MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e752b9e82cf916b508be1dfbd2b4b27d51493c651afc1b09f2dd3169d192fe1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e752b9e82cf916b508be1dfbd2b4b27d51493c651afc1b09f2dd3169d192fe1b
SHA3-384 hash: 171bf8c564ba6c30cde46ffa15c41515e1744412f0a6f728494291a49165b9a35ef13a8bf3ee3e6371577bb136f84d17
SHA1 hash: 883808435ba5bb4df19bbe32fe445eac7413eebc
MD5 hash: de9ec360ea44f1ff632608195a1486b0
humanhash: montana-wolfram-quebec-speaker
File name:TT Swift Copy Pdf.r02
Download: download sample
Signature HawkEye
Create hunting rule
File size:866'818 bytes
First seen:2020-10-19 18:14:51 UTC
Last seen:Never
File type: r02
MIME type:application/x-rar
ssdeep 24576:mkVLafqYFScTZmOnXoVMrN5oY5iiGe4It:mkVuyknqMn3ZeIt
TLSH 350533A23415A642E03092148D8F2BF7B9C3976750A8A516FB8389464F7C7F152FBF4E
Reporter abuse_ch
Tags:HawkEye r02


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: vn.sanfang.com
Sending IP: 78.29.13.106
From: RoyHsieh <royhsieh@vn.sanfang.com>
Subject: TT COPY FOR NEW RREQUIREMENT
Attachment: TT Swift Copy Pdf.r02 (contains "TT Swift Copy.exe")

HawkEye SMTP exfil server:
webmail.essentialhc.com.pk:587

HawkEye SMTP exfil email address:
abdul.samad@essentialhc.com.pk

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e752b9e82cf916b508be1dfbd2b4b27d51493c651afc1b09f2dd3169d192fe1b/
Threat name:
ByteCode-MSIL.Trojan.Golroted
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 10:18:00 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=45jlt2bm7ellkcf6dx55fnfspviuspdfdl6bwcps3uywtums7ynq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e752b9e82cf916b508be1dfbd2b4b27d51493c651afc1b09f2dd3169d192fe1b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

r02 e752b9e82cf916b508be1dfbd2b4b27d51493c651afc1b09f2dd3169d192fe1b

(this sample)

HawkEye

Executable exe d34bf3220c17f2188a05d855c4e5f0501ebe86407daceaa9879ef3bcefc97b12

  
Dropping
MD5 06a3e8506a5c2a41e0d8b6ffbb725e9a
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d34bf3220c17f2188a05d855c4e5f0501ebe86407daceaa9879ef3bcefc97b12

Comments