MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c2ea777da33a621b23492ec92638ae11c24dd7f77e9607277d77a7a02f5ee5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

HawkEye

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	5c2ea777da33a621b23492ec92638ae11c24dd7f77e9607277d77a7a02f5ee5b
SHA3-384 hash:	eeda53b432a4d8afb01d71f266c79edb078a098eeaff9f0f3368443427ea74432eec955b209ff698c85a8fcddd1493e6
SHA1 hash:	07eea0aded2a84bd05218c32ff8cdf4f1d53bc5f
MD5 hash:	34b36a35c25d368cafb2ea1ffdbd8ead
humanhash:	social-illinois-black-twelve
File name:	E002-08943-08304.exe
Download:	download sample
Signature	HawkEye Create hunting rule
File size:	633'856 bytes
First seen:	2020-06-22 11:44:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7a3b36319e10a182a46078ebecd565ef (13 x AgentTesla, 4 x HawkEye, 4 x Loki)
ssdeep	12288:uGeRii6YfY4FBgEMo+3z9SFnbHhnmju5hGO3uoLL:rLLv4fH02bcjuPGO3uy
Threatray	2'348 similar samples on MalwareBazaar
TLSH	F2D47D62E2D04C73CC2F16389C7B56779C2ABD10292869462BE4DCCC9FF929D38252D7
Reporter	abuse_ch
Tags:	exe HawkEye

abuse_ch

Malspam distributing unidentified malware:

HELO: csjn.gov.ar
Sending IP: 45.147.231.50
From: Juan Pablo <dcancela@csjn.gov.ar>
Subject: [EXTERNAL] PAYMENT INFORMATION - BANK ACCOUNT INFORMATION REQUEST
Attachment: E002-08943-08304.zip (contains "E002-08943-08304.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Phoenix

Link:

https://www.capesandbox.com/analysis/12565/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c2ea777da33a621b23492ec92638ae11c24dd7f77e9607277d77a7a02f5ee5b/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-06-22 11:46:06 UTC

AV detection:

28 of 30 (93.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lqxko562gotcdmruslwjey4k4eocjxl7o7uwa4tx255huaxv5znq._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

Result

Malware family:

n/a

Score:

8/10

Tags:

spyware

Link:

https://tria.ge/reports/200624-lmhfr1zyxs/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads user/profile data of local email clients

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184