MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebf11ac3c1c7cbdd7667977fce006d85ff89ff49182a9ac4b3ebd27057b99d89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebf11ac3c1c7cbdd7667977fce006d85ff89ff49182a9ac4b3ebd27057b99d89
SHA3-384 hash: 3fb0c75d6548c9424c2db206a5e458fae7747adaa07819c6f857e7184c0f0aee8f05c80147e02f70856597fd74f49d58
SHA1 hash: ed8e2ebe4ae21a41b995bf82e25169a2f52b9ce3
MD5 hash: 3c0ee822bd8279a7ceb81563b70d3011
humanhash: stairway-three-paris-ack
File name:PAYMENT DETAILS.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:580'919 bytes
First seen:2020-06-02 07:06:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:r2LqmkT+VYujMx2w0ldZy/Egpngmgx4L80h0RakHsApWKcO:rCqVIJjMj2dpqgmgOryHdIKn
TLSH 13C423FE03065A889E41AF4D5274C0B2A8B3D15FCAFA7F95A30A367E5607934D13B487
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: ded4519.inmotionhosting.com
Sending IP: 192.249.120.191
From: comercial@grupo-vision.com
Subject: payment
Attachment: PAYMENT DETAILS.zip (contains "PAYMENT DETAILS.exe")

HawkEye SMTP exfil server:
server165.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 07:37:03 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pyrvq6by7f525ths5744adnqx7yt72jdavjvrft5pjhav5ztweq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip ebf11ac3c1c7cbdd7667977fce006d85ff89ff49182a9ac4b3ebd27057b99d89

(this sample)

HawkEye

Executable exe e1bf95bd96a59075ac24eec7c47b3142361ea79c1fb68e2b6039212fba523449

  
Dropping
MD5 b9d953083a5b1006d5632d82c7a01d8d
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1bf95bd96a59075ac24eec7c47b3142361ea79c1fb68e2b6039212fba523449

Comments