MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aeb66e91ce472bb51cf7f8b2778e05201de3d0ec40bb528967a417374854ad9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aeb66e91ce472bb51cf7f8b2778e05201de3d0ec40bb528967a417374854ad9
SHA3-384 hash: ccfdfc0522944f649822f3f0099eaea076b8fa9bc7a281d430e70b91f369b1e8c90689af8cf2a7a1e30dbb5c432368ae
SHA1 hash: 1a92fb24d6cdb01d9b03f4d48cd5583a7f26fa19
MD5 hash: 4e80135962882bf88e54f90154f3c1b0
humanhash: avocado-may-sad-romeo
File name:REQUEST FOR QUOTATION 13032020_pdf.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:790'704 bytes
First seen:2020-05-05 07:33:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:nRbzZV/g/ZnWh2ibXCNV+Cj50lFRPaqZ+gffIQGr:RbltgRn4LbyX+CiFNjffo
TLSH 57F4336E637B77529A6777774C40694838B4CC2DB3310367B3DAAC6BE33021D265E81A
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: mail.apartacel.com
Sending IP: 187.189.47.210
From: karen@choimesse.com
Subject: FW: URGENT REQUEST FOR QUOTATION
Attachment: REQUEST FOR QUOTATION 13032020_pdf.zip (contains "REQUEST FOR QUOTATION #13032020_pdf.exe")

AgentTesla SMTP exfil server:
mail.crdd.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisE56ED4558D34.13636.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 07:35:49 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=llvwn2i44rzlwuopp6fso6hakia54pioyqf3kkewpjaxg5efjlmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 5aeb66e91ce472bb51cf7f8b2778e05201de3d0ec40bb528967a417374854ad9

(this sample)

HawkEye

Executable exe 57f4a2e59ddbdae494c86f258f57973b041c55c4a54ca2631153de0fdf6a0c05

  
Dropping
MD5 e56ed4558d3474dd31ee6d66909142c6
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 57f4a2e59ddbdae494c86f258f57973b041c55c4a54ca2631153de0fdf6a0c05

Comments