MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8da26b7be8c1f1b3f3dbc9a21373a34ebc49dad60dadb73e2778d0a7da44ed42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8da26b7be8c1f1b3f3dbc9a21373a34ebc49dad60dadb73e2778d0a7da44ed42
SHA3-384 hash: 4865d50566187ca53e1b4db5b77833f58f18ebe8fe7286a9f6662037d9f2a1be753328d442e131ea93cd74df3b6277b5
SHA1 hash: 75d15919d95ebc8cebd702aba3f0e3f9178bef0e
MD5 hash: 8ee5fe266636da4b3738e5d34a52c20e
humanhash: glucose-solar-spaghetti-bluebird
File name:Payment Invoice.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:347'269 bytes
First seen:2020-07-06 14:43:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:yMMdKJtA2FX9Tdelg9VOnjB5eFJPMuzAEnWdPi0tZ5zJQNpBZP3CHB6Jf1YRXAgw:yMT5FXYg9VONUVM3dPjfQTZ8B65SRXlI
TLSH 1E74239A8094551EC6F581D2E2618B1276F4CB69A0B8F8D4AC07DCED40BFB3F3294679
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: jt.com.pk
Sending IP: 23.83.133.76
From: Account Manager <muzammil@jt.com.pk>
Subject: Payment Invoice For Outstanding Bills
Attachment: Payment Invoice.zip (contains "Payment Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Daqc-6598201-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.24749.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8da26b7be8c1f1b3f3dbc9a21373a34ebc49dad60dadb73e2778d0a7da44ed42/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 14:45:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwrgw67iyhy3h463zgrbg45dj26etwwwbww3oprhpdikpwse5vba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 8da26b7be8c1f1b3f3dbc9a21373a34ebc49dad60dadb73e2778d0a7da44ed42

(this sample)

HawkEye

Executable exe 1fc0b64aa5ad4ffdfdd207d5d59dfe238ab1573b793d6da0dca9df7918fdad9e

  
Dropping
MD5 0c4e6ebcece5432054684398a8396f56
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1fc0b64aa5ad4ffdfdd207d5d59dfe238ab1573b793d6da0dca9df7918fdad9e

Comments