MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5f7a373a147db05add8328daa7b72b673b31fef87a1a19a6229d580e5196fe0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5f7a373a147db05add8328daa7b72b673b31fef87a1a19a6229d580e5196fe0
SHA3-384 hash: 0d86c0928a84c85087bd8559533d46dfa2eedbbd2577b2cbfefa0d9011552e33118213b45dad7c20fca0968fc34a8eac
SHA1 hash: 0b2d255da5da17e0555068ec2ea5e1cf363bdb16
MD5 hash: 149f7a0d7ef8a8bf5163ee6effe34319
humanhash: ten-three-crazy-july
File name:NewOrder06102020.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:637'261 bytes
First seen:2020-10-06 17:55:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BcI02JXeb9sHdEhu+XWf6w82EWOHWhiP95TmgXT+7Ywc7vG6+i:Bx02tg2Gtok3Prmgj+7Yn7vG6b
TLSH C0D423E0C466E6F8FDD0A8E28964481A53C4E58E219D36A0C8D978FA4F9141DFDFC74B
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: mgit.mgit.me
Sending IP: 198.57.188.152
From: import <junu@archtsqatar.com>
Reply-To: dh_derhawk@126.com
Subject: Re: EMTB20036500 - S/Ref. INV:28
Attachment: NewOrder06102020.zip (contains "NewOrder06102020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5f7a373a147db05add8328daa7b72b673b31fef87a1a19a6229d580e5196fe0/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 16:48:41 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yx32g45bi7nqlloygkg2u63swzz3gh7pq6q2dgtcfhkybzizn7qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5f7a373a147db05add8328daa7b72b673b31fef87a1a19a6229d580e5196fe0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip c5f7a373a147db05add8328daa7b72b673b31fef87a1a19a6229d580e5196fe0

(this sample)

HawkEye

Executable exe a5d15462095a7f777fdde180102962b84cda21f0312f7efbc0bfe67c9c7775bb

  
Dropping
MD5 ac320db9dcaa30284f580e92092e852b
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5d15462095a7f777fdde180102962b84cda21f0312f7efbc0bfe67c9c7775bb

Comments