MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c51e569302d31f4c432664c267710b9535d80ae2cda96218e46a69077fbc9d90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c51e569302d31f4c432664c267710b9535d80ae2cda96218e46a69077fbc9d90
SHA3-384 hash: ecfa9d33032be7f62cd484d4048320ae8a2423ce5a13420a5db6fd25fc9fc0219e5560c839826736b470247efb919684
SHA1 hash: da33a797d99c9a464472a9336fc1544590809b63
MD5 hash: 32203f7998a46f12da80f15ae548c749
humanhash: nineteen-football-bulldog-cup
File name:whe.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'472 bytes
First seen:2020-04-06 14:03:55 UTC
Last seen:2020-04-06 17:35:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:bmSBWD6YVnknDClFg32VdAbMZLo0I++W98bteOA:KEWD6NM5oneOA
Threatray 10'550 similar samples on MalwareBazaar
TLSH 26543BAD2B88B902F67E193285D5132512F1D0879D62C30F6FC44FE87F71BD92A89396
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 03:07:49 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yupfneyc2mpuyqzgmtbgo4ilsu25qcxczwuweghenjuqo754twia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
102ac6c0d193add286a4339d2e63b2d43733d26364df195ecb942c7ae3fb8bfd
AgentTesla
3eb30f7fa77eeed5c687b9514c1ef0e9cca4778a514e30a2a0c07949945407f4
AgentTesla
9f86e4c1e6b8dd93f705c769d056d73f0f7b28f92b3925ba9a9aee9d3505c5e2
AgentTesla
ac979891a231a3af79a31a52663f77fe151bbbddee9b13750ea02e82f6aefd40
AgentTesla
b36cdef1bf3b71c8edb27b1d2eabaa00b2df89f3a46bc9c727f4dbb6956fcddb
AgentTesla
bcc9c0d2162cec6b418ab08905642c181d2c24b95a4a387242f73cd5d4410bb2
AgentTesla
c964296558dc6cf1a3e305f48af7ea8b6736ef61f01425dbfabc6fd32cd4eb87
AgentTesla
e7e7041b16466bd06811dc949564fdc2cabed3c4f7e8957581f0a4b53808ab0f
AgentTesla
e8917cab54dca8c56976f8fa973521d58d0fc5abc196906a2aaee1e31c8b007c
AgentTesla
f349c4c241a5ce1565b3d584dc1158fbc4e9766d99becca69c5d4d848de0fefa
AgentTesla
+ 10'540 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/335775/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments