#Agenttesla_161018

#IOC #OptiData #VR #Agenttesla #RAT #Keylogger #NET #0199.19 #RTF #11882

https://pastebin.com/d5DxTRrB
previous contact:
04/10/18 https://pastebin.com/JYShuXn4
11/10/18 https://pastebin.com/bkCSvJvM
FAQ:
https://radetskiy.wordpress.com/2018/10/19/ioc_agenttesla_111018/

from @Techhelplistcom :
"smtp variant.
sending to and from cwl.cus@cargoworldlogistics.in
password is Cuscargo123+"

attack_vector
--------------
multiple email attach > (xml.rels) > GET ItvsncjBnvcpjHkX.doc (RTF) > 11882 > GET exe

email_headers
--------------
Received: from sk.com ([180.166.191.164])
	by srv2.victim1.com (8.15.2/8.15.2) with ESMTP id w9GITeKP080450
	for <boss@org7.victim1.com>; Tue, 16 Oct 2018 21:29:42 +0300 (EEST)
	(envelope-from tonykim87@sk.com)
Reply-To: silverlighttrading@live.com
From: Kim Young-jin Tony <tonykim87@sk.com>
To: boss@org7.victim1.com
Subject: Re: Re: Signed Contract Agreeement For You boss@org7.victim1.com
Date: 17 Oct 2018 02:29:27 +0800

files
--------------
SHA-256	68bdce3424d9a40d84430944185983281ddf9a91186291a4c6b19049d95c8d8a
File name	Contract_Agreement.pdf  (!) Contain Contract_Agreement.docx > document.xml.rels > GET ItvsncjBnvcpjHkX.doc (RTF) > 11882 > GET exe
File size	39.67 KB

SHA-256	77a2bdcd7bfa3d4ba7eea2539af3108c76615714a9a10eceb0dc997f045aa13d
File name	Contract_Agreement.docx (!) > document.xml.rels > GET ItvsncjBnvcpjHkX.doc (RTF) > 11882 > GET exe
File size	12.75 KB

SHA-256	65109c78e9d570b035d138ce4cc1c3a49652f0ef9d257b12e848612645620a1d
File name	Contract_Agreement.doc (RTF) (!) > 11882 > GET exe
File size	53.38 KB

SHA-256	d2edb631e79218e1d52983a54928debfd275ad53b316bdd61425a811d948b16a
File name	ItvsncjBnvcpjHkX.doc (RTF) (!) > 11882 > GET exe
File size	52.33 KB

SHA-256	b36264221df581616ff26ae39dbf0425bde324be75a94af3c90d100d0b702704
File name	mine001.exe	> corrupted?
File size	857 KB

activity
**************
payload		share.dmca.gripe/ItvsncjBnvcpjHkX.doc
payload2	3arabsports.net/admin/mine001.exe

netwrk
--------------
n/a, must be SMTP

comp
--------------
n/a - exe is corrupted/crashed

proc
--------------
n/a

persist
--------------
n/a, must be HCU

drop
--------------
n/a

# # #
https://www.virustotal.com/#/file/68bdce3424d9a40d84430944185983281ddf9a91186291a4c6b19049d95c8d8a/details
https://www.virustotal.com/#/file/77a2bdcd7bfa3d4ba7eea2539af3108c76615714a9a10eceb0dc997f045aa13d/details
https://www.virustotal.com/#/file/65109c78e9d570b035d138ce4cc1c3a49652f0ef9d257b12e848612645620a1d/details
https://www.virustotal.com/#/file/d2edb631e79218e1d52983a54928debfd275ad53b316bdd61425a811d948b16a/details
https://www.virustotal.com/#/domain/3arabsports.net
https://www.virustotal.com/#/file/b36264221df581616ff26ae39dbf0425bde324be75a94af3c90d100d0b702704/details
https://analyze.intezer.com/#/analyses/e62ca4fd-b7f3-4d0e-a127-a32bc35a5e6f