2020-09-01 Emotet IOCs

CYBERCHEF RECIPE TODECODE POWERSHELL
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Extract_URLs(false)

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
a-suzuki@zero-g-a.jp
cirebon_opr@masamedi.id
coletas@tadex.com.br
dario@dixonhomeshb.com.au
ecornejo@vyt.com.pe
engenharia1@jequitibapaisagismo.com.br
engineering@ganzberg.com
info@bankalla.se
justine.villanueva@glpackaging.ph
kyoumu@sakaijoshi.ac.jp
lsoto@notaria109cdmx.com.mx
malik@chassisprosoft.be
oficina@casadojapones.com.br
ppd@bjmarthel.com
rsalas@surmotors.com.pe
trangntt@tienhung.com.vn
ufficioragioneriatributi@comune.sanpaolosolbrito.at.it
yokoyama@ipc-pet.com

MALDOC DISTRIBUTION URLS
None

DOCUMENT FILE HASHES
2105f8cabb16da831bc2b55ce205aed9
2a8eae9d38ea26c0d26d4c544a640c4e
2b5ee1c1068cb6988570c3981645387a
3c3c4077441029753240fc33449ce4ab
4651957431311d3414a62f291b11a538
57bf0cb06e0e5ad9934ab53ca02be4fb
5a016be04d02979d6e6d6d22cfdd71dc
6bb1a8aead3c68dd4f2654e620999516
70c23f32d74040859c73b8ca2db24cc8
7c9c596cb2d08328e4de8a56db6f4f00
84a5bcbcbd6b5530232dbd4a97e262c8
ae67b1c5adcd26fe834e06b4b73b12d4
b464d6e86e243de15184963270ec8ccb
c666509785f48eee735c715c179b03be
da0e8753eec935fb816036f2f936299e
e444771158f350beec040433fa17dda4

PAYLOAD FILE HASHES
b750b69afc2060ebe72189e35206ee61
6692831f7dcdbc01bb5f72bdc2a2bb0a

EMOTET PAYLOAD URLs
http://handlestone.com/shadowbox/R/
http://hochzoll.net/bilder/N/
http://ie-innovations.com/insetPages/E/
http://impuls-tech.com/security/Ep/
http://inessilvanutrition.com/islow.co/J/
http://intemar2020.com/sites/all/modules/contrib/prod_check/G/
http://intrasistemas.com/cgi-bin/4/
http://itac2.com/wp-admin/S/
http://jemully.com/wp-admin/uxc/
http://jesusteam12.org/jt12/OV/
http://jmnwebmaker.com/images/vU/
http://jobcapper.com/8.7.19/ii/
http://jrmachines.com/phpbb/F/
http://jung-family.net/cgi-bin/ryb/
http://lblcomputacion.com/img/file/TzRHO/
http://lichenheim.de/1984/mi55m4797242/
http://linstitut.cat/wp-includes/attach/rtvRd/
http://loschelder.eu/bilder/t3vb78/
http://lueckebergfeld.de/cgi-bin/attach/vTDnvuQXDD/
http://m-neumeier.de/cgi-bin/attach/TvaCePYsJNfk/
http://nnpstv.com/newsletter/hDT/
http://nobius.org/hutchins/w/
http://oliverkremer.net/cgi-bin/file/mZpCq/
http://oneinsix.com/plesk-stat/S76/
http://outofphase.de/Uploads/J1tov1276668/
http://party-pix.org/cgi-bin/GVp/
http://pautz.org/cgi-bin/uB6/
http://ptwmusic.com/thumbs/TN/
http://refinanz.org/bachelorme_de/I/
http://relicatessen.com/index_htm_files/9/
http://rueckert-online.de/cgi-bin/Krh7nr1978/
http://rupertstreet.de/Heidis-Ex/attach/vCFSakPHq/
http://sabineschulte.net/cgi-bin/x/
http://samatechnics.com/_scripts/DWxipw/
http://sauerbeck.net/cgi-bin/MWROisGUDpB/
http://schaefer-frank.de/cgi-bin/cbj5rnqm65zm8312/
http://schaidl.de/bilder/kc1rs474657/
http://schickle.org/cgi-bin/file/WkNEqjyvmgM/
http://seattlebugsafari.com/Images/5JM/
http://sindicatodeseguridad.com/_borders/lXe/
http://snoeker.com/cgi-bin/AZ7/
http://spanferkelgrill-verleih.com/cgi-bin/Yk/
http://stall-rosenbusch.com/_/ynWT/
http://standontheedge.com/cgi-bin/C/
http://steuerbuero-nack.de/Grundseite/2HCi55se61/
http://stoepfer.de/cgi-bin/ZpQCmAkDJfWmY/
http://suma-kemper.de/AH_Horn/Im537a147258755/
http://sunshinestate-florida.com/cgi-bin/ZgSKUgs/
http://t-privat.de/cgi-bin/FQzGOWY/
http://tagamoga.de/GC/kfa4o59g111198/
http://thecomedycrowd.com/punkanary/O5/
http://thecreativeronin.com/wp/file/uzXiZSaTCSa/
http://tinerservis.com/cgi-bin/fqo/
http://tjdengler.info/cgi-bin/r/
http://toby-warren.com/cgi-bin/2ja/
http://tomssteakhouse.com/wp-includes/LbZjD/
http://uhlenbusch.info/WordPress_03/QE/
http://vanbaalen.info/cgi-bin/KF4/
http://vanbrast.com/bleech/fR/
http://varivoda.com/cgi-bin/897/
http://vidriodecoracion.com/wp-admin/MIH/
http://villatera.com/cgi-bin/CHy/
http://wakan-tanka.org/Kleinteile/E/
http://wasilewski-online.de/bilder/aqwtirl95549612/
http://weierstrass.de/Elch/file/XQrH/
http://westend-zoo.de/Bavaria/n9HCzf27r6wj6977/
http://westerndata.com.au/wp-includes/VTgoqii6r411691/
http://wetzi.de/cgi-bin/file/heLeDqESyV/
http://white-on-rice.com/Logos/U/
http://www.teleconx.com/cgi-bin/Svt/
http://xxfreshxx.de/bike/file/mRB/
http://zahnarzt-flensburg.com/cgi-bin/L8/
http://zoomandshootphotography.com/wp-includes/file/WZyzalVlzJWc/
https://jemully.com/wp-admin/uxc/
https://odeville.de/cgi-bin/file/OqSD/
https://prprofile.com/wp-admin/B2/
https://radiomuziekland.com/contact/f/
https://rbji.com/rbjfiles/5/
https://rubenwinkelman.nl/cgi-bin/lUH/
https://sedalaser.com/images/niq/
https://sunde-computer.de/WordPress_01/9lYAwhr0u1i3c3998381/
https://www.kunstefan.de/cgi-bin/ZwGV/
https://www.phoenix-internet.com/incontext/QJN/
https://www.tierrasinsolitas.com/prueba/e/
https://www.webhost4christ.org/LAMB/D/

handlestone.com
hochzoll.net
ie-innovations.com
impuls-tech.com
inessilvanutrition.com
intemar2020.com
intrasistemas.com
itac2.com
jemully.com
jesusteam12.org
jmnwebmaker.com
jobcapper.com
jrmachines.com
jung-family.net
kunstefan.de
lblcomputacion.com
lichenheim.de
linstitut.cat
loschelder.eu
lueckebergfeld.de
m-neumeier.de
nnpstv.com
nobius.org
odeville.de
oliverkremer.net
oneinsix.com
outofphase.de
party-pix.org
pautz.org
phoenix-internet.com
prprofile.com
ptwmusic.com
radiomuziekland.com
rbji.com
refinanz.org
relicatessen.com
rubenwinkelman.nl
rueckert-online.de
rupertstreet.de
sabineschulte.net
samatechnics.com
sauerbeck.net
schaefer-frank.de
schaidl.de
schickle.org
seattlebugsafari.com
sedalaser.com
sindicatodeseguridad.com
snoeker.com
spanferkelgrill-verleih.com
stall-rosenbusch.com
standontheedge.com
steuerbuero-nack.de
stoepfer.de
suma-kemper.de
sunde-computer.de
sunshinestate-florida.com
t-privat.de
tagamoga.de
teleconx.com
thecomedycrowd.com
thecreativeronin.com
tierrasinsolitas.com
tinerservis.com
tjdengler.info
toby-warren.com
tomssteakhouse.com
uhlenbusch.info
vanbaalen.info
vanbrast.com
varivoda.com
vidriodecoracion.com
villatera.com
wakan-tanka.org
wasilewski-online.de
webhost4christ.org
weierstrass.de
westend-zoo.de
westerndata.com.au
wetzi.de
white-on-rice.com
xxfreshxx.de
zahnarzt-flensburg.com
zoomandshootphotography.com

EMOTET C2s
http://50.121.220.50
http://51.75.33.122
http://54.37.42.48:8080
http://91.121.54.71:8080
http://83.169.21.32:7080
http://68.69.155.181
http://67.247.242.247
http://213.197.182.158:8080
http://45.173.88.33
http://111.67.12.221:8080
http://217.13.106.14:8080
http://191.99.160.58
http://178.148.55.236:8080
http://85.109.159.61:443
http://110.142.219.51
http://50.28.51.143:8080
http://77.90.136.129:8080
http://209.236.123.42:8080
http://72.135.200.124
http://184.66.18.83
http://61.92.159.208:8080
http://51.159.23.217:443
http://190.2.31.172
http://190.147.137.153:443
http://73.213.208.163
http://70.32.84.74:8080
http://104.131.103.37:8080
http://178.250.54.208:8080
http://181.30.61.163:443
http://64.201.88.132
http://177.72.13.80
http://68.183.190.199:8080
http://103.106.236.83:8080
http://87.106.46.107:8080
http://104.131.41.185:8080
http://45.16.226.117:443
http://114.109.179.60
http://192.241.143.52:8080
http://188.135.15.49
http://51.255.165.160:8080
http://192.241.146.84:8080
http://45.33.77.42:8080
http://94.176.234.118:443
http://185.94.252.27:443
http://190.195.129.227:8090
http://190.163.31.26
http://45.161.242.102
http://177.74.228.34
http://138.97.60.141:7080
http://68.183.170.114:8080
http://190.6.193.152:8080
http://190.24.243.186
http://72.47.248.48:7080
http://186.70.127.199:8090
http://186.103.141.250:443
http://58.171.153.81
http://187.162.248.237
http://185.94.252.12
http://213.60.96.117
http://178.79.163.131:8080
http://172.104.169.32:8080
http://77.238.212.227
http://216.10.40.16
http://219.92.8.17:8080
http://188.2.217.94
http://77.55.211.77:8080
http://212.174.55.22:443
http://170.81.48.2
http://24.135.1.177
http://199.203.62.165
http://204.225.249.100:7080
http://191.182.6.118
http://217.199.160.224:7080
http://190.115.18.139:8080
http://152.169.22.67
http://95.9.180.128
http://2.47.112.152
http://12.162.84.2:8080
http://174.100.27.229
http://65.36.62.20
http://181.129.96.162:8080
http://206.15.68.237:443
http://219.92.13.25
http://82.196.15.205:8080
http://212.71.237.140:8080
http://190.128.173.10
http://72.167.223.217:8080
http://71.197.211.156
http://190.190.148.27:8080
http://137.74.106.111:7080
http://46.28.111.142:7080
http://189.2.177.210:443
http://98.13.75.196
http://70.32.115.157:8080
http://177.73.0.98:443
http://82.76.111.249:443
http://91.219.169.180
http://189.131.57.131
http://5.196.35.138:7080
http://85.105.140.135:443

http://118.110.236.121:8080
http://149.202.5.139:443
http://153.92.4.96:8080
http://51.75.163.68:7080
http://46.32.229.152:8080
http://192.241.220.183:8080
http://173.94.215.84
http://188.0.135.237
http://45.182.161.17
http://74.208.173.91:8080
http://81.214.253.80:443
http://157.7.164.178:8081
http://162.249.220.190
http://192.163.221.191:8080
http://77.74.78.80:443
http://175.29.183.2
http://190.190.15.20
http://188.251.213.180:443
http://222.159.240.58
http://175.139.144.229:8080
http://185.142.236.163:443
http://177.94.227.143
http://181.113.229.139:443
http://46.105.131.68:8080
http://162.144.42.60:8080
http://41.185.29.128:8080
http://105.209.235.113:8080
http://186.227.146.102
http://81.17.93.134
http://190.96.15.50
http://82.239.200.118
http://101.50.232.218
http://75.127.14.170:8080
http://185.208.226.142:8080
http://195.201.56.70:8080
http://179.62.238.49
http://197.221.158.162
http://179.191.239.255
http://54.38.143.245:8080
http://91.75.75.46
http://2.144.244.204:443
http://190.136.179.102
http://24.26.151.3
http://118.101.24.148
http://139.59.12.63:8080
http://181.137.229.1
http://51.38.201.19:7080
http://178.33.167.120:8080
http://192.210.217.94:8080
http://223.17.215.76
http://60.125.114.64:443
http://172.96.190.154:8080
http://103.80.51.61:8080
http://190.225.150.234
http://168.0.97.6
http://201.235.10.215
http://73.84.105.76
http://172.105.78.244:8080
http://115.78.11.155
http://5.79.70.250:8080
http://197.232.36.108
http://185.86.148.68:443
http://86.98.143.163
http://91.83.93.103:443
http://189.39.32.161
http://113.203.250.121:443
http://95.216.205.155:8080
http://50.116.78.109:8080
http://190.164.75.175
http://66.61.94.36
http://143.95.101.72:8080
http://210.1.219.238
http://201.213.177.139
http://190.212.140.6
http://157.245.138.101:7080
http://179.5.118.12
http://190.55.186.229
http://8.4.9.137:8080
http://37.205.9.252:7080
http://71.57.180.213
http://198.57.203.63:8080
http://113.161.148.81
http://58.27.215.3:8080
http://190.53.144.120
http://203.153.216.178:7080
http://220.254.198.228:443
http://37.187.100.220:7080
http://181.122.154.240
http://37.46.129.215:8080
http://115.79.195.246
http://88.249.181.198:443
http://177.144.130.105:443