MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66b8f85747edc77fbfabe6b383e11e5284b185dab2257b7c2a127fbfda839edc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

HawkEye

Vendor detections: 3

Intelligence 3 IOCs YARA 2 File information Comments

SHA256 hash:	66b8f85747edc77fbfabe6b383e11e5284b185dab2257b7c2a127fbfda839edc
SHA3-384 hash:	a8932b331c85806532cbd81884b95810fb8aa8409cd8ec6fb199d9105bed3a2c83ab56d02456f0a376b6f6822523f358
SHA1 hash:	a4f651c98d7a2b26579fce7999abb7f6a3efb0b9
MD5 hash:	5089b1b18bc94e01ef74df6f63b03205
humanhash:	india-kansas-wyoming-twenty
File name:	Balance_Final_Payment.exe
Download:	download sample
Signature	HawkEye Create hunting rule
File size:	847'872 bytes
First seen:	2020-04-30 07:35:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e8a50da9c930d4de68020a02ac03fa88 (1 x HawkEye)
ssdeep	12288:30/k8k178eNMLLUDlPURqkjsov7y6ZkYm6e9XXXxQQQbJ:k8RXNMnARkwovO6ZkYmvXXXxQQQbJ
Threatray	857 similar samples on MalwareBazaar
TLSH	ED05E0D0B2006BD7E40CD5715073E1F2CB6CBCA254E39573B272FB1ADE3A3A26641A59
Reporter	jarumlus
Tags:	HawkEye

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Atraps-6968419-0

Gathering data

Threat name:

Win32.Trojan.Heye

Status:

Malicious

First seen:

2019-05-14 01:10:00 UTC

AV detection:

28 of 30 (93.33%)

Threat level:

5/5

Verdict:

malicious

Label(s):

guloader

agenttesla

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_blackremote_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
VB_API	Legacy Visual Basic API used	MSVBVM60.DLL::__vbaSetSystemError MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef MSVBVM60.DLL::__vbaFileOpen MSVBVM60.DLL::__vbaErrorOverflow

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample