MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
SHA3-384 hash: 97e82843260bf99fb986ae00b2251c47988d3b8283d45bd8d3c5dbde5987d262493f50475b1bb2b78b465c88fc0f740f
SHA1 hash: 1c67ae07cc9f304cb40731f6ed64ec1684198aad
MD5 hash: 0e43f07d161f5d0f3739e5588e1bb3e5
humanhash: berlin-december-queen-bakerloo
File name:document.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:678'912 bytes
First seen:2020-10-14 15:10:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e558a384d112fb5b0555df8d387d7b2c (3 x AgentTesla, 2 x HawkEye, 1 x MassLogger)
ssdeep 12288:ZPzCGvAfW4oCXIYtsz2eCJqN+eyiA8nMvasSkm5283EKs3iocER2i:hOGYO4/xCrOq8WAdasSX5brSy
Threatray 30 similar samples on MalwareBazaar
TLSH DAE423338AC58AA0D2301A747F33FCF0A84C78521419F2B96D51E96AECBB9D1DA55D83
Reporter abuse_ch
Tags:exe HawkEye


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: serv.misrsteel.com
Sending IP: 138.201.220.106
From: Ahmed H. Hashish <ahmed.hamdyhashish@enppi.com>
Reply-To: crew-vantageships@dr.com
Subject: Re: R.F.Q
Attachment: document.zip (contains "document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
HawkEyev9
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70852/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
DNS request
Sending an HTTP GET request
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Reading critical registry keys
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Result
Threat name:
HawkEye MailPassView
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/491209
Signature
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Detected HawkEye Rat
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected HawkEye Keylogger
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 298119 Sample: document.exe Startdate: 14/10/2020 Architecture: WINDOWS Score: 100 33 Multi AV Scanner detection for domain / URL 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 11 other signatures 2->39 7 document.exe 2->7         started        process3 signatures4 41 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 7->41 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->43 45 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 7->45 47 4 other signatures 7->47 10 document.exe 15 7 7->10         started        14 document.exe 7->14         started        process5 dnsIp6 21 eagleeyeapparels.com 54.39.139.67, 49734, 587 OVHFR Canada 10->21 23 mail.eagleeyeapparels.com 10->23 25 bot.whatismyipaddress.com 66.171.248.178, 49732, 49733, 80 ALCHEMYNETUS United States 10->25 49 Writes to foreign memory regions 10->49 51 Allocates memory in foreign processes 10->51 53 Sample uses process hollowing technique 10->53 55 Injects a PE file into a foreign processes 10->55 16 vbc.exe 10->16         started        19 vbc.exe 12 10->19         started        signatures7 process8 signatures9 27 Tries to steal Instant Messenger accounts or passwords 16->27 29 Tries to steal Mail credentials (via file access) 16->29 31 Tries to harvest and steal browser information (history, passwords, etc) 19->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5/
Threat name:
Win32.Trojan.Pynamer
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 01:06:40 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkq5thas2s5362za5zb2exhu3thtjorq3dka3runtrm5jr52exkq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
13f51d450568dc6ee7223eb76584d17417a2ef85141e74720445cfba0b10ad5d
HawkEye
28753bd34049059e094796e4480f184cb0fdec4f5ca2ba0ffc5cc79bb3a7c1a6
HawkEye
2e00a231db5268aabbf82259fb2f25b541b7877a5d8be339b107dfab1e896338
HawkEye
44f88f1551622a78e7e0cb6cb04b810ce4c58a1dbd6039b1f7248b579e8f9095
HawkEye
76f4037b2878a1f9d902b58becabe775f8f99df45b2c5c80ac9eb61a8da4a255
HawkEye
7dfdce0a99eabe706a8f617d20f54ab7c933fd0e702dffed576ea3d5d74aea9d
HawkEye
aff4e29973c297fd764b3ba81237afd91912f51f9a4babfd766ce80f9ace2676
HawkEye
c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513
HawkEye
c944ec2c1c332672384769d2abfbb4f298f9fcaa63b18b4094e1d9779fa82fe0
HawkEye
e842dbdc4b41d7516d87ccc21fa365b93c4c94ce5a75dc6f06321f90efa19e29
HawkEye
+ 20 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
upx keylogger trojan stealer spyware family:hawkeye_reborn family:m00nd3v_logger
Link:
https://tria.ge/reports/201014-1j53n97gee/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
Uses the VBS compiler for execution
UPX packed file
M00nD3v Logger Payload
HawkEye Reborn
M00nd3v_Logger
Unpacked files
SH256 hash:
32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
MD5 hash:
0e43f07d161f5d0f3739e5588e1bb3e5
SHA1 hash:
1c67ae07cc9f304cb40731f6ed64ec1684198aad
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
SH256 hash:
1ed806a07dae3c17ed5ec9faf454240738dcff590a06e68e82cfdd462107c85e
MD5 hash:
4fdfeffb6e1c5773ebfe6990dd9d9ffe
SHA1 hash:
24a04516c7fa4cc857550f038f1b00e439da5aba
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
SH256 hash:
414f642cc634c8f9fe744110f2add77ed0bb2251a8e73c586803ae943f7aeeef
MD5 hash:
dddc5f4656eb88cdcfb211481cb8fe93
SHA1 hash:
de141904a38bb42fd37e9a6a67646c2190e9e998
Detections:
win_hawkeye_keylogger_g0
Create hunting rule
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
Parent samples :
76f4037b2878a1f9d902b58becabe775f8f99df45b2c5c80ac9eb61a8da4a255
c944ec2c1c332672384769d2abfbb4f298f9fcaa63b18b4094e1d9779fa82fe0
c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513
aff4e29973c297fd764b3ba81237afd91912f51f9a4babfd766ce80f9ace2676
7dfdce0a99eabe706a8f617d20f54ab7c933fd0e702dffed576ea3d5d74aea9d
44f88f1551622a78e7e0cb6cb04b810ce4c58a1dbd6039b1f7248b579e8f9095
32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
SH256 hash:
400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342
MD5 hash:
54e8ded7b148a13d3363ac7b33f6eb06
SHA1 hash:
63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
Parent samples :
e6b3160e17f1c4c0ce9136d7e19089f9e7e759bbd2989c27f8eb6083a627bfb9
c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
c2d23332a28fd0f2f0b404e53d9820ba0f5f8070043cfa0b2fbb18a4a33466b6
SH256 hash:
54241d67c33e245742af873dc6e61558b837618a3c03eb055695587e3ddf8740
MD5 hash:
b15ffed0dc3932b66ab628d422b18f70
SHA1 hash:
99e0ea3021640282792f2914a4d7e6626fca9df8
Detections:
win_hawkeye_keylogger_auto
Create hunting rule
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
Parent samples :
76f4037b2878a1f9d902b58becabe775f8f99df45b2c5c80ac9eb61a8da4a255
c944ec2c1c332672384769d2abfbb4f298f9fcaa63b18b4094e1d9779fa82fe0
c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513
aff4e29973c297fd764b3ba81237afd91912f51f9a4babfd766ce80f9ace2676
7dfdce0a99eabe706a8f617d20f54ab7c933fd0e702dffed576ea3d5d74aea9d
44f88f1551622a78e7e0cb6cb04b810ce4c58a1dbd6039b1f7248b579e8f9095
32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
b926b9c322ee16dc0ea54330428658cda75dc84a1a58ef88ebec2572d87d850b
c5845be19adb4e49adb11f5c276835d1f2d11c2d277da2dc265968bb6edb4c2d
a1416f15382642c1bcf6fafac052bcd38900409be007f54414942e405c18ff73
SH256 hash:
e6ad1a92f06a4ec4847d2d40623131fdd237b1c013f93f77d4d28d568edcad06
MD5 hash:
1001f375be22e77a232e8836ea3721ed
SHA1 hash:
d7e960a487023fac393aa6f5943ef473fdcaa6ae
Detections:
win_hawkeye_keylogger_auto
Create hunting rule
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
Parent samples :
76f4037b2878a1f9d902b58becabe775f8f99df45b2c5c80ac9eb61a8da4a255
c944ec2c1c332672384769d2abfbb4f298f9fcaa63b18b4094e1d9779fa82fe0
c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513
aff4e29973c297fd764b3ba81237afd91912f51f9a4babfd766ce80f9ace2676
7dfdce0a99eabe706a8f617d20f54ab7c933fd0e702dffed576ea3d5d74aea9d
44f88f1551622a78e7e0cb6cb04b810ce4c58a1dbd6039b1f7248b579e8f9095
32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
SH256 hash:
4924e0c81fdb47ac113b81db0fbd01c3bb63ec066e86fdc1adf3667e7eac6590
MD5 hash:
8538307d9843dde06fbb3700770538ff
SHA1 hash:
85d7ea52f71c2d1f0fb3da8b5c9f1ddeb41d5159
Detections:
win_hawkeye_keylogger_g0
Create hunting rule
Link:
https://www.unpac.me/results/7510ae7f-7914-47e4-bde3-0dbe0530bfc9/
Parent samples :
76f4037b2878a1f9d902b58becabe775f8f99df45b2c5c80ac9eb61a8da4a255
c944ec2c1c332672384769d2abfbb4f298f9fcaa63b18b4094e1d9779fa82fe0
c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513
aff4e29973c297fd764b3ba81237afd91912f51f9a4babfd766ce80f9ace2676
7dfdce0a99eabe706a8f617d20f54ab7c933fd0e702dffed576ea3d5d74aea9d
44f88f1551622a78e7e0cb6cb04b810ce4c58a1dbd6039b1f7248b579e8f9095
32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip e859cd402b47712b0235056bf30a7ef42a7bf5e2e3c411e8f002e583a479642b

HawkEye

Executable exe 32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5

(this sample)

  
Dropped by
MD5 c37b8ee5afafb02fd7ee4f6c12e834ec
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e859cd402b47712b0235056bf30a7ef42a7bf5e2e3c411e8f002e583a479642b
Cape
Cape
https://www.capesandbox.com/analysis/70852/

Comments