MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec7398900295d52aae5d2756cb459df7e4835f4973b2f8c636393285aa1a5320. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec7398900295d52aae5d2756cb459df7e4835f4973b2f8c636393285aa1a5320
SHA3-384 hash: c385a2ae7f9026dd48eab818b343d17154aeb722e02ebde8225a6384427a2544842f62aaf1de7d3cf31fd62d483a1330
SHA1 hash: af0d60332c453362e35964af6d39bb88cea6228a
MD5 hash: 6aed911c2c4dec9fac5c36799e6635bc
humanhash: zulu-iowa-missouri-lithium
File name:AMSONS BROCHURE.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:409'139 bytes
First seen:2020-05-04 20:53:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:IwXTNIK7V6PCRnUOne7L2VsDkMFixjexroP:IiTF7VZZCLSswMFixkroP
TLSH 68942339A0139DD8BBF16B237A4B60965BCD50895EF54EE06CE1823D3227F9C0E9EC50
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: shark.dnsracks.com
Sending IP: 69.175.7.173
From: AMSONS metal products coating LLC <Sales@amsons.ae> <info@conceptgroups.com>
Reply-To: info@conceptgroups.com
Subject: INTRODUCTION - ELECTROPLATING & METAL COATING
Attachment: AMSONS BROCHURE.zip (contains "AMSONS BROCHURE.pif")

HawkEye SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44270.18099.16188.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 21:37:11 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5rzzreacsxksvls5e5lmwrm567sigx2joozprrrwhezilkq2kmqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip ec7398900295d52aae5d2756cb459df7e4835f4973b2f8c636393285aa1a5320

(this sample)

HawkEye

Executable exe 4e59193170ad7a1da7d91bea0028bb8107a3a305cd91a353822e23924ceda25b

  
Dropping
MD5 36b2c67a3f05c5cee99aeac1a1fe577e
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e59193170ad7a1da7d91bea0028bb8107a3a305cd91a353822e23924ceda25b

Comments