MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64cf8b26d7c8ba515e356915d8575974e14f71b259c7fd7793a5623e9aa8a776. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64cf8b26d7c8ba515e356915d8575974e14f71b259c7fd7793a5623e9aa8a776
SHA3-384 hash: c28466e7957c16953967856ac862f7c627f2245cb23a4d256c4dabd681047ba8b36142492eddec2c2b25b06b8d16c019
SHA1 hash: 785c0c9c86b5feadb5e62718a764efbf571f3746
MD5 hash: f3ace6b037e64af22f2beb6db6175710
humanhash: west-quebec-lima-michigan
File name:agency appointment.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:677'409 bytes
First seen:2020-06-05 11:49:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:DJ2r37NYsbAVQlbH8P8MtakINq9eqhDgd2njHqnFAnm3RR:DcXNXAVsHivtsqw22nqm3v
TLSH 5AE423A5A37AA21C50239BD8A003BB3C3C45572D3E7F53CAD960AD9F6E89311B1B7C45
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: panocean.com
Sending IP: 104.129.25.20
From: Jayden Seo <jayden@panocean.com>
Subject: MV TATRY - loading, Agency appointment & PDA
Attachment: agency appointment.zip (contains "agency appointment.exe")

HawkEye SMTP exfil server:
mail.oms.com.sg:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 12:35:38 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mthywjwxzc5fcxrvnek5qv2zotqu64nslhd7254tuvrd5gviu53a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 64cf8b26d7c8ba515e356915d8575974e14f71b259c7fd7793a5623e9aa8a776

(this sample)

HawkEye

Executable exe 2b595bebceff46c9b833e8780fce9bcbc7aace47dfffbb89fca8e42606b5e281

  
Dropping
MD5 4ac43304b069dfca2f5df2f8c4e32473
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b595bebceff46c9b833e8780fce9bcbc7aace47dfffbb89fca8e42606b5e281

Comments