MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7811b918425d1f25e70ad188f0581b3bacb1fb44c97a8ca84b99bab4e8a445f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7811b918425d1f25e70ad188f0581b3bacb1fb44c97a8ca84b99bab4e8a445f4
SHA3-384 hash: 7a38dc92a3f3f2892d882b50dc6579fefc5817d003ffe8cc1dddfe6a26365cd7611e0a25baf771e4d429e55febc9f1d2
SHA1 hash: 75733fd5c26dea9b18f109c4013c3c3a84b7529d
MD5 hash: 36de7fba7d2fd68a1599cd35be60d951
humanhash: victor-eighteen-double-carolina
File name:Scan-0581110_pdf.gz.r15
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'324'581 bytes
First seen:2020-05-26 11:15:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:BaVMKS94ei7PKX0lcJrOvDqWCWedX6W24iCpEQhgaOGxu5X3lH5EPhN:vt94ei7PKEOJrIRm2ZQOGxuRl+pN
TLSH 30553306D4F920CD23B9624B33AA68BE37C5145436CA745B6DF3CE331EDEA4CB599848
Reporter abuse_ch
Tags:HawkEye r15


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Kent Trung <sargo@cyber.net.pk>
Subject: Re: Re: Proforma invoice- Ex Factory shipment
Attachment: Scan-0581110_pdf.gz.r15 (contains "Scan-0581110_pdf.gz.exe")

HawkEye SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:36:59 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

rar 7811b918425d1f25e70ad188f0581b3bacb1fb44c97a8ca84b99bab4e8a445f4

(this sample)

HawkEye

Executable exe a659e8747ad30e259bde611723fd8b6fc9b040c7cc1a4524b21f6ac1c15e757b

  
Dropping
MD5 b957faac8f23c005064e42c345c73d58
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a659e8747ad30e259bde611723fd8b6fc9b040c7cc1a4524b21f6ac1c15e757b

Comments