2019-01-17 EMOTET INDICATORS

SENDER:
[email protected]

SUBJECT:
Amazon.com order

BODY LINK:
hxxp://houara[.]com/Amazon/Transactions/2019-01

MALDOC DELIVERED:
502971d9b2bf2c94eb44b2f3d785f00b
a2c1de9ebcd839379fc5c37b62028607230587faeb92a3f46ff3dd925cd5c0c7

PAYLOAD DISTRIBUTION DOMAINS:
hxxp://adamallorca[.]org/Jw3mayRvk
hxxp://buyhomecare[.]net/RyoJj06p
hxxp://kosardoor[.]com/PbEu786
hxxp://kynangtuhoc[.]com/WRCk6xGo9s
hxxp://www.antique-carpets[.]com/PIpK4IlRd

PAYLOADS OBSERVED:
79b8983099201e6075f1606d71bb0267
0c516d67a29a48e621675cb943472571e23de620b78c269b59c7c0a9e29262bd

3b2e63529acc34cbb4ea9e81871cdcd4
2c4feeaba7c7a3a7760ef02be73e0e0b28edc9ac8ae25bc44b5c63a5d866d1cc

C2 TRAFFIC OBSERVED:
181.211.11.171:443
181.45.45.132:8443
186.15.66.98:443
189.225.146.180:8443
190.190.101.38:443
192.155.90.90:7080
66.50.57.73:8080
69.163.33.82:8080
-
181.164.8.8:22
181.211.11.171:443
186.15.66.98:443
187.163.177.194:22
189.129.134.124:20
189.225.146.180:8443
190.190.101.38:443
66.50.57.73:8080