MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 21


Intelligence 21 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
SHA3-384 hash: 3e6e0073a46126c696b7bce577dfc8449bd2496e4a61eb34d2d4c543b2c819920585a53013ad29748ae0541bf5ae31be
SHA1 hash: 0adc40fcb0c95406c140b45c26a977cb95a3ec09
MD5 hash: 4249b26282216381d5199522962a3e7b
humanhash: lake-triple-jig-california
File name:227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'206'784 bytes
First seen:2025-12-08 16:12:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1ce208b1192bfcf652c179f34f034d3 (36 x AgentTesla, 23 x Formbook, 8 x SnakeKeylogger)
ssdeep 24576:V5EmXFtKaL4/oFe5T9yyXYfP1MAXDzVRj1iXAEKc+:VPVt/LZeJbInGizVB4XAE
TLSH T1F145BF0273C1D062FFAB95334F5AF6115BBC79260123A62F13981DBAB9701B1563E7A3
TrID 50.4% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
19.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.5% (.EXE) Win32 Executable (generic) (4504/4/1)
3.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon aae2f3e38383b629 (2'644 x Formbook, 1'203 x CredentialFlusher, 913 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
File size (compressed) :699'904 bytes
File size (de-compressed) :1'206'784 bytes
Format:win32/pe
Packed file: 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/542be0ec-2ebe-40fb-916c-901933d6743d/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
_c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153.exe
Verdict:
Malicious activity
Analysis date:
2025-12-08 16:34:40 UTC
Tags:
stealer ultravnc rmm-tool agenttesla netreactor
Link:
https://app.any.run/tasks/c47f6806-a51f-4e6f-916d-27c7d4544377

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43881/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936f934db58e1a2c22b9fa1
Tags:
autoit emotet lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Changing a file
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-08T13:54:00Z UTC
Last seen:
2025-12-09T19:20:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Auzenpak.sb HEUR:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.d Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb Trojan.MSIL.Crypt.sb Trojan-PSW.MSIL.Agensla.acut Trojan-Dropper.Win32.Dorifel.sbd HEUR:Trojan-PSW.MSIL.Agensla.a Trojan-PSW.MSIL.Agensla.sb Trojan.Win32.Zenpak.sb
Link:
https://opentip.kaspersky.com/c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153/results?tab=lookup
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1828946
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1828946 Sample: 227a4456fb01401663152a26fe3... Startdate: 08/12/2025 Architecture: WINDOWS Score: 100 37 mail.honesty-shippings.com 2->37 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 5 other signatures 2->53 11 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe 4 2->11         started        signatures3 process4 signatures5 59 Binary is likely a compiled AutoIt script file 11->59 61 Found API chain indicative of sandbox detection 11->61 63 Switches to a custom stack to bypass stack traces 11->63 14 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe 2 11->14         started        17 RegSvcs.exe 11->17         started        process6 signatures7 71 Binary is likely a compiled AutoIt script file 14->71 19 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe 2 14->19         started        22 RegSvcs.exe 14->22         started        73 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->73 process8 signatures9 55 Binary is likely a compiled AutoIt script file 19->55 24 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe 2 19->24         started        27 RegSvcs.exe 19->27         started        process10 signatures11 57 Binary is likely a compiled AutoIt script file 24->57 29 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe 2 24->29         started        32 RegSvcs.exe 24->32         started        process12 signatures13 65 Binary is likely a compiled AutoIt script file 29->65 67 Writes to foreign memory regions 29->67 69 Maps a DLL or memory area into another process 29->69 34 RegSvcs.exe 2 29->34         started        process14 signatures15 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->39 41 Tries to steal Mail credentials (via file / registry access) 34->41 43 Tries to harvest and steal ftp login credentials 34->43 45 Tries to harvest and steal browser information (history, passwords, etc) 34->45
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/4249b26282216381d5199522962a3e7b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-12-08 16:12:24 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
32 of 38 (84.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yulip62siru2lyomfjt4fzbwshpm7cuejtdye7h56j3nuhya6fjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unc_loader_001
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251208-tnn55seq4v/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6c0b3efc-b0e0-4e97-8b55-25e48c988311
Unpacked files
SH256 hash:
c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
MD5 hash:
4249b26282216381d5199522962a3e7b
SHA1 hash:
0adc40fcb0c95406c140b45c26a977cb95a3ec09
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/c3d54274-c374-4b76-9ce6-c493c14ee250/
Parent samples :
227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
SH256 hash:
b9cdf033d2f2a7e386eb33c1d5fadc9c8d282dac63e1ce7ee8f0af49df84d711
MD5 hash:
75fc4d819504b797d12b74f98c8124c2
SHA1 hash:
b928fe89c209c05c3c5ec95d57664e4889dc61e8
Detections:
win_samsam_auto
Create hunting rule
SUSP_OBF_NET_Reactor_Native_Stub_Jan24
Create hunting rule
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MetaStealer_NET_Reactor_packer
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/c3d54274-c374-4b76-9ce6-c493c14ee250/
Parent samples :
227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
SH256 hash:
a7c1da5486e91e8afd62833ab47c4c4d5d8097838353744433fe408144a5ad6b
MD5 hash:
f712b2c1865a3a118152452840a1ea11
SHA1 hash:
24cde43e6cd6bda14ca989d191c7c445993ab5a3
Detections:
AgentTesla
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
RedLine_Campaign_June2021
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/c3d54274-c374-4b76-9ce6-c493c14ee250/
Parent samples :
227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
SH256 hash:
86cb879164afb94ebf9be082856c06291258f99c5941794d7a2461f285eade26
MD5 hash:
923eb89ae76de1ec653b7d74ac98e347
SHA1 hash:
6146f37e8592ce96854c831995628e35f43cc5a6
Detections:
AgentTesla
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/c3d54274-c374-4b76-9ce6-c493c14ee250/
Parent samples :
227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c51687fb5244/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:win_samsam_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

AgentTesla

Executable exe 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225

AgentTesla

Executable exe c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153

(this sample)

  
Dropped by
SHA256 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225
  
Dropped by
MD5 fa19b78b109a6e4775f8415de3812559
Cape
Cape
https://www.capesandbox.com/analysis/43881/

Comments