MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0846f6019d7fe774dc75d2f35a88769fdd49f99fad217283287f24c1bb54c45e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0846f6019d7fe774dc75d2f35a88769fdd49f99fad217283287f24c1bb54c45e
SHA3-384 hash: ec1cfdbc10411d4e436fd40c7b823f37d05a6716028014c97dc8c4c62e3ae3a17fadcb7fe2fe0ceb7c1e19b65a418696
SHA1 hash: 61b3dc786bc37752a09279b6e1806099c0924179
MD5 hash: de9bb21c18602d65e28f3c716301fd33
humanhash: six-princess-mobile-sink
File name:lIXDHbCcrwGvgZd.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:737'280 bytes
First seen:2020-05-23 12:19:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Ymkbep+fUxAe8m2FrFU7NWuyHh20SgiKFWy4qIw++7Igzqm6cd/7mnpyJ3qo5TnL:Ym8CUHFJ+NFmdfW34fduOd/74oFqohfD
Threatray 2'251 similar samples on MalwareBazaar
TLSH 6BF4014572A8581BC6ED40F8619EF28443F245BF1692FBE5DC8231FB36C3BDA4612993
Reporter JoulK
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 23:27:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
18b880e3b13ed9f47ecbb88ffe91ad90f54e8f98fc2813d4d85ec11fe64f6811
HawkEye
2b595bebceff46c9b833e8780fce9bcbc7aace47dfffbb89fca8e42606b5e281
HawkEye
2e2ac9d4b75c33626c14197dc15c3e92552952cb32c69014bb1b7424e37a758b
HawkEye
56b02707b5f12fd4e8f79fdd9dd9f7eb82394798317a76e499c7d0d659b2d759
HawkEye
5e19889ca24913c6ae660e416467cd2f90f15806d2b1492993874e3d17ebd101
HawkEye
bf15b6d8ed1637598fd2d08ae5f619a4c08c6b03372fddfa8f68f6380e735083
HawkEye
d12d7f07071e59df09d70cae377fc3e41b35a098d5096f7437ce17b59f74fd64
HawkEye
e140db160590e9d59bcba114a517f2478eac1f730f639487029f2df1bc8d8cc6
HawkEye
e83be3e4db904d9f9896cd039170dc3fba0f316b6be60affea209aae96da71b8
HawkEye
ffb4e1b5e6ac64c969e3f90351eb0d401146f266b6678dfbff611faaf15a311f
HawkEye
+ 2'241 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:hawkeye_reborn family:m00nd3v_logger keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-7ttz4cj7p2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
M00nD3v Logger Payload
HawkEye Reborn
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MAL_HawkEye_Keylogger_Gen_Dec18
Create hunting rule
Author:Florian Roth
Description:Detects HawkEye Keylogger Reborn
Reference:https://twitter.com/James_inthe_box/status/1072116224652324870

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HawkEye

Executable exe 0846f6019d7fe774dc75d2f35a88769fdd49f99fad217283287f24c1bb54c45e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366580/
  
Delivery method
Distributed via web download

Comments