MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8e23232e61f541ff025a8cee736579b1a4399e85326cfd475de1f9a5ce1e7f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8e23232e61f541ff025a8cee736579b1a4399e85326cfd475de1f9a5ce1e7f9
SHA3-384 hash: 69f7e760554609b22024587507873f06602cd0f645abdda3e11cef78ddad7ac4c1a9e290d8690ae7abd63ce0c4ba6442
SHA1 hash: 5f140e9986470a15bddb1e9d4d2450dd3ec1bd60
MD5 hash: bc7356c00434eb0d70e36629cb73ed2c
humanhash: red-pennsylvania-fish-mississippi
File name:RFQ-ELCKSEL2007.rar
Download: download sample
Signature HawkEye
Create hunting rule
File size:631'232 bytes
First seen:2020-08-06 05:46:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:W39BwO1qTxx7C9spEXXhWytEsjKN6odXV2XszFdUojJqTIt5ec0s:A67UspEhtEoKFV2KdtjJqw7
TLSH 88D423B786E8EA44D0CF2D5916206FE1F346F4D6A787EB30C3A6869D74398C506BA530
Reporter abuse_ch
Tags:HawkEye rar


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: gmail.com
Sending IP: 81.171.9.143
From: 조미선(Cho Misun) <chomi0605@panpacific.co.kr>
Reply-To: BBI <surnit9041@gmail.com>
Subject: VESSEL B/L NO : ELCKSEL20070292 SHIPPING DOC
Attachment: RFQ-ELCKSEL2007.rar (contains "RFQ-ELCKSEL2007.exe")

HawkEye SMTP exfil server:
mail.grandinnabalibeach.com:587

HawkEye SMTP exfil email address:
purchasing@grandinnabalibeach.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8e23232e61f541ff025a8cee736579b1a4399e85326cfd475de1f9a5ce1e7f9/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:48:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5drdemxgd5kb74bfvdhoonsxtmnehgpikmtm7vdv3ypzuxhb474q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e8e23232e61f541ff025a8cee736579b1a4399e85326cfd475de1f9a5ce1e7f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

rar e8e23232e61f541ff025a8cee736579b1a4399e85326cfd475de1f9a5ce1e7f9

(this sample)

HawkEye

Executable exe 5ef4854ae64579b17c0bec988ba62658ed442c8a174c1648531d9ba2748c9a97

  
Dropping
MD5 b5733570aee4cb1675ed9c36e672ddb5
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ef4854ae64579b17c0bec988ba62658ed442c8a174c1648531d9ba2748c9a97

Comments