MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60a4735f8cacc7d31be0d23d12b4a7cd70c6ba66b4fda9375049780b38e21e0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60a4735f8cacc7d31be0d23d12b4a7cd70c6ba66b4fda9375049780b38e21e0c
SHA3-384 hash: f03e7362f506a8f24230337233e0f03b8bdd744b3455c38ca3f6e1b2bf52a015c8dbb27ed7b75dfc1ce1987a78f8a0d6
SHA1 hash: de9b603a3651d5090f509afa12ea2efee891744f
MD5 hash: 34bef04c9da31859332e9650243a149b
humanhash: tennis-table-rugby-ohio
File name:SWIFT COPY.arj
Download: download sample
Signature HawkEye
Create hunting rule
File size:729'598 bytes
First seen:2020-06-25 13:25:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:37iKW+Oqd/EOtWjITnyR9IilE61mzVveSR41E0n2jHst7o7U2PxAS/FAchGOVrti:3uKOqdptmIryvnlE6YeSRcNn2H7peS/m
TLSH D9F423FD5D62A48E76729E6B32E230B9FD66BC354E50F5908F049708693E6C440AB0DD
Reporter abuse_ch
Tags:arj HawkEye


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: v12.techscape.info
Sending IP: 118.98.75.77
From: customerservice@demajors.com
Subject: SWIFT
Attachment: SWIFT COPY.arj (contains "SWIFT.exe")

HawkEye SMTP exfil email server:
mail.djindustries.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.181bf63f744587d9.5579.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24343.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60a4735f8cacc7d31be0d23d12b4a7cd70c6ba66b4fda9375049780b38e21e0c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:37:31 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mcshgx4mvtd5gg7a2i6rfnfhzvymnotgwt62sn2qjf4awohcdyga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 60a4735f8cacc7d31be0d23d12b4a7cd70c6ba66b4fda9375049780b38e21e0c

(this sample)

HawkEye

Executable exe 1bb034cbd16394a007729ff3099c124f7b39b696b5e1db3d5078def6f8437d82

  
Dropping
MD5 8a0a2bca0b3d798daf56d1e05a6ace87
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1bb034cbd16394a007729ff3099c124f7b39b696b5e1db3d5078def6f8437d82

Comments