MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6480d0d4232a23159e754ab88769b21a48e8bc4a86fa84b99c2160b2bfb09244. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6480d0d4232a23159e754ab88769b21a48e8bc4a86fa84b99c2160b2bfb09244
SHA3-384 hash: 1df30a26f239da5ca6ab650ba55673cdef57aaf38b9b166b04eef7f0aa8e77e0f9e73230cd426edd8bb38b6ec9220e43
SHA1 hash: 40dc6706d152f1ee9121bb2bf4bf96843b89aecd
MD5 hash: de3d218d89e5fe940e9d9ade725f6ef9
humanhash: three-hotel-blossom-queen
File name:RFQ-MT-JS JIANGYIN-DOCX.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:514'596 bytes
First seen:2020-06-04 08:07:46 UTC
Last seen:2020-06-04 12:00:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fec7202070edb9862911b0bdf2bee56d (13 x AgentTesla, 3 x HawkEye, 3 x Loki)
ssdeep 12288:OZvDjvD2TsFPsy9Rz3cVpMImn0HRnAAATtLCngY:uLH2TsF1RGplKCRnAAATt2gY
Threatray 2'249 similar samples on MalwareBazaar
TLSH 4AB48EE2E2A05437C562167E9D1B5F7C582ABA61292825476BF8FC4C9F3D2C3352E1C3
Reporter jarumlus
Tags:HawkEye

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 08:36:53 UTC
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=msanbvbdfirrlhtvjk4io2nsdjeorpckq35ijom4efqlfp5qsjca._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
03858ed158440d03ed25802a74b88cc2091960e35ded3901d4d0370c88a38d9f
HawkEye
0776457840077a9b6ac113b23ebf60c224c3c7b4807c6698fdfe764531d285be
HawkEye
08f7d226c61cc7f24dfc55909238659ddf5c09f47127f348322c2d8636cdca1c
HawkEye
52054471a155edf2779e397464d81796b16de9f44476388591dd91a9ce136df2
HawkEye
6d415497a3d0845048c1ccafb82bf70283dd6976dbabb8f1cf639b9780571a40
HawkEye
7501745bfca00a30575e2ea4219b88ef3d4b19ff684deefce5c50d329f9bfc51
HawkEye
b44ef73bf2306886ca92291cbbdc5b0d07d6878f9a1b3c84ce476ca69cc4532e
HawkEye
bb94a881c3aa20c54450ee7d907eae152aa667a7a3280f7b00b44051d92322f5
HawkEye
d7b266bb9eacabd128560d80eea9195b42b227df16d460f1c0e13ed6575ca627
HawkEye
e6628501ee0344c1e6c7adc92944f5ddc7c784c1ac6278bdd7b66164b01707d3
HawkEye
+ 2'239 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware upx
Link:
https://tria.ge/reports/201109-27cpz1wqvn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip a651eb62ed2290751cafff474ce7d5542e2571ba4a273490550b0b40a4588e2c

HawkEye

Executable exe 6480d0d4232a23159e754ab88769b21a48e8bc4a86fa84b99c2160b2bfb09244

(this sample)

  
Dropped by
MD5 ed0cf2a2059d0016f2a48940a7463aef
  
Dropped by
SHA256 a651eb62ed2290751cafff474ce7d5542e2571ba4a273490550b0b40a4588e2c
  
Delivery method
Distributed via e-mail attachment

Comments