Agent Tesla RAT 24-Nov-2020

Files:

BILL_OF_LADIG_SHIPPING_DOCSPDF.rar
1b2cf23895a8b87faa2a0cff4bdc448572357aeadf114353517cdb9055a38d23

Orden de compra.exe
33ba597423706b8abd06af2e6e602fbb6f37bce4e8c3537c08bf6a71891c4169


BILL OF LADING SHIPPING DOCSPDF.scr (AnyDesk instance)
1d21fe93f7cc6898d25510b30ae921a1704780858f8610974a31aed7de457d70

vJYIGohBMFpBSBGYdpuFPqYc.exe
FA0AE9F2DD86A1F0A0225D59E461E9D3196CAB383001B6C4A26019611AB618D2

vlc.exe (fake file)
84a89fbe416dc250832d27a335e2d354a4cc808dd0e38d99f703544db049a175


Network:

Sender: [email protected]
Protocol: smtp
Host: pnkfpcdk.outbound-mail.sendgrid.net
IP: 50.31.60.209 (USA) - 167.89.100.127 (USA)
Port: 25

Network Handshake:

Username: [email protected]
Password: N!QbrVc7
Host: smtp.zuarakltd.com - us2.smtp.mailhostbox.com
IP: 208.91.199.224 (USA) - 208.91.199.223 (USA)
Port: 587


System Behavior:

File Create
process: BILL OF LADING SHIPPING DOCSPDF.scr
path: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
op: CreateModify
status: 0x00000000

File Write
process: BILL OF LADING SHIPPING DOCSPDF.scr
path: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe

\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\""