MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c62b9a0f4baad6949a7a10f691296949b66408476838d4f8132753ffc2ee9a95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c62b9a0f4baad6949a7a10f691296949b66408476838d4f8132753ffc2ee9a95
SHA3-384 hash: 371182ff1988c6328e0a0526b550bcbde98bc3aa239d3f13ae89e6a505b87c84964da9464f8a723d57385bb4153b225c
SHA1 hash: ad52f1fa7dcf3ac986cde032477f68cbc2fae5d6
MD5 hash: d0f28f48ce8ef99834a93c98665b4175
humanhash: tennessee-north-triple-robin
File name:Spedizione.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:471'643 bytes
First seen:2020-08-04 15:15:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zkvGsda70SHZpVhrrWDHxONglgCRhvBBDCybAFYooPxqNpbo:zYGEagaaENgeCRhvHDDaToPGS
TLSH 24A42367A00379EC3FA56DB0C45497A123F5330BCAA73D813DEA90572EAEC6FB194184
Reporter abuse_ch
Tags:DHL geo HawkEye ITA zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: luna.raxa.host
Sending IP: 169.61.59.131
From: SERVIZIO DI CONSEGNA DHL <lilia@clabeck.com>
Reply-To: shipping@dhl.com
Subject: dettagli di spedizione
Attachment: Spedizione.zip (contains "Spedizione.exe")

HawkEye SMTP exfil server:
server165.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Barys.54078.14481.23631.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c62b9a0f4baad6949a7a10f691296949b66408476838d4f8132753ffc2ee9a95/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 15:17:04 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yyvzud2lvlljjgt2cd3jckljjg3gicchna4nj6ate5j77qxotkkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Barys
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c62b9a0f4baad6949a7a10f691296949b66408476838d4f8132753ffc2ee9a95

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip c62b9a0f4baad6949a7a10f691296949b66408476838d4f8132753ffc2ee9a95

(this sample)

HawkEye

Executable exe a4d6c0a909365bd89fdf812fbb75f92edc06fcd2a9a7b3c6d9b553ffe124858f

  
Dropping
MD5 b599bd2ef331c165a003de2bfcd397ad
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4d6c0a909365bd89fdf812fbb75f92edc06fcd2a9a7b3c6d9b553ffe124858f

Comments