MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1738801ebd6a53c6f1becf35978e07b6a5d31dd839fbe1cbf17899a6bcbf00e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1738801ebd6a53c6f1becf35978e07b6a5d31dd839fbe1cbf17899a6bcbf00e0
SHA3-384 hash: 643391d527158c18fba08b13452b8da05e8ed54159042e51eeb0f263a2b224efcb6dcd1c1e06926e2e1b1483fc029db6
SHA1 hash: 01bd882aa80e7dd46e2ec1d7491ea40a5ad3ed36
MD5 hash: eeddec52271d7d12ba8dd2cc340f31fa
humanhash: whiskey-butter-hawaii-golf
File name:PAYMENT_SLIP.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:458'254 bytes
First seen:2020-07-20 08:54:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:cCZay1wmZf7MvabIdE3oQzNXZScD7kVALabU3BqrAWM21d3uSk/l/LZkDKhLZ14:cwjzLUe3oQxpQkKU3rS3bkV1IKhZa
TLSH 28A42326B39F9F152E4013154852DF942C91EAEBC5EDED3E48A81E78A9643EE00D733C
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: 53-7-static.mxserver.ro
Sending IP: 46.102.249.75
From: Wells Fargo Bank <Payment@wellsfargo.com>
Reply-To: s.peters.edur@bk.ru
Subject: payment
Attachment: PAYMENT_SLIP.zip (contains "PAYMENT_SLIP.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1738801ebd6a53c6f1becf35978e07b6a5d31dd839fbe1cbf17899a6bcbf00e0/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:56:10 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c44iahv5njj4n4n6z42zpdqhw2s5ghoyhh56ds7rpcm2npf7adqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1738801ebd6a53c6f1becf35978e07b6a5d31dd839fbe1cbf17899a6bcbf00e0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 1738801ebd6a53c6f1becf35978e07b6a5d31dd839fbe1cbf17899a6bcbf00e0

(this sample)

HawkEye

Executable exe 40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745

  
Dropping
MD5 cbff403de61e81792b6a6985d113f588
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 40bdc01698c806663cb359cb632f36320837884062ddb6c440c8d11580bbc745

Comments