MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0776457840077a9b6ac113b23ebf60c224c3c7b4807c6698fdfe764531d285be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0776457840077a9b6ac113b23ebf60c224c3c7b4807c6698fdfe764531d285be
SHA3-384 hash: 98ec54e9193a6159a099d9789d565a682ca4ef0eb44d99770ad84723da55ed25906ea1c025dc9c4adb3fa63d5704906b
SHA1 hash: 87d3a9bdbbf7ef6c0bdd7a81682c7316dfa0d7c8
MD5 hash: e07de03d1978041647c10e75b7eb7389
humanhash: vegan-cold-music-uranus
File name:file-10101231_pdf.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:522'276 bytes
First seen:2020-06-05 07:59:41 UTC
Last seen:2020-06-05 13:20:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a0f2ef0c3f2e6d478baacafaefbb4c2b (6 x AgentTesla, 5 x Loki, 2 x HawkEye)
ssdeep 12288:iu3EjrY6vfxKKlxl+amOCaOGJxB7g466vWZ+45b:Z0jUEfx3+D8l6yWEcb
Threatray 2'292 similar samples on MalwareBazaar
TLSH A2B46D21F2A0543FC132167D5D1F5FFBA82ABA11F95815466BE7DCC8AE392C1392B183
Reporter jarumlus
Tags:HawkEye

Intelligence

File Origin
# of uploads :
3
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 07:55:35 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a53ek6caa55jw2wbcozd5p3ayismhr5uqb6gngh57z3ekmosqw7a._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
3dc7611aaf0cee733ba2520adfd2087ee276ee8fdeeb6423cd99865eee458f8a
HawkEye
56fed2fa0de0cadceed9d9cbe72af5b30f979ae3617e7042b6a42895dc559a22
HawkEye
6480d0d4232a23159e754ab88769b21a48e8bc4a86fa84b99c2160b2bfb09244
HawkEye
6c23d5aac98c05cf9faca072f1875f7fcde253a4a782dda7d897681bda6f92d9
HawkEye
9dce7953b8cdd196fc4b75c14e9e5889ef01229cd680f8f9b1f02ae2c11768f4
HawkEye
acea43435c7dedb7b910e538aa72997d038b8b45112b58ae219c056ddda851af
HawkEye
b44ef73bf2306886ca92291cbbdc5b0d07d6878f9a1b3c84ce476ca69cc4532e
HawkEye
d7b266bb9eacabd128560d80eea9195b42b227df16d460f1c0e13ed6575ca627
HawkEye
e24a3fe957675ab9e6815582079bf483dd6f0b75e744b51d6f71d4fdcb301da0
HawkEye
e583af99eacb5d6801001cc6c8b052e3267cda7111832ffded94fa68ebe2d9e6
HawkEye
+ 2'282 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware upx
Link:
https://tria.ge/reports/201109-tale2dbt16/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip c883620f8d94cb4df37dcd345fdbe54e3bc08ab5e8fdae48be1eb74c74401365

HawkEye

Executable exe 0776457840077a9b6ac113b23ebf60c224c3c7b4807c6698fdfe764531d285be

(this sample)

  
Dropped by
MD5 7a24fee4eb1887ab4ebc055f066b8ac9
  
Dropped by
SHA256 c883620f8d94cb4df37dcd345fdbe54e3bc08ab5e8fdae48be1eb74c74401365
  
Delivery method
Distributed via e-mail attachment

Comments