 10:35:22 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54qwesxnjeoo552livjnt2gangsop2qubmlwutngizjpwunbciga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

rar ef21624aed491ceef74b4552d9e8c069a4e7ea140b176a4da64652fb51a1120c

(this sample)

HawkEye

Executable exe 1660cbe9bd7e85ed0a2ad4ca9f793e0ef8b5f889946844e2184b1a8d2fd89ba8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1660cbe9bd7e85ed0a2ad4ca9f793e0ef8b5f889946844e2184b1a8d2fd89ba8
  
Dropping
HawkEye

Comments