MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 705f4d7d22c1ee050c9a2120f89eb7a33df430ef12ecfac1fe630654af7496af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 705f4d7d22c1ee050c9a2120f89eb7a33df430ef12ecfac1fe630654af7496af
SHA3-384 hash: 9b5ab9270bb7086578e19ddc748759d928c02220f466c2af1d4627b0b704d7df2ff47d4d411b2b9349df2c9a244ba98b
SHA1 hash: d606b90bf859bf0e9d71e4b3604b8b69c88b8c54
MD5 hash: 7e417528865cd99fcac5cac2d3e185e4
humanhash: blossom-uncle-stairway-crazy
File name:Order05AUG2020.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:633'832 bytes
First seen:2020-08-05 16:06:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:LmS4MxqGiXlwlpzh1Jo4xlHIYH8ZchNXCvHE0Kya99V0vYRtGlpL:LmD1wlpVdvIYH8mEaycV0nnL
TLSH 57D4239681134DF5BD003FB0E9C83D05F0A52B0BBF85AFFD6E955B835BADE8848544A2
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: ns1.linux2020.dnsboot.com
Sending IP: 184.95.63.110
From: sales <support@delhicrimenationalnews.in>
Reply-To: dh_derhawk@126.com
Subject: Re:SPS-1726076
Attachment: Order05AUG2020.zip (contains "Order05AUG2020.exe")

HawkEye SMTP exfil server:
smtp.amargrand.mn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Strictor.247961.5681.1845.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/705f4d7d22c1ee050c9a2120f89eb7a33df430ef12ecfac1fe630654af7496af/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:05:25 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=obpu27jcyhxakde2eeqprhvxum67imhpclwpvqp6mmdfjl3us2xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/705f4d7d22c1ee050c9a2120f89eb7a33df430ef12ecfac1fe630654af7496af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 705f4d7d22c1ee050c9a2120f89eb7a33df430ef12ecfac1fe630654af7496af

(this sample)

HawkEye

Executable exe dc9ab0fc37303739eebdebf61ae10291db28738997267cdaf100f5c03f263c39

  
Dropping
MD5 038693f8466a14ba268a79978cbc8b7a
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc9ab0fc37303739eebdebf61ae10291db28738997267cdaf100f5c03f263c39

Comments