MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 089286ffcd2e619bec5d6822b387ccddac4121ad13fe44c4fb8c740eb6e19ee1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 089286ffcd2e619bec5d6822b387ccddac4121ad13fe44c4fb8c740eb6e19ee1
SHA3-384 hash: 51a078b30da6efc36a1fd162a0b8d7b3bc6fc7e04c0f90a71f483e639ef69b566a0596cb5b056144acbcf175267393a1
SHA1 hash: eda014104d9b9ef227df2e739289870dca29e146
MD5 hash: 25b773a2149ae211d3d7cd559fdb7f2e
humanhash: wyoming-thirteen-aspen-charlie
File name:NewOrder160620209988.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:585'350 bytes
First seen:2020-06-16 14:05:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BvdeJzgDbs0HBiG6Go+k6FwyTDI/BSKX1:BFIuA0HBV6GpFvI/PX1
TLSH 8BC42365D3CDBF23A695318ACA94C568F2E5174F790B8B0C4D47F7B062DB87B44C24A8
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: shmx.tama5cci.or.jp
Sending IP: 60.32.68.163
From: Purchasing Manager <info@tama5cci.or.jp>
Reply-To: dh_derhawk@126.com
Subject: Re:ORDER-04350316//4183000102292563
Attachment: NewOrder160620209988.zip (contains "NewOrder160620209988.exe")

HawkEye SMTP exfil server:
smtp.urban.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.21567.31408.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21381.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 14:07:07 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bcjin76nfzqzx3c5narlhb6m3wwecinncp7ejrh3rr2a5nxbt3qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 089286ffcd2e619bec5d6822b387ccddac4121ad13fe44c4fb8c740eb6e19ee1

(this sample)

HawkEye

Executable exe 5680e271889058770b8e1e0511477865407735b5bbe46766599c6d0c88f74a43

  
Dropping
MD5 773ed1d737209e588bd14991930dd95d
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5680e271889058770b8e1e0511477865407735b5bbe46766599c6d0c88f74a43

Comments