MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1073e674e5df0abebed633491f18c4bf7765a46f19d1be22923e810c374f9807. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1073e674e5df0abebed633491f18c4bf7765a46f19d1be22923e810c374f9807
SHA3-384 hash: df69ad89716828b8815487e69c5f1e06cf1cfd175a94779c550f8eb435dcea20da0d1b128f738ea0f07fefdbba8c7a28
SHA1 hash: 1bf52a4dcdde06606adc9ffca398ad762ba0a639
MD5 hash: fdea6399648463891662a08458d7c3e0
humanhash: magazine-jupiter-mississippi-single
File name:Request pl.iso
Download: download sample
Signature HawkEye
Create hunting rule
File size:577'536 bytes
First seen:2020-06-20 07:47:19 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:qbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9XHu:qQtqB5urTIoYWBQk1E+VF9mOx9+
TLSH 7BC4AE03B3E14436D4FF0630157797329ABABA701635CA4B97DC188A6FB6291EE36347
Reporter abuse_ch
Tags:HawkEye iso


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: kbtradings.com
Sending IP: 103.147.184.73
From: sales@kbtradings.com
Subject: RE: New PI Request
Attachment: Request pl.iso (contains "Request pl.exe")

HawkEye SMTP exfil server:
dal-shared-56.hostwindsdns.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Passwordstealera-6765350-0
Create hunting rule

Win.Virus.Sality-6832669-0
Create hunting rule

Win.Packed.Pswtool-6840731-0
Create hunting rule

Win.Trojan.Agent-1376651
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Golroted
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 07:04:37 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbz6m5hf34fl5pwwgner6ggex53wljdpdhi34iush2aqyn2ptadq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

iso 1073e674e5df0abebed633491f18c4bf7765a46f19d1be22923e810c374f9807

(this sample)

HawkEye

Executable exe f644429ae879d41b7edfc6eed05d575b0b616c70327955e32d15875dcc3d5c49

  
Dropping
MD5 50f02724daf9a947077fc3b57e842018
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f644429ae879d41b7edfc6eed05d575b0b616c70327955e32d15875dcc3d5c49

Comments