MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
SHA3-384 hash: a4660aea4b4d65de5d9f1c8ad93ee0165734bb0fea6ae9894eb3859c9c1689c649874454a83c2411614d1d710f2ab0a1
SHA1 hash: e8553d2177cb4e92f1cdb3e67b8d787fdd53dafb
MD5 hash: f74b104bcdb47b4371cba42a64b395b7
humanhash: whiskey-burger-cold-cold
File name:ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
Download: download sample
Signature HawkEye
Create hunting rule
File size:2'134'528 bytes
First seen:2020-11-11 11:22:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 49152:8wV+7Vr4Ujif5XWadqVhne3UPN7ylJvJF1k8wdd9EEUJkGa1MY:z+JfjiBX0VVzCvJ/pU9E/Jkt1M
Threatray 468 similar samples on MalwareBazaar
TLSH 6EA5D022639DCA60FA6EB032BA2577016E67E8653560FCF72E54087CE9501E01E3C76F
Reporter seifreed
Tags:HawkEye

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Launching a process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:24:38 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=54spveo4etrur5xpmd2t4nwlkmkqsufkcmaung3645dveo6eh5sq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
182b2d026edb387534dda66711ee6f9050bc8ed871d0ebb71a96f0b18498ba24
HawkEye
28753bd34049059e094796e4480f184cb0fdec4f5ca2ba0ffc5cc79bb3a7c1a6
HawkEye
487032be06deec0a6b50c6c0464edb67d50f9bb769ea1527969d4b67b83e8733
HawkEye
6591794758496511c22b638fc57b5d58943670a72568dfa92f29a08c501c73d6
HawkEye
6c18ca5bda44004c45e35e8224736bac8da9c64e901a5d3342a9834cb43d93ae
HawkEye
95dce20d910cf373ff2b72697282c344313dd3bf7ffd09c4ece59cd9f58c8972
HawkEye
bbf613ce1f6850b2b62c6f55082ab7b9bcc7f92db0a8ec8f0b495e29cb4988ae
HawkEye
c689edeb2bea45f5a7e6402ba51dc23e40e6c8b509841f60cb3d7327340b9b60
HawkEye
e842dbdc4b41d7516d87ccc21fa365b93c4c94ce5a75dc6f06321f90efa19e29
HawkEye
f46f7af124b25fff7a984b802bfa9f1f01f1efcc3416221aa9b6254150ac9667
HawkEye
+ 458 additional samples on MalwareBazaar
Result
Malware family:
hawkeye_reborn
Create hunting rule
Score:
  10/10
Tags:
family:hawkeye_reborn keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201111-cgzlxlea76/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Drops startup file
Reads user/profile data of web browsers
Uses the VBS compiler for execution
HawkEye Reborn
Unpacked files
SH256 hash:
ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
MD5 hash:
f74b104bcdb47b4371cba42a64b395b7
SHA1 hash:
e8553d2177cb4e92f1cdb3e67b8d787fdd53dafb
Link:
https://www.unpac.me/results/cd5becf0-9132-44ff-99f7-bb9e1efc5ead/
SH256 hash:
2c5c6737315e1231daae3c559b9d0d2e275b555f5ea90a41cb47a9eed4b0e83e
MD5 hash:
5e8d81b745d1de9196f69f71b8929fad
SHA1 hash:
d2547f681e3b80a8d2a1d78e118bd2c7e0c992ac
Detections:
win_hawkeye_keylogger_g0
Create hunting rule
Link:
https://www.unpac.me/results/cd5becf0-9132-44ff-99f7-bb9e1efc5ead/
Parent samples :
ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
b926b9c322ee16dc0ea54330428658cda75dc84a1a58ef88ebec2572d87d850b
c5845be19adb4e49adb11f5c276835d1f2d11c2d277da2dc265968bb6edb4c2d
a1416f15382642c1bcf6fafac052bcd38900409be007f54414942e405c18ff73
SH256 hash:
ce5ddb4d00a5e331a897130c9cee1e1b4d541e043bb35a983e8d06b5ce261b94
MD5 hash:
0a3eb3b92256654546fcb3ea713b47e9
SHA1 hash:
51e3bde402afc2fa70bc7c0b678634289be7e474
Detections:
win_hawkeye_keylogger_auto
Create hunting rule
Link:
https://www.unpac.me/results/cd5becf0-9132-44ff-99f7-bb9e1efc5ead/
Parent samples :
ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
b926b9c322ee16dc0ea54330428658cda75dc84a1a58ef88ebec2572d87d850b
c5845be19adb4e49adb11f5c276835d1f2d11c2d277da2dc265968bb6edb4c2d
a1416f15382642c1bcf6fafac052bcd38900409be007f54414942e405c18ff73
SH256 hash:
400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342
MD5 hash:
54e8ded7b148a13d3363ac7b33f6eb06
SHA1 hash:
63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9
Link:
https://www.unpac.me/results/cd5becf0-9132-44ff-99f7-bb9e1efc5ead/
Parent samples :
e6b3160e17f1c4c0ce9136d7e19089f9e7e759bbd2989c27f8eb6083a627bfb9
c0498d7a70e78c236241d0e91b3bb599c1961ea62a10bd76a16fe7b18824f646
c2d23332a28fd0f2f0b404e53d9820ba0f5f8070043cfa0b2fbb18a4a33466b6
SH256 hash:
54241d67c33e245742af873dc6e61558b837618a3c03eb055695587e3ddf8740
MD5 hash:
b15ffed0dc3932b66ab628d422b18f70
SHA1 hash:
99e0ea3021640282792f2914a4d7e6626fca9df8
Detections:
win_hawkeye_keylogger_auto
Create hunting rule
Link:
https://www.unpac.me/results/cd5becf0-9132-44ff-99f7-bb9e1efc5ead/
Parent samples :
76f4037b2878a1f9d902b58becabe775f8f99df45b2c5c80ac9eb61a8da4a255
c944ec2c1c332672384769d2abfbb4f298f9fcaa63b18b4094e1d9779fa82fe0
c2689bc7e035365f3aad0880c3f2526da7e6934882be23bef2b7fa20f4b04513
aff4e29973c297fd764b3ba81237afd91912f51f9a4babfd766ce80f9ace2676
7dfdce0a99eabe706a8f617d20f54ab7c933fd0e702dffed576ea3d5d74aea9d
44f88f1551622a78e7e0cb6cb04b810ce4c58a1dbd6039b1f7248b579e8f9095
32a1d99c12d4bbbf6b20ee43a25cf4dccf34ba30d8d40dc68d9c59d4c7ba25d5
39ae83af1cd715dadb50a266b91587dab04fffa94d2aa923c03cff634265f9ec
ef24fa91dc24e348f6ef60f53e36cb53150950aa1301469b7ee747523bc43f65
b926b9c322ee16dc0ea54330428658cda75dc84a1a58ef88ebec2572d87d850b
c5845be19adb4e49adb11f5c276835d1f2d11c2d277da2dc265968bb6edb4c2d
a1416f15382642c1bcf6fafac052bcd38900409be007f54414942e405c18ff73
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:MALWARE_Win_HawkEyeV9
Create hunting rule
Author:ditekshen
Description:Detects HawkEyeV9 payload
Rule name:MAL_HawkEye_Keylogger_Gen_Dec18
Create hunting rule
Author:Florian Roth
Description:Detects HawkEye Keylogger Reborn
Reference:https://twitter.com/James_inthe_box/status/1072116224652324870

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments