MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9db7dfb26daaf27cc5c2e501b947771ad1156f7eb02f8b238ebd1cac04aa487e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9db7dfb26daaf27cc5c2e501b947771ad1156f7eb02f8b238ebd1cac04aa487e
SHA3-384 hash: 1d88489b8cd7c6ad6771ffe18175dea931eab49e271a2f88d6b773a38abcf1cd24b199589dc442bca668b77cef376218
SHA1 hash: 68c27beca76aa08793222b5b57ca536469bdbfd9
MD5 hash: 380d6e3b0fb232e21d445e7b8c4638b5
humanhash: autumn-kentucky-twelve-bulldog
File name:RFQ 2.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:746'340 bytes
First seen:2020-10-09 05:53:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:pShRKFkAm+/TDrPsHDQSVKONRtDAKkMU9dvCY/HfWOeB5yrPV:p3m+/HrPsHVKkR1A9pCYuB5yrN
TLSH FFF433A4EAD4992E784385CA04F3E8D293469A1453B9FCF0CEEC6A855574F6CFC8B071
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: ESSAR.COM
Sending IP: 107.173.40.220
From: ROBIN KEDIR<INFO@ESSAR.COM>
Subject: RE: RFQ for supply of Piping Fittings oil and maritime equipments as attached.
Attachment: RFQ 2.zip (contains "RFQ (2).exe")

HawkEye SMTP exfil server:
mail.eagleeyeapparels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9db7dfb26daaf27cc5c2e501b947771ad1156f7eb02f8b238ebd1cac04aa487e/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 00:41:14 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tw357mtnvlzhzroc4ua3sr3xdlirk336waxywi4oxuokybfkjb7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9db7dfb26daaf27cc5c2e501b947771ad1156f7eb02f8b238ebd1cac04aa487e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 9db7dfb26daaf27cc5c2e501b947771ad1156f7eb02f8b238ebd1cac04aa487e

(this sample)

HawkEye

Executable exe c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513

  
Dropping
MD5 491b5032691babc841e83246767aa5be
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513

Comments