MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 240a926af43b47b1888f789cff11ac3f2fb7e29d471723d416865492bd499ced. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 240a926af43b47b1888f789cff11ac3f2fb7e29d471723d416865492bd499ced
SHA3-384 hash: ae24ba6afb3404de5320c2e14c78d9513072bad3c59efe325b6312454901b4041dc2ab41925b8389d5b01b535be5b773
SHA1 hash: 4866dcc56355b926c86a503e590a45b07def4603
MD5 hash: ba7bc777742560070833b647b2391740
humanhash: violet-north-equal-stairway
File name:Prueba de pago.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:718'577 bytes
First seen:2020-11-09 19:30:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:nTa60uOPDldkeSYSpZ11pqq+JyYIvfWopOB2wFeBCUND290En46sQbjQTcUZDJoO:nEfdkeG1bqL6fWopOB2w1UND23n4ab0r
TLSH F0E42340B647D6ED44D5AB34F6B2F9B04157E1108F3F8A8D8A9CF8899EA37192C39347
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: imscp.swebians.com
Sending IP: 144.76.175.181
From: Carles Llorens <support@rieth-kg.de>
Reply-To: dh_derhawk@126.com
Subject: justificante de la transferencia
Attachment: Prueba de pago.zip (contains "Prueba de pago.exe")

HawkEye SMTP exfil server:
smtp.casalsmd.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.334505.17226.20270.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/240a926af43b47b1888f789cff11ac3f2fb7e29d471723d416865492bd499ced/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 15:30:17 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eqfje2xuhnd3dceppcop6enmh4x3pyu5i4lshvawqzkjfpkjttwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/240a926af43b47b1888f789cff11ac3f2fb7e29d471723d416865492bd499ced

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 240a926af43b47b1888f789cff11ac3f2fb7e29d471723d416865492bd499ced

(this sample)

HawkEye

Executable exe 9fcc8cbe6ed3a2a12ba1c1ebf6fab95099fb6cd7c2822cad3423d80d0fc38c03

  
Dropping
MD5 e662c90579b66184755aad154440abbf
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9fcc8cbe6ed3a2a12ba1c1ebf6fab95099fb6cd7c2822cad3423d80d0fc38c03

Comments