MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0237ae8c63b4a1a61583984fa5091f3f7e095454a86187551de27aa9c8877b89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0237ae8c63b4a1a61583984fa5091f3f7e095454a86187551de27aa9c8877b89
SHA3-384 hash: 6b59ad478aaeca65bfd557f8ecc250b9c9509160f0d38d683c4fde28125043ac543d82cb14140f790c66a76437587b21
SHA1 hash: e2acfbf75d3ee55bea17ffbfbd69f7cb90869903
MD5 hash: 8c85fabe0eaabdeff8ce011bbcb9cc0f
humanhash: sink-sodium-juliet-monkey
File name:NKF20205 LIST.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:470'836 bytes
First seen:2020-08-03 13:11:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:bzplFH5HZKhH7zQvh4VMgrgr0k6qYhaJpi+Wzz0labfNn//yHTRYRQGjlKRR5QtK:bzpl7Hkhwgs/tTJgLqgHyzuHLrlhaGW
TLSH C6A42378E513CC0B7CC48136FCA5F4A9523BBB44B422EC55A15B9A11C0EB5AF87F4E68
Reporter abuse_ch
Tags:GoDaddy HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: p3plwbeout05-06.prod.phx3.secureserver.net
Sending IP: 97.74.135.51
From: Jamie Somasundar <lnlbeachy@agoodwave.com>
Subject: Technical & Your Financial offer]
Attachment: NKF20205 LIST.zip (contains "NKF20205 LIST.exe")

HawkEye SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0237ae8c63b4a1a61583984fa5091f3f7e095454a86187551de27aa9c8877b89/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:13:04 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ai325dddwsq2mfmdtbh2kci7h57asvcuvbqyovi54j5ktsehpoeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0237ae8c63b4a1a61583984fa5091f3f7e095454a86187551de27aa9c8877b89

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 0237ae8c63b4a1a61583984fa5091f3f7e095454a86187551de27aa9c8877b89

(this sample)

HawkEye

Executable exe 8fcf4d1528f2945b751c3d9035e17f7143fdbc94ef687f5c9e4e35d892c5922b

  
Dropping
MD5 2309696d1d8614a83a0dc72b8bfbab6b
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8fcf4d1528f2945b751c3d9035e17f7143fdbc94ef687f5c9e4e35d892c5922b

Comments