MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee6579fabec9da8f478fc1b310f111ecd2128cc62a65c7f05b1c701378a470cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee6579fabec9da8f478fc1b310f111ecd2128cc62a65c7f05b1c701378a470cb
SHA3-384 hash: a4fc960cf78f4c8cab891fcbb02d66ad9b92fdc3bba5dc8784735d52accfee308183be7db4fa6f109b4d62ebf4801599
SHA1 hash: d61c16cfed02506e7f51ed25ceba493e6cb2bf8c
MD5 hash: b018b82d36f3a68ebc829013f570e394
humanhash: colorado-oranges-west-fifteen
File name:Bankbezahlung.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:440'652 bytes
First seen:2020-07-08 14:20:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:VXlEg+lF9ocd6hbjFZnCV4pwTopBrjkEHtX:pcd6hb5pCFspVjZHB
TLSH AB9423CB528AD3586A54536EA2A7847720E4A7123D73486020DADFB52FCFCB73D0357A
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: relay3.grserver.gr
Sending IP: 88.198.112.68
From: BMW AG Group <Zahlung@supercoolservice.gr>
Subject: Re: Zahlung
Attachment: Bankbezahlung.zip (contains "Bankbezahlung.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee6579fabec9da8f478fc1b310f111ecd2128cc62a65c7f05b1c701378a470cb/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 14:22:06 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5zsxt6v6zhni6r4pygzrb4ir5tjbfdggfjs4p4c3drybg6feodfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip ee6579fabec9da8f478fc1b310f111ecd2128cc62a65c7f05b1c701378a470cb

(this sample)

HawkEye

Executable exe 26662ea8f2ceaeb815e62f5fcf388b95a782f6856dc7c743c1cf698681ba9dc4

  
Dropping
MD5 f719210283f21205a9b5fac30a6a9606
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26662ea8f2ceaeb815e62f5fcf388b95a782f6856dc7c743c1cf698681ba9dc4

Comments