MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b21819aa25f7716bd28e647446b0f0e51b0b49f1b0d5f4e5dd71aff5bdd8ebe1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b21819aa25f7716bd28e647446b0f0e51b0b49f1b0d5f4e5dd71aff5bdd8ebe1
SHA3-384 hash: 6b0fcdbb094b2ee12c5ae9d0686c3462f1f86e0de3ad8ce263c129fd60baba2f0f48c7902561247ac63a54c961529d36
SHA1 hash: 2edf184ad1f44537f70c2e2de92dbdbd9718dcca
MD5 hash: 3fd5aad71c6022e2861a97039ed709b3
humanhash: speaker-pip-tennis-network
File name:Payment_Invoice 2.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:446'269 bytes
First seen:2020-06-10 11:28:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:1L0eMCR6kjUmNzC/OsJkDDXfAmjr2YQ96XmV9Sm6Q06E38:1L0eMrKXPfAAqP5Smr06EM
TLSH 5B9423DF1B44150A4DC816AA4BA2E9E5106D9FD9304F1F4648B9DE47E3CF063DA32B87
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: smtp01.govps.gr
Sending IP: 62.210.50.187
From: DAPCO Industries <dcrawford@dapcoind.com>
Reply-To: info.fun-kids@bk.ru
Subject: payment invoice
Attachment: Payment_Invoice 2.zip (contains "Payment_Invoice.exe")

HawkEye SMTP exfil server:
server165.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:30:07 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wimbtkrf65ywxuuomr2enmhq4unqwsprwdk7jzo5ogx7lpoy5pqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip b21819aa25f7716bd28e647446b0f0e51b0b49f1b0d5f4e5dd71aff5bdd8ebe1

(this sample)

HawkEye

Executable exe 60306f9591e8da938065fb47fbe4e9012c6d2d7dd4ac98b8adef4815a11980c8

  
Dropping
MD5 c65077d32b9636ada0f9382448181772
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60306f9591e8da938065fb47fbe4e9012c6d2d7dd4ac98b8adef4815a11980c8

Comments