2022-05-20 Agent Tesla IOCs

THREAT IDENTIFICATION:  AGENT TESLA

SUBJECTS OBSERVED
Payment Advice - Advice Ref:[A1OQwnBHyTTi] / Priority payment / Customer Ref:[AP0001666605]

SENDERS OBSERVED
alert@hsbc.com

MALDOC FILE HASHES
advice.xlsx
02b4919e879f843e5634b26396f037bc

PAYLOAD DOWNLOAD URL
http://104.168.33.12/200/vbc.exe

AGENT TESLA PAYLOAD FILE HASHES
vbc.exe
f406a9ba20e13aa04d451d187b950faa

AGENT TESLA C2
https://api.telegram.org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/sendDocument

SUPPORTING EVIDENCE
https://urlhaus.abuse.ch/url/2204009/
https://app.any.run/tasks/0cd3c92a-4a16-43df-8790-cef07229b0b1/