MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 200c2c1ad502a7c015d39f513cce255f0eeaaecd1befea68d7cc0d2ba673d524. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 200c2c1ad502a7c015d39f513cce255f0eeaaecd1befea68d7cc0d2ba673d524
SHA3-384 hash: 6440f8d1961866cadfe04fcbd3d12f4720d3fe4bfc8f9636f047482fcd6e8d9d0c8c046b7cdc96a5afb6980e82fd9d96
SHA1 hash: ee6df23a1421899b5451ae3fe24e8ff1de8a5b65
MD5 hash: 32b98782e6c8f83729913bf7eabb4c7b
humanhash: oxygen-magnesium-washington-bluebird
File name:Payment_PO.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:464'988 bytes
First seen:2020-07-02 06:33:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Wk86M8Th4L0AvOK+UX+WUs+n+P2k/NvL4PpSxKq6f:W/6M8FiHvFHXjo+P2k/9lKz
TLSH BBA423546CE7ECBAB6C9418489EC74F27C56DADFF077009394F9B753E982138182136A
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: dd36610.kasserver.com
Sending IP: 85.13.153.98
From: Deutsche Bank <payment@db.com>
Reply-To: mark@zoomwebmedia.com
Subject: Re: PAYMENT.
Attachment: Payment_PO.zip (contains "Payment_PO.exe")

HawkEye SMTP exfil server:
server165.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/200c2c1ad502a7c015d39f513cce255f0eeaaecd1befea68d7cc0d2ba673d524/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:35:09 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eagcygwvakt4afott5itztrfl4hovlwndpx6u2gxzqgsxjtt2usa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 200c2c1ad502a7c015d39f513cce255f0eeaaecd1befea68d7cc0d2ba673d524

(this sample)

HawkEye

Executable exe 17f48452ba71f7bbf410015c1eb67099aefb5da9ee9e61aea0ae323ca339bc1a

  
Dropping
MD5 44a449e8130ba1528b8c87c8c57f1a6e
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 17f48452ba71f7bbf410015c1eb67099aefb5da9ee9e61aea0ae323ca339bc1a

Comments