MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320
SHA3-384 hash: 597965798ac21433812f5238930b35b00d6bdec33590d1d01a130237a3185924d3b19bc7926ec3b28c6df62d9ae4f3c8
SHA1 hash: 58393367b11bb9859b2ae6b9d401dce8e5a6f162
MD5 hash: d18e3b25f9a8bf69b437e6ad4a33f651
humanhash: fourteen-neptune-single-mars
File name:d18e3b25f9a8bf69b437e6ad4a33f651.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:346'624 bytes
First seen:2020-06-01 07:54:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:4oXQV8V5qmSSv5YK4t8YriOJoG/PEjkcuiwPaED5a7wirfTxm:4oXQM5WSvWKLmoG/PENuTsa
Threatray 408 similar samples on MalwareBazaar
TLSH 7174129A668C452FEB6C1EF51011614443F3892FB422E3CF9DA424F55BAF3C0AF46A97
Reporter abuse_ch
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 04:42:28 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iafnpbv7dz3ick3quovuxi2fm2h6a7axm5b7iexw75jxei4memqa._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
0a375c52851b79c5d3be0d18025940bee5f68501c8e18334264f116775e57fa7
HawkEye
0b0843fec59e2e7c90b04d88f9d90f7e6a3c8e7511a601d20ba588a52380781b
HawkEye
1136fada0e7737d8ea5304cb8e85550cf1ca35e2b64bfa6e000b07d5c428f7d7
HawkEye
3a2adcac20af82cdb882ab9bd9a1a78ca30f833a488cd13a55daf8ff743271a3
HawkEye
538a207974969d50055870c016eb819c2a71a1388db863bf025ea5bc2144b00b
HawkEye
a4b07204b33173093041072e00e88d0083c88b88f634561aabe46ec8992f9332
HawkEye
c0a5e2237ef1901c7a3ee2c15290c8db625a1cb9659e99a86ee474460533aa32
HawkEye
c51d3c8be3936b476ac729e5ddc15eb4dcd5dea18dbcf8200f0767b33ab0b076
HawkEye
c730e6287aa786e04d22daa4e6c77b504cdf80dc4f09877a15bc79bac84403f6
HawkEye
f9aa404e6b892570fa59a968eb1e6f2069cb6e6105632e323ae91d7c8005fe57
HawkEye
+ 398 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger spyware stealer
Link:
https://tria.ge/reports/201109-hwerbbbtc2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Uses the VBS compiler for execution
M00nD3v Logger Payload
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_NK_BabyShark_KimJoingRAT_Apr19_1
Create hunting rule
Author:Florian Roth
Description:Detects BabyShark KimJongRAT
Reference:https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

Executable exe 400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments