2021-03-09 Agent Tesla IOCs

THREAT IDENTIFICATION:  AGENT TESLA

SUBJECTS OBSERVED
Re: DEVOLUCIÓN DE PAGO TT (Ref 0180066743)

SENDERS OBSERVED
[email protected]

MALDOC FILE HASHES
Detalles del banco..PDF.....gz
1c82a6fd738178598e8a3c207846c6a0

Devolver detalles de Swift..PDF.......gz
562ca9d4bc237708fd23849fd3600e25

AGENT TESLA PAYLOAD FILE HASHES
WcF3F786rumYVOl.exe
a5e4ad305745815c85521f1bec3db622

QqxOrD9ivjVteg7.exe
daa19bf920ef774e7bc435c8ae7e5567

AGENT TESLA ESMTP DESTINATION
https://66.70.204.222:587
mail.iymorenterprizelogs.com

SUPPORTING EVIDENCE
https://tria.ge/210309-k9van3gy8a
https://app.any.run/tasks/75bbb948-6edf-47de-a4e5-f3d17f855bb6/