MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 403306fd448f4736094038f59619819a808fad718f3a69fb06fd84ecde9ec37f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	403306fd448f4736094038f59619819a808fad718f3a69fb06fd84ecde9ec37f
SHA3-384 hash:	bca974fcaba09b6bee014dec5cd98f73a50d660716349798de1f9f0bca277e084975c016778676c36f10b814e2cae2ed
SHA1 hash:	f89cad8b84a73bb43b0c1187e9fa649587eddc7c
MD5 hash:	f0c1e7770816a25579334ebd95235bdb
humanhash:	delta-bacon-white-kansas
File name:	Balance SOA.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	647'843 bytes
First seen:	2022-12-01 07:21:28 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:cWPkGiSA4j/pC6OTDwosnfci+zfvYFvimHsKawhoPoy2yf4HQHiB/2GiCc:c9GiSJCbvzgEfv4sKfn12GA
TLSH	T123D423388D86A11122E6F54FA905A7B00D68711CAC2B75246B89691FFF70B33943CB7F
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: ""Giulia Alessio"<giulia.alessio@stiga.com>" (likely spoofed)
Received: "from stiga.com (unknown [103.145.253.235]) "
Date: "30 Nov 2022 05:20:25 -0800"
Subject: "Balance Statement"
Attachment: "Balance SOA.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Balance SOA.exe
File size:	830'976 bytes
SHA256 hash:	b27f7a44bbe68d1ceb1d8d2b0a81fe4dcb9dc8047080e6a79aaca37b409cf240
MD5 hash:	c6de6c6bf618e381621a009e0677c80c
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.3169.10050.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6388561bba51a7caf9a83b18/reports/e6037d83-1179-4895-b551-351a091870db/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/403306fd448f4736094038f59619819a808fad718f3a69fb06fd84ecde9ec37f

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/403306fd448f4736094038f59619819a808fad718f3a69fb06fd84ecde9ec37f/

Threat name:

ByteCode-MSIL.Trojan.Taskun

Status:

Malicious

First seen:

2022-11-30 04:26:08 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iazqn7ker5dtmckahd2zmgmbtkai7llrr45gt6yg7wcozxu6yn7q._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/221201-jtwgasha83/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/403306fd448f4736094038f59619819a808fad718f3a69fb06fd84ecde9ec37f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.