2021-07-26 Agent Tesla IOCs

THREAT IDENTIFICATION:  AGENT TESLA

SUBJECTS OBSERVED
RE: RQF  UKLSiP 40-4_RP_Z

SENDERS OBSERVED
meiqin.wen@cn.leggett.com

MALDOC FILE HASHES
UKLSiP 40-4.zip
00157f98b08a38551dbd10d40baae91e

AGENT TESLA PAYLOAD FILE HASHES
UKLSiP 40-4.exe
13689d3a5e66bf63310432308f682d22

AGENT TESLA ESMTP DESTINATION
mail.roplantpakistan.com
https://148.66.136.56:587

SENDER/RECIPIENT
sales@roplantpakistan.com

SUPORTING EVIDENCE
https://www.virustotal.com/gui/file/db4f9a9828a3d4382e970566f66484d168c7341533ca79ddd618a03252057210/detection