MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c
SHA3-384 hash: bac13cca5369a39fc75b21c6aa97ff1bc33936968b271e1ec2e548c830b947c2652c8890e090174e4e486fe77e2270ea
SHA1 hash: 36c1d67c3e05f10528b9c1e64dc2b3b6f251e0fb
MD5 hash: 6d7c69d1cb5ac9121f0a1097da2803d0
humanhash: early-emma-table-helium
File name:ORDER2020Aug05.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'035'776 bytes
First seen:2020-08-06 05:06:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6f6a6c4d7e3c496aeb050e49f17c295e (6 x MassLogger, 5 x Loki, 4 x AgentTesla)
ssdeep 12288:+cE9+ysRKpnYn0uCYQvSXxJ9P9cz6ku52zNC61CrN2etofsWVD8CRWPUOODdC3oL:+3+RcOn0TC3moKh4R23xO5Oo3ode2
Threatray 348 similar samples on MalwareBazaar
TLSH B1258DE2F290C4F7D0631578FC4B92F76826BD10E924994B26E57F0C7E36291352A2B7
Reporter abuse_ch
Tags:exe HawkEye


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: bolutech.com
Sending IP: 49.85.226.116
From: Sales-48 <sales@bolutech.com>
Reply-To: dh_derhawk@126.com
Subject: Re:SPS-1726076
Attachment: ORDER2020Aug05.zip (contains "ORDER2020Aug05.exe")

HawkEye SMTP exfil server:
smtp.amargrand.mn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
HawkEye
Create hunting rule
Link:
https://www.capesandbox.com/analysis/40000/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Strictor.247961.5681.1845.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Sending a UDP request
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Setting a keyboard event handler
Enabling the 'hidden' option for recently created files
Launching a process
Reading critical registry keys
Deleting a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Stealing user critical data
Deleting of the original file
Enabling a "Do not show hidden files" option
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Unauthorized injection to a system process
Result
Threat name:
HawkEye MailPassView
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/412039
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Detected HawkEye Rat
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Yara detected Keylogger Generic
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 258260 Sample: ORDER2020Aug05.exe Startdate: 06/08/2020 Architecture: WINDOWS Score: 100 78 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Detected unpacking (changes PE section rights) 2->82 84 14 other signatures 2->84 10 ORDER2020Aug05.exe 2->10         started        13 WindowsUpdate.exe 2->13         started        15 WindowsUpdate.exe 2->15         started        17 2 other processes 2->17 process3 signatures4 102 Detected unpacking (changes PE section rights) 10->102 104 Detected unpacking (creates a PE file in dynamic memory) 10->104 106 Detected unpacking (overwrites its own PE header) 10->106 108 Contains functionality to detect sleep reduction / modifications 10->108 19 ORDER2020Aug05.exe 9 10->19         started        110 Maps a DLL or memory area into another process 13->110 22 WindowsUpdate.exe 13->22         started        26 WindowsUpdate.exe 15->26         started        112 Machine Learning detection for dropped file 17->112 process5 dnsIp6 52 C:\Users\user\...\ORDER2020Aug05.exe.log, ASCII 19->52 dropped 28 Windows Update.exe 19->28         started        72 smtp.amargrand.mn 22->72 74 63.155.11.0.in-addr.arpa 22->74 76 2 other IPs or domains 22->76 94 Writes to foreign memory regions 22->94 96 Allocates memory in foreign processes 22->96 98 Sample uses process hollowing technique 22->98 100 2 other signatures 22->100 31 dw20.exe 22->31         started        54 C:\Users\user\AppData\...\Windows Update.exe, PE32 26->54 dropped 56 C:\...\Windows Update.exe:Zone.Identifier, ASCII 26->56 dropped 33 Windows Update.exe 26->33         started        file7 signatures8 process9 signatures10 114 Maps a DLL or memory area into another process 28->114 35 Windows Update.exe 16 8 28->35         started        40 Windows Update.exe 33->40         started        process11 dnsIp12 64 smtp.amargrand.mn 35->64 66 63.155.11.0.in-addr.arpa 35->66 70 3 other IPs or domains 35->70 58 C:\Users\user\AppData\...\WindowsUpdate.exe, PE32 35->58 dropped 60 C:\...\WindowsUpdate.exe:Zone.Identifier, ASCII 35->60 dropped 86 Changes the view of files in windows explorer (hidden files and folders) 35->86 88 Writes to foreign memory regions 35->88 90 Allocates memory in foreign processes 35->90 92 3 other signatures 35->92 42 vbc.exe 35->42         started        44 vbc.exe 35->44         started        46 dw20.exe 22 6 35->46         started        68 127.0.0.1 unknown unknown 40->68 62 C:\Users\user\...\Windows Update.exe.log, ASCII 40->62 dropped file13 signatures14 process15 process16 48 WerFault.exe 42->48         started        50 WerFault.exe 44->50         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:08:08 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6drfsh6nkgfz6263psey3sx2f75ceuzpkbr6g2cny5hmubrkega._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
0be2fd26cdd52bc071b076fc7350077db4962173366192cbc9870df8b3cb234c
HawkEye
46c79161fd1c1762286f0faeb76f8b885225466281e3ccea8cd81d3403e3b0d3
HawkEye
5321f28c4dc096dbf5eda4f882cb97f22acd91fa73826ccaa64d4e9b66f12499
HawkEye
536aabc78e3dd5a4577cdbacacb57fb38984e125393c4f3e6d11ae40e5a1bbf7
HawkEye
72153192845eff78553d2aebfca4f5d1cfba2910c12877c8b5d7dc25aa777408
HawkEye
7c69003f46210e2d3e2e23476883c1f22d8b1997a0a3927d726e83f49ed19344
HawkEye
9d52b33e1184f121f9b086b0296e5e1bf8d224bd9887780d86b01f43da7c85eb
HawkEye
a2966a3e5a7753ea245a9e5228cf96d631e15a3777a5b2550724bed0f646784a
HawkEye
ce1cba4461c9e999067572915bc3f2d6ff9c114b4e643a65b61b44e71084d30a
HawkEye
d27d51b27254802f1da9473d7808dc21036ee08ec6298c85a5e25becf7ba5508
HawkEye
+ 338 additional samples on MalwareBazaar
Result
Malware family:
hawkeye
Create hunting rule
Score:
  10/10
Tags:
upx keylogger trojan stealer spyware family:hawkeye persistence
Link:
https://tria.ge/reports/200806-ret81gpc1n/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Adds Run key to start application
Loads dropped DLL
Deletes itself
Uses the VBS compiler for execution
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
HawkEye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hawkeye
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect HawkEye in memory
Reference:internal research
Rule name:RAT_HawkEye
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects HawkEye RAT
Reference:http://malwareconfig.com/stats/HawkEye
Rule name:win_hawkeye_keylogger_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_hawkeye_keylogger_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e

HawkEye

Executable exe 2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c

(this sample)

  
Dropped by
MD5 ec469e44b717bb5c6f45c1d959985453
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/40000/
  
Dropped by
SHA256 af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e

Comments