MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ea073ddc357d19912eeb45d967fd80c742a676cf9f00ad8d7ade93be5e4b101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ea073ddc357d19912eeb45d967fd80c742a676cf9f00ad8d7ade93be5e4b101
SHA3-384 hash: a90671139f30bc1ed09730bf5754576ea333c7aae805e85832839657b545e0f7d01db4282585ac004476dd2c6dbe56ac
SHA1 hash: 4d6f29a4f6a496394156ed800b4dfd6cd952d4f0
MD5 hash: 472d076a50474e002f4bd798eac94876
humanhash: yankee-cola-missouri-bluebird
File name:PO_Invoices_pdf.z
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'300'240 bytes
First seen:2021-02-02 07:46:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:z9mm9W50G+UvOKDMdh4DEW+jXqnSy5N16l6GOHRUVTR63:zB9lG2KDMdh4D8pAFFyVtc
TLSH D85533ED91157EC33798304D829ED554E8CECCB4E267A722E6D08CD3E72EA290C5879D
Reporter abuse_ch
Tags:HawkEye Yahoo z


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: sonic308-3.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.130.42
From: Farzaneh Pirani <pirani.fazaneh@yahoo.com>
Subject: Re: 3 x 40ft Container Mixed
Attachment: PO_Invoices_pdf.z (contains "PO_Invoices_pdf.exe")

HawkEye SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ea073ddc357d19912eeb45d967fd80c742a676cf9f00ad8d7ade93be5e4b101/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 07:47:04 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2qhhxodk7izsexowrozm76ybr2cuz3m7hyavwgxvxutxzpeweaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ea073ddc357d19912eeb45d967fd80c742a676cf9f00ad8d7ade93be5e4b101

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 2ea073ddc357d19912eeb45d967fd80c742a676cf9f00ad8d7ade93be5e4b101

(this sample)

HawkEye

Executable exe ef715cd322f0a805a68840b215c062f2e254977170a11c6800d836eac781fabb

  
Dropping
MD5 59d7d8d5dd3e0055e7c0dcc75897f569
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef715cd322f0a805a68840b215c062f2e254977170a11c6800d836eac781fabb

Comments