MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
SHA3-384 hash: 0b769c807614ef01c85b94ab0cfd7453af7b797454bced09d04b4bfcb07a486ecf9b32d88cd568c6d41a04a96e8976a8
SHA1 hash: df3cc344a71e5bf855e3bc97b8848eb2daaf8afc
MD5 hash: 9b6b4686d55afe1479011ee77b5ffb24
humanhash: fish-black-california-mars
File name:LisectAVT_2403002B_386.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:538'624 bytes
First seen:2024-07-25 01:20:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:tUiQnjozy4J/aA/z+DNZFFQ6yunCjo3QkFLcnhpSVfBPp9bJ:yrrstr+JFQ6jFAS
TLSH T165B42259B26631DFDD47CC319FEA9D947E10A0BB53078B53A86710EC981E09ACF885B3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Anonymous
Tags:exe HawkEye


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILZilla.13978.15244.11084.UNOFFICIAL
Create hunting rule

Win.Dropper.Nanocore-10029186-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Restart of the analyzed sample
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Reading critical registry keys
Stealing user critical data
Enabling autorun
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed razy threat
Link:
https://www.filescan.io/uploads/66a1a88b4c5c17942a7d39d8/reports/93e73f58-94e1-4a78-b4cc-01db34719a19/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
dotRunpeX
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b94b8547-b9a0-43a0-81e5-bd51998d15fa
Result
Threat name:
HawkEye, MailPassView
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1481728
Behaviour
Behavior Graph:
n/a
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646/
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2018-11-30 00:30:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
30 of 38 (78.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ybey26tq46gcgysb2durwo5vthazmhvgfiil25vbn7t3dcbe6zda._file
Verdict:
malicious
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:hawkeye_reborn family:m00nd3v_logger collection credential_access discovery infostealer keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/240725-bqqsmszakr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Uses the VBS compiler for execution
Credentials from Password Stores: Credentials from Web Browsers
Detected Nirsoft tools
M00nD3v Logger payload
NirSoft MailPassView
NirSoft WebBrowserPassView
HawkEye Reborn
M00nd3v_Logger
Modifies WinLogon for persistence
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/db7cee69-0374-4388-a742-810266005a0d
Unpacked files
SH256 hash:
54c39ec66c7b3abc097343d81496deda1d41299f321abe7af9797fdd9e9ca922
MD5 hash:
479d634b8cdc46beddfcb661074c0b5b
SHA1 hash:
7f372306cf0993805f47811c5a9eedff623a5a93
Detections:
win_hawkeye_keylogger_auto
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Link:
https://www.unpac.me/results/853ec908-5f66-45ab-a559-be8691c0b5df/
Parent samples :
6810169d25d00430652e3ee482cfd4a9f84318dff9500153ff5612c3bffc5312
14396bfa106633749adc71005e510fa870dd635d0f1465775d56939b8fabc895
6e576c6aee1a0e3adf5e36c0ae52d1eda0ec0171fe8163bb0983f62a0e23c0da
e773f60aeb241f884b4f932d7ddd4e31c87f31781d5bd53d8583b3d54807a449
fa38ec9464602a1727813004fc616d9d0359c37da01b7d07c3e38784c0b2a46d
de1730eddefee2b8d8193d92b02fc5a3fd1bf6d54c6f55eff53c85c8a2501a79
691cb999c6be0f430c14a9411abf6796f174c8d8f3c3edc4b819b3b35972d832
0a0e7c81912b02e6ec1c7fbb338f4ef200e23d441d57c692cc88fef616593f0d
752efe9ad078a9be4a82b6f7c2123d58c90a1456287390b50df9e9c3292bc490
70ef3c88a90dd590de9a0ac4634b5017f35ea6dedec14f3cc3b5d9eeb3ca84a2
fa228078490ab490d0990eade1bf3900837b83db09ac9b245d932106ba565e48
c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
c2d23332a28fd0f2f0b404e53d9820ba0f5f8070043cfa0b2fbb18a4a33466b6
SH256 hash:
400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342
MD5 hash:
54e8ded7b148a13d3363ac7b33f6eb06
SHA1 hash:
63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9
Detections:
APT_NK_BabyShark_KimJoingRAT_Apr19_1
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Link:
https://www.unpac.me/results/853ec908-5f66-45ab-a559-be8691c0b5df/
Parent samples :
e6b3160e17f1c4c0ce9136d7e19089f9e7e759bbd2989c27f8eb6083a627bfb9
c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
c2d23332a28fd0f2f0b404e53d9820ba0f5f8070043cfa0b2fbb18a4a33466b6
SH256 hash:
b1bd95a4d9f705ada3c4ffa5f4b952c31ae3bcfcaa6ab950059f9db9d347baca
MD5 hash:
c0ba1fa93483b391296eaeb3a16dccf4
SHA1 hash:
0839a6f2cb40b0c8f577daaa2bbb83797da8774d
Detections:
win_hawkeye_keylogger_auto
Create hunting rule
APT_NK_BabyShark_KimJoingRAT_Apr19_1
Create hunting rule
Link:
https://www.unpac.me/results/853ec908-5f66-45ab-a559-be8691c0b5df/
SH256 hash:
65194741d7bda17ad0692657bf4d19f75160b10ead3ffe5ff381a60e6bfb5124
MD5 hash:
6e5d5bbaccc0add75f26a156499fb4e8
SHA1 hash:
69c0dbc25f96e64ab50e329703fd38da73ea0f40
Detections:
win_hawkeye_keylogger_g0
Create hunting rule
MAL_HawkEye_Keylogger_Gen_Dec18
Create hunting rule
SUSP_NET_NAME_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/853ec908-5f66-45ab-a559-be8691c0b5df/
SH256 hash:
457e467d5fa643aafd4c1edb99a1bc09726e74e309f974e34b1e5472cbccda5e
MD5 hash:
c8519217a4476b415ad5b1c53e4455d3
SHA1 hash:
1f3f3b68c11d5c422543699960f4509b33ee4cad
Link:
https://www.unpac.me/results/853ec908-5f66-45ab-a559-be8691c0b5df/
SH256 hash:
c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
MD5 hash:
9b6b4686d55afe1479011ee77b5ffb24
SHA1 hash:
df3cc344a71e5bf855e3bc97b8848eb2daaf8afc
Link:
https://www.unpac.me/results/853ec908-5f66-45ab-a559-be8691c0b5df/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

Executable exe c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments