MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c085fbaacb5db264b06e40480126208b2ff797317a2062e6ba69da405a094951. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c085fbaacb5db264b06e40480126208b2ff797317a2062e6ba69da405a094951
SHA3-384 hash: 3c4bfede8da4e70f08121d8aae3d46ca9dfebfdb5a15b02e733a6400c74823895aa77c810224c0715e78ed75403cb79c
SHA1 hash: 5d15efe990589bebb276aa276ece055d1f6d4434
MD5 hash: 0b81236e011eb2d41c3b22894154edd1
humanhash: glucose-harry-nuts-alanine
File name:de58481e5ed2f1b98c48c6e85e41039e.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:532'992 bytes
First seen:2020-03-26 15:39:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 6144:luEqqN0HbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9C:d0HQtqB5urTIoYWBQk1E+VF9mOx99i
Threatray 475 similar samples on MalwareBazaar
TLSH 81B49D03B3D14436D4FF0631677757729BBABE301632C91B87E818896E76291BA36387
Reporter abuse_ch
Tags:exe GuLoader HawkEye


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1J-FH5u5I_bxPzcvffAkM2H4JeuvvsuSk

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Passwordstealera-6765350-0
Create hunting rule

Win.Virus.Sality-6832669-0
Create hunting rule

Win.Packed.Pswtool-6840731-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Golroted
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:37:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
57
AV detection:
42 of 47 (89.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycc7xkwllwzgjmdoibeacjrarmx7pfzrpiqgfzv2nhneawqjjfiq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
067fe961b8467627e2de7b7f1553b6e48b53c54fd65d18014fc3f3cc4660a9d3
HawkEye
18b5e8b21a0feba19538fd26046557f1b5ae22e93cf99adb92122254b8c72f3e
HawkEye
2be5f97b6c1e1a59e9e19b41de55ab517fcd423773ae51b3b4cd18bc0dbcd037
HawkEye
648c45f4fd75ed8f4cd95520ea62803e7ee475daec97c217886c8f06fb1da0c6
HawkEye
68101d145825fc980210f1f56638011d98eeaf5c53fb734b62a80dac6489f2e3
HawkEye
7e6dc9928e049d75cd726d8542b39cf46afef0cfd37c8dcb968ea618aedbb696
HawkEye
81bee8d418f47ecd30fee01140fa79cf8f5b0851e314c0b795ed5afdc0228395
HawkEye
a2966a3e5a7753ea245a9e5228cf96d631e15a3777a5b2550724bed0f646784a
HawkEye
ba4b2f524b82bec30f74540c124034b082a275b83a94c20ccede668f83f05a0f
HawkEye
da2e87ff6e505f0e64c3804f5355d693d9fd69e71916812f75bcd43b6cd445ec
HawkEye
+ 465 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

GuLoader

Executable exe f84e6e22fd9d11dc942218f7efd0e3215b92ca5a05c33cd06c89f2b58372e3d0

HawkEye

Executable exe c085fbaacb5db264b06e40480126208b2ff797317a2062e6ba69da405a094951

(this sample)

  
Dropped by
MD5 de58481e5ed2f1b98c48c6e85e41039e
  
Dropped by
MD5 2fb235097616d46f7bd86832e340b469
  
Dropped by
GuLoader
  
Dropped by
SHA256 f84e6e22fd9d11dc942218f7efd0e3215b92ca5a05c33cd06c89f2b58372e3d0
  
Dropped by
SHA256 17a0e65b0ff31eec399960a35d42c94dbd032e9eac904d039741f77effb2178b
  
URLhaus
https://urlhaus.abuse.ch/url/328888/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments