MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ab729bd110b9e02da700da750167459a6e33088e463a80f9274777b3460f825. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ab729bd110b9e02da700da750167459a6e33088e463a80f9274777b3460f825
SHA3-384 hash: 3443abec876de064cafd45a63573432a25c97e37ae00d7ed02bbc2aac0ded0745918f4d8d591cda7d17fd63f7000d2c4
SHA1 hash: 652c845e356a94db563ed771424ee9f6f437a514
MD5 hash: 836ab83cdfbaa5220334f04651134d9b
humanhash: mobile-johnny-texas-india
File name:K409476485-03032021000.pdf.z
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'155'567 bytes
First seen:2021-03-03 07:38:25 UTC
Last seen:Never
File type: z
MIME type:application/gzip
ssdeep 24576:0BlGOzbdrf/qEXqyoRM7qGNUkIOllLEJFEPhS0itLr5ve:EMOfx/XqpuqgUkDLEJFEU2
TLSH 113533053B7DC3869815939671404E4B14FE08AEA2A0B534FA1F23F0366F235DED677A
Reporter abuse_ch
Tags:HawkEye z


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: kasourcing.com
Sending IP: 104.168.167.195
From: Lifung sourcing<OliverYiu@kasourcing.com>
Subject: RE: SU21 Lifung sourcing for Dress S0118976 - leaf Comment
Attachment: K409476485-03032021000.pdf.z (contains "K409476485-03032021000.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27281.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ab729bd110b9e02da700da750167459a6e33088e463a80f9274777b3460f825/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:39:31 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fk3stpirbopafwtqbwtvaftulgtogmei4rr2qd4sor3xwnda7asq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/2ab729bd110b9e02da700da750167459a6e33088e463a80f9274777b3460f825

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

z 2ab729bd110b9e02da700da750167459a6e33088e463a80f9274777b3460f825

(this sample)

HawkEye

Executable exe 93aacab7e09044795808ad1a0256c015271653ab0fe9d62785800c0f19ef1ad8

  
Dropping
MD5 88ff54784a623dcd43bb8c22491a5398
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 93aacab7e09044795808ad1a0256c015271653ab0fe9d62785800c0f19ef1ad8

Comments