Extracted

• • Target
    FTTJ JMFS2607PO4272 .img
  • Size 3.4MB
  • SHA256 a504125e372e518457f676cfd1f2ff0f1c0101acbbb09c302407be920a40ca38
  • MD5 fb9fa30d2d0228a080b6678f208ad778
  • SHA1 bc6eca5d3f90ae971a1eb9c65e4a6f1d167d5e51
  • SHA512 1ec6200db627996472a600a339024d9cc0c676694e4c409c43275ab9ce5473bcc3a2b9415a9ba5b57cdb5d66041f5e14027a7aec05dc23ce985a0499a8f49d6a
  • SSDEEP 98304:SHILTdvxL+0Vr5EjXDGNm/AdvJt1YPB90wnkK53K4RM+CV6Xk6cT4TlZST:Pvh+Wr5lNJcJ90wnkK53zM+C0XkFTOZi
  • TLSH
    T148F5C4411794A932F721ABBC923ADDF0D90A511315C6CF1634ACF618BB2CD1BA758AF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral1
• • Target
    out.iso
  • Size 3.4MB
  • SHA256 a504125e372e518457f676cfd1f2ff0f1c0101acbbb09c302407be920a40ca38
  • MD5 fb9fa30d2d0228a080b6678f208ad778
  • SHA1 bc6eca5d3f90ae971a1eb9c65e4a6f1d167d5e51
  • SHA512 1ec6200db627996472a600a339024d9cc0c676694e4c409c43275ab9ce5473bcc3a2b9415a9ba5b57cdb5d66041f5e14027a7aec05dc23ce985a0499a8f49d6a
  • SSDEEP 98304:SHILTdvxL+0Vr5EjXDGNm/AdvJt1YPB90wnkK53K4RM+CV6Xk6cT4TlZST:Pvh+Wr5lNJcJ90wnkK53zM+C0XkFTOZi
  • TLSH
    T148F5C4411794A932F721ABBC923ADDF0D90A511315C6CF1634ACF618BB2CD1BA758AF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral2
• • Target
    FTT JMFS2607PO4272 REQ Parts -Specs- Inv-contract.JS
  • Size 2.9MB
  • SHA256 64018e5208c85adaf81f0354b8ba68ce8aa0d8bec9501e8078ccaec9f7c153cc
  • MD5 0258b74a2c7b48ed99d13db6151d7f77
  • SHA1 f39762b49a847256a1f21b189bce74cc48921b09
  • SHA512 9fcd560310a05fb987d55a41555e770b4a9930f5899b287d126163a29dd145b17339c9dcd82c0eb55d74f75dcfd5b518406d415524442a9531d360cdd568bcab
  • SSDEEP 49152:uOpBn8bwISsTH9vj2ywYPXpBIHdOVr5EjuX0DGOxgm/AdnvJt1eIIwepPB90wnkd:vHILTdvxL+0Vr5EjXDGNm/AdvJt1YPBI
  • TLSH
    T16DE5C3411794AD33B721AB9C923ADDF0D90A511325C6CF1634ACF618BB2CD1BA758AF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3