MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58ead128df62a83e25018f9688b8f5718104158b7246c5c2a5ab53cd1ce975b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58ead128df62a83e25018f9688b8f5718104158b7246c5c2a5ab53cd1ce975b4
SHA3-384 hash: 717c1ae8ec7b3c71a22b336c28dc44c0ee01673254fda82832d09a4b95fc136762b2fdf22ff245de37c6e8c664a99c5b
SHA1 hash: cefd9bf0232d0b01c7d49f34a6e7fa07e819d09a
MD5 hash: 6921a8c3be1b35f8b3f4a83701df62c0
humanhash: hydrogen-michigan-cola-one
File name:order07082020.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'114'112 bytes
First seen:2020-08-07 13:22:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d2c5bb9650248d566011b3a45aa89b6f (2 x HawkEye, 2 x AgentTesla, 1 x MassLogger)
ssdeep 24576:/yrAsCU/TdrqBRzSwEJsYJkSIdLqJyWBM:/y6e5+dMyWm
Threatray 348 similar samples on MalwareBazaar
TLSH 25359D22B591C43ED3322638FF379EF958267ED0E918650727E43D4F7A3828D252529E
Reporter abuse_ch
Tags:exe HawkEye


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: server02.imanila.ph
Sending IP: 203.167.7.69
From: HEIMIR JÓNSSON <server@stsoft.es>
Reply-To: dh_derhawk@126.com
Subject: Re:SPS-1726076
Attachment: order07082020.zip (contains "order07082020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
HawkEye
Create hunting rule
Link:
https://www.capesandbox.com/analysis/41638/
Detection(s):
SecuriteInfo.com.Variant.Zusy.310751.25174.6541.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Sending a UDP request
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Setting a keyboard event handler
Enabling the 'hidden' option for recently created files
Launching a process
Reading critical registry keys
Deleting a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Stealing user critical data
Deleting of the original file
Enabling a "Do not show hidden files" option
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Unauthorized injection to a system process
Result
Threat name:
HawkEye MailPassView
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/415290
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Detected HawkEye Rat
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Yara detected HawkEye Keylogger
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 259895 Sample: order07082020.exe Startdate: 07/08/2020 Architecture: WINDOWS Score: 100 86 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->86 88 Found malware configuration 2->88 90 Malicious sample detected (through community Yara rule) 2->90 92 15 other signatures 2->92 10 order07082020.exe 2->10         started        13 WindowsUpdate.exe 2->13         started        15 WindowsUpdate.exe 2->15         started        17 2 other processes 2->17 process3 signatures4 102 Detected unpacking (changes PE section rights) 10->102 104 Detected unpacking (creates a PE file in dynamic memory) 10->104 106 Detected unpacking (overwrites its own PE header) 10->106 108 Contains functionality to detect sleep reduction / modifications 10->108 19 order07082020.exe 9 10->19         started        110 Maps a DLL or memory area into another process 13->110 22 WindowsUpdate.exe 13->22         started        26 WindowsUpdate.exe 15->26         started        112 Machine Learning detection for dropped file 17->112 process5 dnsIp6 60 C:\Users\user\...\order07082020.exe.log, ASCII 19->60 dropped 28 Windows Update.exe 19->28         started        72 smtp.amargrand.mn 22->72 74 35.37.15.0.in-addr.arpa 22->74 76 3 other IPs or domains 22->76 94 Writes to foreign memory regions 22->94 96 Allocates memory in foreign processes 22->96 98 Sample uses process hollowing technique 22->98 100 2 other signatures 22->100 31 vbc.exe 22->31         started        33 dw20.exe 22->33         started        35 vbc.exe 22->35         started        37 WerFault.exe 22->37         started        62 C:\Users\user\AppData\...\Windows Update.exe, PE32 26->62 dropped 64 C:\...\Windows Update.exe:Zone.Identifier, ASCII 26->64 dropped 39 Windows Update.exe 26->39         started        file7 signatures8 process9 signatures10 122 Maps a DLL or memory area into another process 28->122 41 Windows Update.exe 16 8 28->41         started        46 WerFault.exe 31->46         started        48 Windows Update.exe 39->48         started        process11 dnsIp12 78 smtp.amargrand.mn 41->78 80 35.37.15.0.in-addr.arpa 41->80 84 3 other IPs or domains 41->84 66 C:\Users\user\AppData\...\WindowsUpdate.exe, PE32 41->66 dropped 68 C:\...\WindowsUpdate.exe:Zone.Identifier, ASCII 41->68 dropped 114 Changes the view of files in windows explorer (hidden files and folders) 41->114 116 Writes to foreign memory regions 41->116 118 Allocates memory in foreign processes 41->118 120 3 other signatures 41->120 50 vbc.exe 41->50         started        52 vbc.exe 41->52         started        54 dw20.exe 22 6 41->54         started        82 127.0.0.1 unknown unknown 48->82 70 C:\Users\user\...\Windows Update.exe.log, ASCII 48->70 dropped file13 signatures14 process15 process16 56 WerFault.exe 50->56         started        58 WerFault.exe 52->58         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58ead128df62a83e25018f9688b8f5718104158b7246c5c2a5ab53cd1ce975b4/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:24:09 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ldvnckg7mkud4jibr6lirohvogaqifmlojdmlqvfvnj42hhjow2a._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
0d6437a1e212ba6c8b651098ae5863a45b1e81d201d3722bd52e0c6559898db8
HawkEye
0edc6218dec611e4dd00d3251ba2b3361d512f09dde595a8489639b9aa250ec9
HawkEye
3dbc13f74f3ce33aad9985eb2cd06a636e09c1f4581c1d59dcdebfd7efb4e9fd
HawkEye
488c81c6de7f2f8d5b81e8089d08bb84c9e61e1914edceb10a9349b31e15c93c
HawkEye
5321f28c4dc096dbf5eda4f882cb97f22acd91fa73826ccaa64d4e9b66f12499
HawkEye
536aabc78e3dd5a4577cdbacacb57fb38984e125393c4f3e6d11ae40e5a1bbf7
HawkEye
72153192845eff78553d2aebfca4f5d1cfba2910c12877c8b5d7dc25aa777408
HawkEye
7c69003f46210e2d3e2e23476883c1f22d8b1997a0a3927d726e83f49ed19344
HawkEye
86ce3571c645ccec7f6831b75cb4a00b65213d1b3bc4d4c2c8b3e5f197bd0232
HawkEye
a2966a3e5a7753ea245a9e5228cf96d631e15a3777a5b2550724bed0f646784a
HawkEye
+ 338 additional samples on MalwareBazaar
Result
Malware family:
hawkeye
Create hunting rule
Score:
  10/10
Tags:
upx persistence spyware keylogger trojan stealer family:hawkeye
Link:
https://tria.ge/reports/200807-atzc3q5hte/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Deletes itself
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Loads dropped DLL
Executes dropped EXE
UPX packed file
HawkEye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58ead128df62a83e25018f9688b8f5718104158b7246c5c2a5ab53cd1ce975b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hawkeye
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect HawkEye in memory
Reference:internal research
Rule name:RAT_HawkEye
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects HawkEye RAT
Reference:http://malwareconfig.com/stats/HawkEye
Rule name:win_hawkeye_keylogger_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_hawkeye_keylogger_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 009ac34ff97c62b0dc6431203ee65f024ce43e91ca7e7d0be8f1952b189bb0cb

HawkEye

Executable exe 58ead128df62a83e25018f9688b8f5718104158b7246c5c2a5ab53cd1ce975b4

(this sample)

  
Dropped by
MD5 9b923164203ded1410611e925232c76b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/41638/
  
Dropped by
SHA256 009ac34ff97c62b0dc6431203ee65f024ce43e91ca7e7d0be8f1952b189bb0cb

Comments