MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 488c81c6de7f2f8d5b81e8089d08bb84c9e61e1914edceb10a9349b31e15c93c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 488c81c6de7f2f8d5b81e8089d08bb84c9e61e1914edceb10a9349b31e15c93c
SHA3-384 hash: c1648b405289345fdf1439656a34ea2bd97d063047be669a24ca98e04e5b363ba56826aa3abc58490c13c1f62659c6c1
SHA1 hash: e4cbfd6147769f4b548dea88a6a3d7d94b311457
MD5 hash: 22e8547d42f9283de9263bb801c5054f
humanhash: magnesium-mockingbird-pennsylvania-nitrogen
File name:order22JUN2020.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:996'352 bytes
First seen:2020-06-23 05:47:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7a3b36319e10a182a46078ebecd565ef (13 x AgentTesla, 4 x HawkEye, 4 x Loki)
ssdeep 12288:KGeRii6YfY4FBgEMo+3z9SFnbHhnmju5hS9ONdq9U0p4dd41Cw0aLIgQuHaL9MPg:nLLv4fH02bcjuPRI9Cr42gyxht
Threatray 349 similar samples on MalwareBazaar
TLSH 06257B15EDD0CC3ED82E1638CC3F96F6692D7DD0E92C68439EA7FC487B386592415262
Reporter abuse_ch
Tags:exe HawkEye


Avatar
abuse_ch
HawkEye SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12803/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.7193.27524.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/488c81c6de7f2f8d5b81e8089d08bb84c9e61e1914edceb10a9349b31e15c93c/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 21:58:41 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcgidrw6p4xy2w4b5aej2cf3qte6mhqzctw45miksne3ghqvze6a._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
0be2fd26cdd52bc071b076fc7350077db4962173366192cbc9870df8b3cb234c
HawkEye
0d6437a1e212ba6c8b651098ae5863a45b1e81d201d3722bd52e0c6559898db8
HawkEye
0edc6218dec611e4dd00d3251ba2b3361d512f09dde595a8489639b9aa250ec9
HawkEye
18b5e8b21a0feba19538fd26046557f1b5ae22e93cf99adb92122254b8c72f3e
HawkEye
3dbc13f74f3ce33aad9985eb2cd06a636e09c1f4581c1d59dcdebfd7efb4e9fd
HawkEye
5321f28c4dc096dbf5eda4f882cb97f22acd91fa73826ccaa64d4e9b66f12499
HawkEye
536aabc78e3dd5a4577cdbacacb57fb38984e125393c4f3e6d11ae40e5a1bbf7
HawkEye
58ead128df62a83e25018f9688b8f5718104158b7246c5c2a5ab53cd1ce975b4
HawkEye
86ce3571c645ccec7f6831b75cb4a00b65213d1b3bc4d4c2c8b3e5f197bd0232
HawkEye
a2966a3e5a7753ea245a9e5228cf96d631e15a3777a5b2550724bed0f646784a
HawkEye
+ 339 additional samples on MalwareBazaar
Result
Malware family:
hawkeye
Create hunting rule
Score:
  10/10
Tags:
evasion spyware trojan keylogger stealer family:hawkeye persistence
Link:
https://tria.ge/reports/200624-kkkvx84dns/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Modifies system certificate store
Looks up external IP address via web service
Adds Run entry to start application
Loads dropped DLL
Deletes itself
Uses the VBS compiler for execution
Reads user/profile data of web browsers
UPX packed file
Executes dropped EXE
HawkEye
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hawkeye
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect HawkEye in memory
Reference:internal research
Rule name:RAT_HawkEye
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects HawkEye RAT
Reference:http://malwareconfig.com/stats/HawkEye
Rule name:win_hawkeye_keylogger_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12803/

Comments