MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f095d3e8aa52a4ea3c9e074f987fda1170439217f2f63b36edbac5e0ed5f932f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f095d3e8aa52a4ea3c9e074f987fda1170439217f2f63b36edbac5e0ed5f932f
SHA3-384 hash: 7f5261860bfa861a2bf4a86bafbdc223a39b605f8e9b46f99a4585d2bb33ea6d56f3f1457698be72ba434bb00ceed72d
SHA1 hash: 1d0e6bf26705fd2f77668fc895ab8547048a75f0
MD5 hash: d6ea79f5182ef3cef7804759a3571989
humanhash: uranus-single-salami-london
File name:Payment_slip 1.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:454'595 bytes
First seen:2020-07-21 09:46:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:pyiDPYd12mJCShrCMTRb/UbmQGidKkibmyLRIDuy98OoJPi:p3wd1AwciwKkib7SXijQ
TLSH 39A423A5CBB6F64852A8476E67A172C30E65CAEEA1F33B6046D5C5F31CC851E9034C1F
Reporter abuse_ch
Tags:HawkEye WellsFargo zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: 53-7-static.mxserver.ro
Sending IP: 46.102.249.75
From: Wells Fargo Bank <Payment@wellsfargo.com>
Reply-To: s.peters.edur@bk.ru
Subject: payment
Attachment: Payment_slip 1.zip (contains "Payment_slip.exe")

HawkEye SMTP exfil server:
server165.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.68844.9490.29308.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f095d3e8aa52a4ea3c9e074f987fda1170439217f2f63b36edbac5e0ed5f932f/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 09:23:25 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ck5h2fkkksoupe6a5hzq762cfyeheqx6l3dwnxnxlc6b3k7smxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f095d3e8aa52a4ea3c9e074f987fda1170439217f2f63b36edbac5e0ed5f932f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip f095d3e8aa52a4ea3c9e074f987fda1170439217f2f63b36edbac5e0ed5f932f

(this sample)

HawkEye

Executable exe dab6a48ba657c5f7b2847c460dd389e85b368e1e55e7f1ba4e3603f43bcf3fbf

  
Dropping
MD5 4b3ac1a2ed151b36a4468f47bf2d8781
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dab6a48ba657c5f7b2847c460dd389e85b368e1e55e7f1ba4e3603f43bcf3fbf

Comments