MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03
SHA3-384 hash: 124e316341db93b5a675585dee6b3c53ffce4af0563d19de215cb089530da50524af88f15136f42d76bdd7394e77d1b3
SHA1 hash: 980d137b47dc5664a1a8a134b0030e4e79489408
MD5 hash: d2c03864dcf6003537851a411452464d
humanhash: connecticut-queen-ten-september
File name:tool.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:867'840 bytes
First seen:2020-04-10 15:38:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e0d4c6e04dd72cdba2ee496954fbe0a6 (2 x Loki, 2 x AgentTesla, 1 x FormBook)
ssdeep 12288:PyVwhFSGiJ6d7wTlqq0ymhTdst6l8YesE+HMsJUHLxwVJ4D/cBLgP:6GKX6d7Lq2h5HRE+HMseHLGkUG
Threatray 764 similar samples on MalwareBazaar
TLSH DF058D32F2D65433D5732A7C9D2B67A4992ABE013D28988A3FF41C4C4F3964179352E7
Reporter James_inthe_box
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.BBFB.UNOFFICIAL
Create hunting rule

Win.Dropper.LokiBot-7662731-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-09 15:54:37 UTC
File Type:
PE (Exe)
Extracted files:
62
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
azorult
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1433b4d3248aed590bdbc1295cc755490176aa3c300d1c56373736272ddd8dcb
HawkEye
17f254df13906b735315c9a4377b950ba059eff2636ce4a710af5dd3a1ea4535
HawkEye
1abd6deadaaa0e8386b1df2aeceacf637894adcb1d42762d1b141bcde569bc6f
HawkEye
4343e77b4710f4ea72e445b733076ba3495be7f1c94b88d73ff70b6f03711c3e
HawkEye
6b03acf7658af95975077de9cb4b5acaac1d2ed23f0c419ea13f39d25387bdce
HawkEye
7f29131cb5f28ccbd60dbdf39b6b3c79a974d4a3950aac1d1c0f7edd68193c03
HawkEye
7f62e5e2d0cfbe0740718588465b71a701fe3e188a8a4755baacbdc6fb41d52c
HawkEye
9c83b050047ab4b9ca6c23e46b7d77ffc9c5207cc5981aac77c6c392abb7aff9
HawkEye
b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8
HawkEye
cb5c24e649bfdd00c9d03e8c16dfda3f1101fb531b94fd57922339a12e22a0d6
HawkEye
+ 754 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments