Emotet_Feodo_IOC's_19-06-2018

#Emotet #Feodo #Banking #Trojan #Malware
-------------------------------------------------
19-06-2018				IOC's
-------------------------------------------------
Main object- "3e2d7638b70a4469b85a05cf168b314c2dcb0760d67301e4de1fbaadfe9d856a.bin"
	sha256	3e2d7638b70a4469b85a05cf168b314c2dcb0760d67301e4de1fbaadfe9d856a
	sha1	b5d8f35714d3db837432988c50c5ba6e7d5443ca
	md5	6dc05ffb9686494ccc58b976a3c35518
DNS requests
	domain	santehnika-kohler.ru
	domain	www.7.adborod.z8.ru
	domain	www.intermekatronik.com
	domain	positivebusinessimages.com
	domain	www.holod24.by
HTTP/HTTPS requests
	url	http://positivebusinessimages.com/JJBZ2k/
	url	http://www.intermekatronik.com/cPIbc/
	url	http://www.holod24.by/Ushy/
	url	http://www.7.adborod.z8.ru/qpzJM8T/
	url	http://santehnika-kohler.ru/system/helper/4pKGw/
---------------------------------------------------
Main object- "tracking-number-and-invoice-of-your-order"
	url	http://www.euro-specialists.com/STATUS/tracking-number-and-invoice-of-your-order/
	sha256	ceb070480f3fd618c25a3f6f418081e7d5a9f136b7fdc7dec42c36ed57756e97
	sha1	396165596641f484c0aaed98e85eb852df1bff5f
	md5	27e352533fac86b81835d22b7cf7d8e5
DNS requests
	domain	www.asdohasda.org
	domain	www.hoaphamxaydung.com
	domain	www.iconetworkllc.com
	domain	www.17184.p17.justsv.com
	domain	www.umjmnyqx.com
HTTP/HTTPS requests
	url	http://www.hoaphamxaydung.com/3y49s/
	url	http://www.iconetworkllc.com/IN3mtJj/
	url	http://www.umjmnyqx.com/t6pONVQ/
	url	http://www.asdohasda.org/vv28IS9/
	url	http://www.17184.p17.justsv.com/pUZdddm/
----------------------------------------------------
Main object- "UPS-Invoice-for-downloads-726.doc"
	sha256	86ed28e677575a7f498aaeb8ef98613c896a9dd025e540f4f6d8e9afc6a8c51a
	sha1	cb359655f6f78690e6fd5c7ac0920b55d45de919
	md5	41df718f344c92e8a7ccb4a8b47b2452
[Duplicate payload drops]
----------------------------------------------------
Main object- "DEAXUW.exe"
	sha256	e5bb3b427629cf817ca7372a44fba31365037ee50155027f49bf43aef7b47197
	sha1	d1e5ad977fca95ce511923a431cb3fd126a8de3b
	md5	66cd421eff9dfe084d0185b25f0b9132
HTTP/HTTPS requests
	url	http://47.188.131.94:443/
	url	http://217.91.43.150:7080/
	url	http://128.100.126.113/
	url	http://98.100.177.74:8080/
	url	http://46.4.100.178:8080/
	url	http://70.184.125.132:8080/
	url	http://76.72.225.30:465/
	url	http://203.45.184.52/
	url	http://70.168.7.6:443/
	url	http://23.239.2.11:8080/
	url	http://177.99.167.185:443/
	url	http://164.160.161.118:8080/
	url	http://75.152.52.109:8080/
	url	http://121.50.43.110:8080/
	url	http://115.78.95.230:443/
	url	http://24.119.116.230:990/
	url	http://46.38.238.8:8080/
	url	http://66.76.26.33:8080/
	url	http://87.248.77.159/
	url	http://110.143.116.201/
	url	http://206.255.140.203/
	url	http://71.244.60.231:4143/
	url	http://69.17.170.58/
	url	http://222.214.218.192:4143/
	url	http://191.242.178.46:443/
	url	http://149.62.173.247:8080/
	url	http://197.249.165.27:443/
	url	http://80.153.201.243:22/
	url	http://194.88.246.242:443/
	url	http://50.31.146.101:8080/
	url	http://24.217.117.217/
	url	http://78.47.182.42:8080/
	url	http://96.94.189.130:443/
	url	http://108.170.54.171:8080/
	url	http://184.186.78.177/
	url	http://189.236.94.20:995/
	url	http://216.105.170.139:4143/
	url	http://50.73.183.69/
----------------------------------------------
Main object- "rechnungszahlung-Nr0180_87.doc"
	sha256	a9e46fe6f26eee23427740e1cb3aefee7cf9621684edaedb966d394725332b2f
	sha1	0b82f9f55c7eb2b6f916134900ec4def45ef2ee5
	md5	915e693de6a9bfd5997484c5c5e77654
DNS requests
	domain	www.healthy.gmsto.com
	domain	024dna.cn
	domain	www.jxprint.ru
	domain	tecserv.us
	domain	techidra.com.br
HTTP/HTTPS requests
	url	http://techidra.com.br/eYE0Bjsz/
	url	http://www.healthy.gmsto.com/qrcC2Q/
	url	http://tecserv.us/TedsCars/gUSyoA7/
	url	http://www.jxprint.ru/Gj6zBk/
	url	http://024dna.cn/0rGSKVzu/
---------------------------------------------
Main object- "INV1928326040384393"
	url	http://www.amiralpalacehotel.com/Purchase/INV1928326040384393/
	sha256	b3e0c3db94c18eed05404d8f29c8353b9601e170a4ed6456df5b7a77d2924e74
	sha1	55649969127e11f54ce22166c3883259619359c9
	md5	fa15a1e8911825f42fec1f9bce646ac2
DNS requests
	domain	www.17184.p17.justsv.com
	domain	www.iconetworkllc.com
	domain	www.asdohasda.org
	domain	www.umjmnyqx.com
	domain	www.hoaphamxaydung.com

[Duplication Payload Domains]
----------------------------------------------
Main object- "Rechnungs-fur-Zahlung"
	url	http://www.arrifa.com/Rechnungs-fur-Zahlung/
	sha256	a5e5e88268b6edb1fa13cee068f6ecf8b5fb31ada12e9afebb5c2549812c1ef7
	sha1	50afff58110dd9839697aa8b420ecd8a7243a6d5
	md5	b9ab3017e2a694e3f7308059f32a1de7
DNS requests
	domain	www.createyourfuture.org.uk
	domain	the-grizz.com
	domain	pekny.eu
	domain	milldesign.com
	domain	thegilbertlawoffice.com
HTTP/HTTPS requests
	url	http://thegilbertlawoffice.com/Facturation/Kfa1i4MiD/
	url	http://the-grizz.com/gallery/g2data/hRjNssfWG/	         <---- [OpenDir]
	url	http://milldesign.com/84TqhmkDOW/
	url	http://pekny.eu/nC5GuNE/
	url	http://www.createyourfuture.org.uk/z5h2FEnyt/
------------------------------------------------
Main object- "Rechnung_2018_06_395914984.doc"
	sha256	afe37a79b49e80d09ab51400c291cb9d50b73cc561bb409c1d7b9c7bc3b002d0
	sha1	7ca9a6a8bb7afaf3b96f2b2c7c97850c28bdfe97
	md5	99b8d31f05e56d97ed335245110bf4ed
DNS requests
	domain	casamatamatera.it
	domain	www.qwqcpfhp.com
	domain	online-band.nl
	domain	cloudcapgames.com
	domain	windwardwake.com
HTTP/HTTPS requests
	url	http://windwardwake.com/YgRI/
	url	http://cloudcapgames.com/pSWMA/
	url	http://www.qwqcpfhp.com/7YMtk/
	url	http://casamatamatera.it/vvYa/
	url	http://online-band.nl/images/newspost_images/KXi68g/
--------------------------------------------------
Main object- "2018"
	url	http://www.beautifulgreat.com/RECH/Rechnung-vom-19/06/2018/
	sha256	32bbbe9e913054ba09dcee52cbcd8b755ea77d8655567387baf28e343d0513ae
	sha1	3fae4062f18ad138a609da44111697a093b0641b
	md5	4222eb0aaf76b788d07d411673911695
DNS requests
	domain	www.17184.p17.justsv.com
	domain	www.asdohasda.org
	domain	www.umjmnyqx.com
	domain	www.iconetworkllc.com
	domain	www.hoaphamxaydung.com

[Duplication Payload Domains]
--------------------------------------------------
Main object- "Invoice-45490"
	url	http://houselight.com.br/Jun2018/Invoice-45490/
	sha256	de0ecad318280b0dc89a7ee8251981b92b618cb14112369cf0f626b495c06804
	sha1	0c12a081c04ff43ba62baab6deb4656f5ba5c4a7
	md5	75be313380b9c6cc0cc2c4bd18687c31
DNS requests
	domain	www.hoaphamxaydung.com
	domain	www.iconetworkllc.com
	domain	www.asdohasda.org
	domain	www.17184.p17.justsv.com
	domain	www.umjmnyqx.com
HTTP/HTTPS requests
	[Duplication Payload Domains]
---------------------------------------------------
	url	http://www.masozilan.info/YAL1Ah/
	url http://skyleaders.com/OH7y4n2/
	url http://amexx.sk/Z6JYZ/
	url http://healthphysics.com.au/p0ACEU/
	url http://zafado.com/aspnet_client/zWDjgqBG/