2021-09-20 Agent Tesla IOCs

THREAT IDENTIFICATION: AGENT TESLA

SENDERS OBSERVED
Ellie.Loizou@gapgroup.com

SUBJECTS OBSERVED
Inquiry Purchase Order PO81-36A2DC

MALDOC FILE HASH
Purchase Order PO81-36A2DC.doc
bbff3d02c5d7c87053e6432555d1c35f

PAYLOAD DOWNLOAD URL
http://lg-tv.tk/bryantzx.exe

PAYLOAD FILE HASH
bryaniop1974.exe
4e2e9f752d0cf2a0bf4a31d03b05e3d2

SMTP EXFILTRATION
208.75.149.34
six.qservers.net

SMTP CREDENTIALS
Username: osun@dhmlnigeria.com
Password: #25,Ofatedo,Road

EXFILTRATION EMAIL
MAIL FROM:<osun@dhmlnigeria.com>
RCPT TO:<peopleinpower@yandex.com>


OBSERVED STRINGS IN MEMORY
http://monitorrhcoordena.brazilsouth.cloudapp.azure.com/