MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efbca40ddc7442c3e794ec5fb4f1968e9d1b432f4a37ba8da7831ec89f03da56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efbca40ddc7442c3e794ec5fb4f1968e9d1b432f4a37ba8da7831ec89f03da56
SHA3-384 hash: 3c52d824bed504278b5d5319aa76321ad4b3a0cc8161f3e3902747c34e04dd53ea8fc9f7fa28dcbded2c0e1ebc70b9c8
SHA1 hash: 04883188da9ce49c38ead1dd3d976e70b76329a1
MD5 hash: c79f4eaefa4ec8156ae91d0c738334a7
humanhash: stairway-nitrogen-nuts-twelve
File name:Catalogue-Order-202105.rar
Download: download sample
Signature HawkEye
Create hunting rule
File size:773'751 bytes
First seen:2020-05-21 08:09:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:eN6OcOplLPZVPfysCKdlZPfrMceNA7QV6Z4Q6wf7E48HABb6wCvXzN1JYLLAwqCR:eN1pPVlysndP3rNcwAGEAcLXx1JYLLAK
TLSH 62F4333786EB63218DF694D3C9C1C10EC4774A1C3FC9C2D9A679C70A15CEB92A56DEA0
Reporter abuse_ch
Tags:HawkEye rar


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: mail.itfusion.ro
Sending IP: 193.33.24.2
From: Rohan Virmani <ron@eurostarinc.com>
Subject: Catalogue Order Ready
Attachment: Catalogue-Order-202105.rar (contains "Catalogue-Order-202105.exe")

HawkEye FTP exfil server:
ftp.anuarul-sanatatii.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 08:36:38 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=566kido4orbmhz4u5rp3j4mwr2orwqzpji33vdnhqmpmrhyd3jla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

rar efbca40ddc7442c3e794ec5fb4f1968e9d1b432f4a37ba8da7831ec89f03da56

(this sample)

HawkEye

Executable exe 5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb

  
Dropping
MD5 569522488836413ac64590314af81450
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5df1a3e64559a1056fd1cac70e1b6bbf236eca17c1c3a5e59f1c329710b42dbb

Comments