MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69a34116377032442c113adb0490c641f4af86b04fb8a2027f094d3678674915. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

HawkEye

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	69a34116377032442c113adb0490c641f4af86b04fb8a2027f094d3678674915
SHA3-384 hash:	393c0e7990e1757555832a7c441d4d7c2e0f5682be99f9f54683371fab36ba275dae57c9cb58597466a9854b4c2ace19
SHA1 hash:	6ce55d848dd73376baf76b7dd716d14c57b9123b
MD5 hash:	a27883ff5f9107b0a013ea777b591fbe
humanhash:	paris-south-edward-foxtrot
File name:	Payment Sent.exe
Download:	download sample
Signature	HawkEye Create hunting rule
File size:	1'015'296 bytes
First seen:	2020-08-03 07:16:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:5nAUScQdcQ3gXNPvJJF/rlk+hqn0rxNQmpaemaRn+mm1622vrvgte8IWMdUck:9FBQxwXPSUq0rxBY16/r4tHxMqV
Threatray	391 similar samples on MalwareBazaar
TLSH	E125BF523945DC62C2A76B33CC8FC21843B9AD11A9D2DA16B5DA73EC0612FFBDC055CA
Reporter	abuse_ch
Tags:	exe HawkEye

abuse_ch

Malspam distributing HawkEye:

HELO: mta1.infoaljazea.tk
Sending IP: 104.168.214.67
From: Accounts Department <info@infoaljazea.tk>
Reply-To: accountss@indo-heavy.com
Subject: Re: Re:Re : TT transfer payment slip
Attachment: Payment Sent.rar (contains "Payment Sent.exe")

HawkEye SMTP exfil server:
mail.indoheavy.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

HawkEye

Link:

https://www.capesandbox.com/analysis/37422/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Creating a file

Creating a file in the %AppData% directory

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Unauthorized injection to a system process

Enabling a "Do not show hidden files" option

Result

Threat name:

HawkEye MailPassView

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/407352

Signature

Binary contains a suspicious time stamp

Changes the view of files in windows explorer (hidden files and folders)

Detected HawkEye Rat

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM_3

Yara detected MailPassView

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69a34116377032442c113adb0490c641f4af86b04fb8a2027f094d3678674915/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-08-03 07:17:07 UTC

AV detection:

33 of 48 (68.75%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ngrucfrxoazeilarhlnqjeggih2k7bvqj64keat7bfgtm6dhjekq._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

emotet

agenttesla

Result

Malware family:

hawkeye

Score:

10/10

Tags:

spyware keylogger trojan stealer family:hawkeye

Link:

https://tria.ge/reports/200803-2s3wa8ct8s/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

Uses the VBS compiler for execution

HawkEye

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/69a34116377032442c113adb0490c641f4af86b04fb8a2027f094d3678674915

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Hawkeye Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect HawkEye in memory
Reference:	internal research

Rule name:	RAT_HawkEye Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
Description:	Detects HawkEye RAT
Reference:	http://malwareconfig.com/stats/HawkEye

Rule name:	win_hawkeye_keylogger_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_hawkeye_keylogger_w0 Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com