MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 012a8b58a7e5e04737ee8c5c004e1272b98e0dcf8bcb025f1573e63de8b2f7e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 012a8b58a7e5e04737ee8c5c004e1272b98e0dcf8bcb025f1573e63de8b2f7e9
SHA3-384 hash: 3dea936f8d6061232f5cb005e83892d07482a1087a0ada57a8d7e8dd5618e2c5682add9ddbeeeb207bd80a5359652580
SHA1 hash: 90cbd2797859f8fd876efa184fc8000b0a5ed9fb
MD5 hash: 8a1746253e70690b289f2d6f984f057b
humanhash: butter-coffee-uranus-wolfram
File name:Hesap Hareketleri 20200616 PDF.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:832'000 bytes
First seen:2020-06-22 07:51:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b7b5ab2d2e3c38731ec072a73a113374 (11 x AgentTesla, 4 x NanoCore, 3 x HawkEye)
ssdeep 12288:Br5NlaFRMb7GKWWUxDz/xTT8Hc0jcDxRQpy1Ibh90VaPf:VL+Mb7hUhZqc0jcDLK/0g3
Threatray 352 similar samples on MalwareBazaar
TLSH D105BF22EDA04437C122157F5C1BB67898EABDD1292817467BE5FC48AF39342B7271B3
Reporter abuse_ch
Tags:exe HawkEye


Avatar
abuse_ch
HawkEye SMTP exfil server:
host25.safaricombusiness.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection:
HawkEye
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12479/
Detection(s):
Win.Malware.AgentTesla-8066370-1
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.21567.31408.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/012a8b58a7e5e04737ee8c5c004e1272b98e0dcf8bcb025f1573e63de8b2f7e9/
Threat name:
Win32.Trojan.CryptInjector
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 07:53:05 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aeviwwfh4xqeon7orroaatqsok4y4doprpfqexyvoptd32fs67uq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
005f14d06c16be03e043dd8a6e92eadac72688491f960e0219de292eaefdfd22
HawkEye
0d6437a1e212ba6c8b651098ae5863a45b1e81d201d3722bd52e0c6559898db8
HawkEye
2e6d01252c1c1469683b9412b4f2eefcd05bd8b433c8811b72ea0ab717cd1615
HawkEye
5680e271889058770b8e1e0511477865407735b5bbe46766599c6d0c88f74a43
HawkEye
77728dc00d957e7c3a175b58f539ed1ce895595832f3ff527aac52a10b185565
HawkEye
7e6dc9928e049d75cd726d8542b39cf46afef0cfd37c8dcb968ea618aedbb696
HawkEye
86ce3571c645ccec7f6831b75cb4a00b65213d1b3bc4d4c2c8b3e5f197bd0232
HawkEye
8f4dce7ad41fd654a99038ce4b52b7b276795fd56a6c376eb58e40e4600ebe52
HawkEye
9d52b33e1184f121f9b086b0296e5e1bf8d224bd9887780d86b01f43da7c85eb
HawkEye
a46a4d49d8497c6cf8560c708fc6cf68c6901f2762938caa3be46b47a62d3ea6
HawkEye
+ 342 additional samples on MalwareBazaar
Result
Malware family:
hawkeye
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:hawkeye persistence evasion
Link:
https://tria.ge/reports/200624-3d628319pa/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Looks up external IP address via web service
Adds Run entry to start application
Modifies system certificate store
Drops startup file
Uses the VBS compiler for execution
Reads user/profile data of web browsers
UPX packed file
HawkEye
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hawkeye
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect HawkEye in memory
Reference:internal research
Rule name:RAT_HawkEye
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects HawkEye RAT
Reference:http://malwareconfig.com/stats/HawkEye
Rule name:win_hawkeye_keylogger_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

Executable exe 012a8b58a7e5e04737ee8c5c004e1272b98e0dcf8bcb025f1573e63de8b2f7e9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12479/

Comments