MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bab8cb9cb9c4f6f7ecb91a398157080f17e2ab0178855f2ddc27b7b461a4f9bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bab8cb9cb9c4f6f7ecb91a398157080f17e2ab0178855f2ddc27b7b461a4f9bd
SHA3-384 hash: 10e294015611a9c7cdabe1a0e570d846ec88ff58f3edf69cb09a131a4433968b6b10b562a7c02d3c2a104fab105e8d68
SHA1 hash: bb51ebe5c28c53ccae90ddc0a3de8f041d0fdf38
MD5 hash: 403ccea48b2bd8a919c929218b98ad55
humanhash: cold-oregon-spaghetti-lima
File name:order14062020849992334.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:616'618 bytes
First seen:2020-06-14 13:27:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lRJUgDewcMD7CleMvP2JenQFr0a8KABfidCQRBgZYb8O:ygDewcKCl7n2wgrWKAZid9T98O
TLSH E3D423338F074D1977757A748F02E3636F8598A4229334B7FA869066E213DEB009F65D
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: shmx.tama5cci.or.jp
Sending IP: 60.32.68.163
From: Purchasing Manager <info@tama5cci.or.jp>
Reply-To: dh_derhawk@126.com
Subject: RE:RE:REF# 200816:C1090068 R21-441450
Attachment: order14062020849992334.zip (contains "order14062020849992334.exe")

HawkEye SMTP exfil server:
smtp.urban.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-14 13:29:04 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xk4mxhfzyt3pp3fzdi4ycvyib4l6fkybpccv6lo4e633iyne7g6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip bab8cb9cb9c4f6f7ecb91a398157080f17e2ab0178855f2ddc27b7b461a4f9bd

(this sample)

HawkEye

Executable exe e4b792f8d07c013c8dddeb023f23482518567b126c3ec51a07eecda4b26fc63b

  
Dropping
MD5 f75c9cd637f6b4be2f7f3a70015fb27d
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4b792f8d07c013c8dddeb023f23482518567b126c3ec51a07eecda4b26fc63b

Comments