MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f708c1681975f96481f2c4f45ebf56f2c3be83b7f087a73ae845b537cf1d21f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f708c1681975f96481f2c4f45ebf56f2c3be83b7f087a73ae845b537cf1d21f2
SHA3-384 hash: 17da302298269c064f40d98fa3db90b16a35f601ec9584dda1a48ec706c7100e6165f3905205dca6c53da4e29e1e1dd4
SHA1 hash: 7feb5ba2db449abce6a43b8fe2d84467adeee641
MD5 hash: a667b9f3cce4cf9405a836ba29e85ea6
humanhash: oregon-apart-oklahoma-cup
File name:order08062020.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:614'321 bytes
First seen:2020-06-08 13:23:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Sqmp0XqmPaBkyfh5QhzueXoeHRRi2w4ttqDWaHeHeOpvcAV:Sq76WE9pahzuej7JEDChEAV
TLSH 44D423427EA3A1D0EDD3209FEDDCA3F8ED221364721DFD09022E6C18D2B16549552ABE
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing HawkEye:

HELO: mta2.hrz.uni-giessen.de
Sending IP: 134.176.3.225
From: Purchasing Manager <karin.u.brokamp@med.uni-giessen.de>
Reply-To: <dh_derhawk@126.com>
Subject: PO#: EF17BA/0-00661
Attachment: order08062020.zip (contains "order08062020.exe")

HawkEye SMTP exfil server:
smtp.urban.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.AI.Packer.46E09C1421.12572.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 13:25:05 UTC
AV detection:
30 of 46 (65.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=64emc2azox4wjapsyt2f5p2w6lb35a5x6cd2ooxiiw2tpty5ehza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip f708c1681975f96481f2c4f45ebf56f2c3be83b7f087a73ae845b537cf1d21f2

(this sample)

HawkEye

Executable exe 43979426d7bd2eae9c93599e389dff26e8bc919eaa2412355f5c557bd0277f9e

  
Dropping
MD5 a72fc2114237ad8a311898eb8a336eca
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 43979426d7bd2eae9c93599e389dff26e8bc919eaa2412355f5c557bd0277f9e

Comments