MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 576c49c08e0fdf319e6bd95e0f2f6aa92e2460e8b9032cfd732b51261f48b757. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 5 Yara 3 Comments

SHA256 hash: 576c49c08e0fdf319e6bd95e0f2f6aa92e2460e8b9032cfd732b51261f48b757
SHA3-384 hash: f3576326c3c5f787c3328d6689f1aeb0b66323d97efa78b58053d5e4b7b6c6094b7670c37aba7c60276ff41a43367f51
SHA1 hash: 0ffb6dbd026bc5287c25f916de027409732d774f
MD5 hash: c8b2f3ed20b96d896efed10bc72f4bc7
humanhash: texas-monkey-utah-neptune
File name:Payment Copy.exe
Download: download sample
Signature AgentTesla
File size:480'256 bytes
First seen:2020-06-30 13:59:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:M6+yS6t0HeYy/wqQezYSZ7STudxbR1d9s4AAY9iXX6H0ggi/DJPJG1XpVYpL9Zr:Ayd0HfMicWYDzsdAY9in/w/9WXpO
TLSH 91A40260B7FB3BC2C47407F425A0A18777F6A61F1626CA3E9DD4A0ED0A2578012B5E77
Reporter @jarumlus


Mail intelligence
Trap location Impact
Global Low
NL Netherlands Low
# of uploads 1
# of downloads 32
Origin country US US
CAPE Sandbox Detection:n/a
ClamAV No detection
CERT.PL MWDB Detection:agenttesla
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Genkryptik
First seen:2020-06-30 11:17:00 UTC
AV detection:17 of 31 (54.84%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Tags:spyware keylogger trojan stealer family:agenttesla persistence
VirusTotal:Virustotal results 22.22%

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 576c49c08e0fdf319e6bd95e0f2f6aa92e2460e8b9032cfd732b51261f48b757

(this sample)

Dropped by
Delivery method
Distributed via e-mail attachment