MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b155a088a3efde25997ffb88b22c922c10ebf2bf1d696a0962b51d2762d80d6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b155a088a3efde25997ffb88b22c922c10ebf2bf1d696a0962b51d2762d80d6e
SHA3-384 hash: 8040b3d70084c28b7733f9b69c768f668077a0b3e86d5787aa6fa301d65587f1005844aa822b22864a1e262cf3d3eaa6
SHA1 hash: f62905303254ee33e95c3fdf94e02aa7735caa73
MD5 hash: 1ce617bf084b0f2a7d579e7e87630777
humanhash: lithium-quebec-october-don
File name:order23JUN2020.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:607'527 bytes
First seen:2020-06-23 14:19:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:jXRAFfkfGFkazs3CuUNjjjtlzmv/6qUPHbXOy/iFIdHm:b+FfkfGFkGc8njivCHbXGYm
TLSH FCD4231A26CAEE5F178BE3F5FD24DB623EE0950510D59C11E2630F802D19EF5A87EA0C
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: www.lazzeri.com
Sending IP: 82.184.89.138
From: Purchasing Manager <info@lazzeri.com>
Reply-To: dh_derhawk@126.com
Subject: RE:New Order:723 4143300723+7418200723
Attachment: order23JUN2020.zip (contains "order23JUN2020.exe")

HawkEye SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Injector.EMJE.10043.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b155a088a3efde25997ffb88b22c922c10ebf2bf1d696a0962b51d2762d80d6e/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 14:21:04 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfk2bcfd57pclgl77oelelesfqiox4v7dvuwuclcwuosoywybvxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip b155a088a3efde25997ffb88b22c922c10ebf2bf1d696a0962b51d2762d80d6e

(this sample)

HawkEye

Executable exe 84684c3af14bee4d80ffe6ef27ac50f3e36d94212019810e4aed70fe0717c098

  
Dropping
MD5 6f1b4ffd2a6821f71d6e0ddc22eb96c6
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84684c3af14bee4d80ffe6ef27ac50f3e36d94212019810e4aed70fe0717c098

Comments