MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af1ea2edcd0d71efbfecbe325b9660fdd6443a2758041414fa80848aa5746bb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af1ea2edcd0d71efbfecbe325b9660fdd6443a2758041414fa80848aa5746bb8
SHA3-384 hash: 52dfb21de828e0f3659d6e9769a4cf93d98a2405a31bbadf4f8e4c59347a47f12096d617b76d019009a07fa1abfa7644
SHA1 hash: e8da9a210e271a7af7342fc8b24dd61c5ead999a
MD5 hash: aab62d8a811dd4239f26bc0b7e30a9c1
humanhash: nuts-mobile-stairway-lamp
File name:Payment_Invoice.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:465'932 bytes
First seen:2020-06-29 06:16:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:XdH8PMSAQ/WtUyok0L8f9GjWqfWCJtg49cr:XF8zB/WtUyo7QFoWIWv6+
TLSH B5A4236C99C09A86EA745188EB794FFAB44B246B8FFF2007D1D8985FA2C8DC3545C1C7
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: linux687.grserver.gr
Sending IP: 185.4.133.224
From: saless@compuparts.gr
Subject: payment
Attachment: Payment_Invoice.zip (contains "Payment_Invoice.exe")

HawkEye SMTP exfil server:
server165.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43405634.18994.21873.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af1ea2edcd0d71efbfecbe325b9660fdd6443a2758041414fa80848aa5746bb8/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 02:24:14 UTC
AV detection:
32 of 47 (68.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v4pkf3onbvy67p7mxyzfxfta7xleiorhlacbifh2qccivjluno4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip af1ea2edcd0d71efbfecbe325b9660fdd6443a2758041414fa80848aa5746bb8

(this sample)

HawkEye

Executable exe 57f92b82742c44d3cac1bbf93e85e498e52f2ce132a79bcb00bb3bbf54b5db65

  
Dropping
MD5 143796f4d423aaedec93525c123b2f0b
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 57f92b82742c44d3cac1bbf93e85e498e52f2ce132a79bcb00bb3bbf54b5db65

Comments