MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51614b7356cca6df45dcaf1a88ef2ba1dd02c4015ea283ac84e1f3bdcc3d0053. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51614b7356cca6df45dcaf1a88ef2ba1dd02c4015ea283ac84e1f3bdcc3d0053
SHA3-384 hash: 20d7bd9d965195111812b09e108b7b5a03a4fc7b04739c216dffcdd4f2dea808bf0cca4dc620aa684ab799f1773ac56d
SHA1 hash: 8a18d8e1d3db2e63f6ec44df3e74e0d1c116f1a9
MD5 hash: 49071adecf109e428af6ee81c11e762b
humanhash: venus-september-sixteen-michigan
File name:MV_ FORTUNE TRADER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'395 bytes
First seen:2020-05-11 14:43:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:MoY/uldts6JK7GP5PAyEorXdV5b3dYKYf2lfdssNGr9BjMgXNljPohGMGyCUe73c:3Y2ljjTdTzdYKG23gxDvAAMsLuGhxiJ
TLSH 9594231822F20CF8E4FACBE4B438C9AA53E620519F02DB55395EC9D14B2C7AF65525CF
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.57.menxtinuon.casa
Sending IP: 161.35.17.244
From: CIDO SHIPPING KOREA CO., LTD <djkim1123@cidoship.com>
Subject: RE:REQUEST FOR QUOTATION // M/V FORTUNE TRADER
Attachment: MV_ FORTUNE TRADER.rar (contains "MV_ FORTUNE TRADER.exe")

AgentTesla SMTP exfil server:
secure197.inmotionhosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:45:55 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfquw42wzstn6ro4v4nir3zluhoqfrabl2rihlee4hz33tb5abjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 51614b7356cca6df45dcaf1a88ef2ba1dd02c4015ea283ac84e1f3bdcc3d0053

(this sample)

AgentTesla

Executable exe 010376ca31e9211822e78b07de7e3b5dd524cc359ab8e479b8f5435f81c8398b

  
Dropping
MD5 0881ea9e974aa458fcfc757f91c3f063
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 010376ca31e9211822e78b07de7e3b5dd524cc359ab8e479b8f5435f81c8398b

Comments