MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8586674bc6f4935993150280951e26478bc6e5dd8db231f650e852552a9c288e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8586674bc6f4935993150280951e26478bc6e5dd8db231f650e852552a9c288e
SHA3-384 hash: 782c89dad944905173e47d47a9887a2707058a6142ba8181620444a0b6e37b3d7d0499b7d420c9cf44312f35b076a688
SHA1 hash: 9dad68be31f2e20e5a4f820a5ee22bd0dd399744
MD5 hash: e0e1c5fb91af0bcd6bf886ba8b378fe5
humanhash: sweet-video-mississippi-pip
File name:Prueba de pago.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:691'584 bytes
First seen:2020-11-18 12:13:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:8bPR9jXnirS7DOpG9ngv1JbZdCWCxOBq7bahyDg6o3dlTTaqKsYqNKnTEt+:8TjXnLeY9n81crsos5nTTatToI
TLSH 02E4230105CF80552C2333D14C7F51EABAA824DACB87EB5513E879996D2B58FF9FD882
Reporter abuse_ch
Tags:ESP geo HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: vh261.sweb.ru
Sending IP: 77.222.61.137
From: Javier Garcia <support@tg-logistics.kz>
Reply-To: dh_derhawk@126.com
Subject: justificante de la transferencia
Attachment: Prueba de pago.zip (contains "Prueba de pago.exe")

HawkEye SMTP exfil server:
smtp.jif-asesores.com:587

HawkEye SMTP exfil email address:
administracion@jif-asesores.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Fareit.bh.12664.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8586674bc6f4935993150280951e26478bc6e5dd8db231f650e852552a9c288e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:14:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwdgos6g6sjvteyvakajkhrgi6f4nzo5rwzdd5sq5bjfkku4fcha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 8586674bc6f4935993150280951e26478bc6e5dd8db231f650e852552a9c288e

(this sample)

HawkEye

Executable exe 286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

  
Dropping
MD5 b3a244a097904a4d6689a582d7ec9985
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

Comments