2021-08-27 Agent Tesla IOCs

THREAT IDENTIFICATION:  CREDENTIAL PHISHING / AGENT TESLA

SUBJECTS OBSERVED
Notification of Suspended Messages

SENDERS OBSERVED
tomasz.bartkowiak@hagric.pl

CREDENTIAL PHISHING URLS OBSERVED
https://countlocfwriteloginapp.web.app/loginapp.html?id=john.doe@myrealwork.com

https://betnkulu.co.mz/host.php?type=Webmail&email=am9obi5kb2VAbXlyZWFsd29yay5jb20=&password=c2VjcmV0

MALDOC FILE HASHES
SWIFT_ADVICE.doc
d0d3448509bcdaa023c02601aba4f819

AGENT TESLA PAYLOAD URL
http://hdmilg.xyz/richyzx.exe

AGENT TESLA PAYLOAD FILE HASHES
richysj853.exe
0951bbdc6abd651b72cbc6fd5c06a95a

EXFILTRATION INFORMATION - SMTP
http://smtp.henglibatterys.com:587
50.17.5.224:587

SUPPORTING EVIDENCE
https://urlhaus.abuse.ch/url/1544591/
https://tria.ge/210819-ejzbt152hn