MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ef6094514b3aeb5b99aa24f1ac9297004fbd7fc509171e3e501e5effad6ecfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 7


Intelligence 7 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ef6094514b3aeb5b99aa24f1ac9297004fbd7fc509171e3e501e5effad6ecfe
SHA3-384 hash: 5008fde1f1b200122dd3e429d32d82eee6db61ae72d3cf800f879bc0a95b64a0789dfeca2aa1f50ff3cb1cf83426be0f
SHA1 hash: 106189c9510408de134f593907893ed87e814dad
MD5 hash: 074fb0d538aa8602edda6ab2ef33950c
humanhash: blue-fillet-may-spaghetti
File name:pictures of me and factory haw on.bin
Download: download sample
Signature HawkEye
Create hunting rule
File size:2'752'000 bytes
First seen:2020-11-09 10:22:48 UTC
Last seen:2020-11-15 22:58:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'604 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 1536:1Y0KwMSrzENfPDWLlhUGY3xFmskCFa4gfRwvArS4ocYjQt96hOh5h4EvfB5gLJ+A:u0H3
Threatray 455 similar samples on MalwareBazaar
TLSH B0D506E071C65F7AC7CA424F30590E3D1EE17DE9A792BB88C6F257F7A912B910B24805
Reporter JAMESWT_WT
Tags:HawkEye landzro365groupe.com

Intelligence

File Origin
# of uploads :
5
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.vz.30640.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a file
Creating a file in the %AppData% directory
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Setting a keyboard event handler
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Enabling autorun by creating a file
Enabling autorun
Enabling a "Do not show hidden files" option
Unauthorized injection to a system process
Result
Threat name:
HawkEye MailPassView
Create hunting rule
Detection:
malicious
Classification:
phis.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/526180
Signature
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to hide a thread from the debugger
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Detected HawkEye Rat
Drops PE files to the startup folder
Found malware configuration
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected HawkEye Keylogger
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 312175 Sample: pictures of me and factory ... Startdate: 09/11/2020 Architecture: WINDOWS Score: 100 52 cdn.onenote.net 2->52 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for dropped file 2->66 68 12 other signatures 2->68 8 pictures of me and factory haw on.exe 2->8         started        12 pictures of me and factory haw on.exe 2->12         started        14 pictures of me and factory haw on.exe 2->14         started        16 3 other processes 2->16 signatures3 process4 file5 46 C:\...\pictures of me and factory haw on.exe, PE32 8->46 dropped 48 pictures of me and...exe:Zone.Identifier, ASCII 8->48 dropped 84 Creates an undocumented autostart registry key 8->84 86 Hides threads from debuggers 8->86 88 Injects a PE file into a foreign processes 8->88 18 pictures of me and factory haw on.exe 8->18         started        22 WerFault.exe 8->22         started        90 Creates autostart registry keys with suspicious names 12->90 92 Creates multiple autostart registry keys 12->92 24 pictures of me and factory haw on.exe 14->24         started        27 pictures of me and factory haw on.exe 14->27         started        29 pictures of me and factory haw on.exe 14->29         started        31 WerFault.exe 14->31         started        33 pictures of me and factory haw on.exe 16->33         started        35 pictures of me and factory haw on.exe 16->35         started        37 4 other processes 16->37 signatures6 process7 dnsIp8 54 101.37.7.0.in-addr.arpa 18->54 56 smtp.privateemail.com 199.193.7.228, 49742, 587 NAMECHEAP-NETUS United States 18->56 58 192.168.2.1 unknown unknown 18->58 70 Changes the view of files in windows explorer (hidden files and folders) 18->70 72 Writes to foreign memory regions 18->72 74 Sample uses process hollowing technique 18->74 76 2 other signatures 18->76 39 vbc.exe 18->39         started        42 vbc.exe 18->42         started        44 WerFault.exe 18->44         started        60 127.0.0.1 unknown unknown 24->60 50 pictures of me and...tory haw on.exe.log, ASCII 24->50 dropped file9 signatures10 process11 signatures12 78 Tries to steal Instant Messenger accounts or passwords 39->78 80 Tries to steal Mail credentials (via file access) 39->80 82 Tries to harvest and steal browser information (history, passwords, etc) 42->82
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ef6094514b3aeb5b99aa24f1ac9297004fbd7fc509171e3e501e5effad6ecfe/
Threat name:
ByteCode-MSIL.Trojan.Scarsi
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 10:24:09 UTC
File Type:
PE (.Net Exe)
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d33asriuwoxllom2ujhrvsjjoacpxv74kcixdy7fahs676ww5t7a._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
3634bc353643a382dc730729771f212f69c8f3fa489bd4ff843a3985076fdc46
HawkEye
5b56965b3b01283c8ac5277021645a8c85c366e39c200d8bcb6869750dfc3100
HawkEye
67f6187ea8c5c35a68d12ea1a66d60e173dad5e4d54983254aece59929d405d1
HawkEye
69a34116377032442c113adb0490c641f4af86b04fb8a2027f094d3678674915
HawkEye
89960c6e0b1d193051322647448e48fe0c4a42fc103d2b19256c0e335da71189
HawkEye
9ab98e8d67aa054c7d860cb54100954bfc5429cce7b4fb9bb1d69ddc3f43d2ce
HawkEye
a837374ed66cc50cb5760f0f948db288657fd0891687f43df9b9260dfb71449c
HawkEye
ba4b2f524b82bec30f74540c124034b082a275b83a94c20ccede668f83f05a0f
HawkEye
d5886c42f7b8f77d036091616f0314f37e2db5c117aaa769ede368027fe7d43a
HawkEye
f1a630f7b8387dc08f1c516b7e79c2d7099fcc47ab529902807d471e683a909b
HawkEye
+ 445 additional samples on MalwareBazaar
Result
Malware family:
hawkeye
Create hunting rule
Score:
  10/10
Tags:
family:hawkeye keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-kt6fqe1322/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Reads user/profile data of web browsers
Uses the VBS compiler for execution
HawkEye
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Hawkeye
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect HawkEye in memory
Reference:internal research
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:RAT_HawkEye
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects HawkEye RAT
Reference:http://malwareconfig.com/stats/HawkEye
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory
Rule name:win_hawkeye_keylogger_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_hawkeye_keylogger_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments