MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e
SHA3-384 hash: 3844e8fbda6a17ba71a72da4f09d34e497f194033b06c300bf734888c9c90b62e8ba257b18953507082c4c365190abe3
SHA1 hash: d7a20e48d6cbee4103c3a25ca3fbbceef97cd42a
MD5 hash: ec469e44b717bb5c6f45c1d959985453
humanhash: lithium-sink-mobile-finch
File name:ORDER2020Aug05.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:630'881 bytes
First seen:2020-08-06 05:06:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:vDm3ZQDxKSlZt65suhUJPHBslkJUzmaYy2PTpX5oMmoeCU7NQJFN2D4vnplygGbI:vy2tuhGslHzmHPfoMmh17KJFN2D4vR
TLSH 07D4237D20DEA70EA6ED10DA84CAA81C3E1994BFE583A7B761CC9CBC203279D4546D15
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: bolutech.com
Sending IP: 49.85.226.116
From: Sales-48 <sales@bolutech.com>
Reply-To: dh_derhawk@126.com
Subject: Re:SPS-1726076
Attachment: ORDER2020Aug05.zip (contains "ORDER2020Aug05.exe")

HawkEye SMTP exfil server:
smtp.amargrand.mn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Strictor.247961.5681.1845.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:08:07 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v4ittdp3tbbfbbwxumh7tg5r5hltb6m2kj4ixkx35hyqyoyuvmxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip af11398dfb98425086d7a30ff99bb1e9d730f99a52788baafbe9f10c3b14ab2e

(this sample)

HawkEye

Executable exe 2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c

  
Dropping
MD5 6d7c69d1cb5ac9121f0a1097da2803d0
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f8712c8fe6a8c5cfb5edbe44c6e57d17fd112997a831f1b426e3a765031510c

Comments