Emotet_Feodo_IOC's_30-08-2018

#Emotet #Feodo #Banking #Trojan #Malware
----------------------------------------------
30-08-2018					IOC's
----------------------------------------------
Main object- "LloydsBank_Payment_Remittance_Advice_606665.doc"
	sha256	869d2c750c91ff932065ffe1bfdb39e95c1cd8a0407cd917df4fc10c2ab44493
	sha1	f9a5274598fdd1c2f788c53b1890d32036b99b44
	md5	4364bbf2d8fc801f98e8f8e5282c2f3c
DNS requests
	domain	tonyleme.com.br
	domain	tresillosmunoz.com
	domain	lunacine.com
	domain	sg2i.com
	domain	www.yuanjhua.com
Connections
	ip	45.40.182.129
	ip	177.11.53.48
	ip	134.0.11.179
	ip	167.114.158.225
	ip	50.93.198.131
HTTP/HTTPS requests
	url	http://tresillosmunoz.com/2HB
			C2:
			http://213.79.36.67/
			http://189.250.174.245:7080/
			http://24.90.102.247:443/
			http://199.38.204.218/
			http://24.98.3.183:990/
			http://50.125.99.70:443/
			http://2.220.176.75/
			http://67.251.11.28:443/
			http://201.170.115.201:443/
			http://118.174.151.25:8080/
			http://157.7.164.23:8080/
			http://199.119.78.38:443/
			http://24.194.235.193/
			http://173.68.6.147/
			http://81.16.240.39/
			http://78.47.182.42:8080/
			http://24.40.230.254/
			http://82.19.6.143/
			http://24.253.16.214:50000/
			http://201.183.153.243:8080/
			http://194.150.118.8:443/
			http://222.214.218.192:4143/
			http://67.245.84.8/
			http://146.185.170.222:8080/
			http://95.141.175.240:443/
			http://199.119.78.9:443/
			http://71.251.192.132/
			http://211.115.111.19:443/
			http://173.70.36.136:443/
			http://201.142.170.69:8443/
			http://118.41.9.171/
			http://199.119.78.19:443/
			http://118.244.214.210:443/
			http://199.119.78.23:443/
			http://84.200.106.120:8080/
			http://47.206.102.188:443/
			http://184.70.141.226:8080/
			http://46.105.131.69:8080/
			http://14.1.39.3:443/
			http://78.102.51.229/
			http://93.103.89.117/
			http://69.198.17.7:8080/

	url	http://tonyleme.com.br/8l3XcSKQ
			C2:
			http://199.38.204.218/
			http://189.250.174.245:7080/
			http://213.79.36.67/
			http://24.90.102.247:443/
			http://2.220.176.75/
			http://24.98.3.183:990/
			http://50.125.99.70:443/
			http://67.251.11.28:443/
			http://201.170.115.201:443/
			http://118.174.151.25:8080/
			http://157.7.164.23:8080/
			http://199.119.78.38:443/
			http://173.68.6.147/
			http://24.194.235.193/
			http://81.16.240.39/
			http://24.40.230.254/
			http://78.47.182.42:8080/
			http://194.150.118.8:443/
			http://67.245.84.8/
			http://201.183.153.243:8080/
			http://222.214.218.192:4143/
			http://82.19.6.143/
			http://71.251.192.132/
			http://211.115.111.19:443/
			http://173.70.36.136:443/
			http://24.253.16.214:50000/
			http://199.119.78.23:443/
			http://69.198.17.7:8080/
			http://118.244.214.210:443/
			http://199.119.78.19:443/
			http://146.185.170.222:8080/
			http://95.141.175.240:443/
			http://199.119.78.9:443/
			http://14.1.39.3:443/
			http://47.206.102.188:443/
			http://118.41.9.171/
			http://93.103.89.117/
			http://84.200.106.120:8080/
			http://78.102.51.229/
			http://46.105.131.69:8080/
			http://184.70.141.226:8080/
			http://201.142.170.69:8443/

	url	http://sg2i.com/wwG
			C2:
			http://24.253.16.214:50000/
			http://213.79.36.67/
			http://24.90.102.247:443/
			http://189.250.174.245:7080/
			http://24.98.3.183:990/
			http://199.38.204.218/
			http://67.251.11.28:443/
			http://2.220.176.75/
			http://201.170.115.201:443/
			http://118.174.151.25:8080/
			http://24.194.235.193/
			http://173.68.6.147/
			http://157.7.164.23:8080/
			http://199.119.78.38:443/
			http://50.125.99.70:443/
			http://81.16.240.39/
			http://82.19.6.143/
			http://67.245.84.8/
			http://222.214.218.192:4143/
			http://24.40.230.254/
			http://78.47.182.42:8080/
			http://71.251.192.132/
			http://194.150.118.8:443/
			http://201.183.153.243:8080/
			http://173.70.36.136:443/
			http://95.141.175.240:443/
			http://211.115.111.19:443/
			http://199.119.78.9:443/
			http://199.119.78.23:443/
			http://146.185.170.222:8080/
			http://199.119.78.19:443/
			http://118.244.214.210:443/
			http://201.142.170.69:8443/
			http://69.198.17.7:8080/
			http://47.206.102.188:443/
			http://93.103.89.117/
			http://118.41.9.171/
			http://46.105.131.69:8080/
			http://14.1.39.3:443/
			http://184.70.141.226:8080/
			http://84.200.106.120:8080/
			http://78.102.51.229/

	url	http://lunacine.com/CQ
			C2:
			http://95.141.175.240:443/
			http://24.90.102.247:443/
			http://213.79.36.67/
			http://189.250.174.245:7080/
			http://199.38.204.218/
			http://24.98.3.183:990/
			http://67.251.11.28:443/
			http://50.125.99.70:443/
			http://2.220.176.75/
			http://201.170.115.201:443/
			http://24.40.230.254/
			http://78.47.182.42:8080/
			http://81.16.240.39/
			http://199.119.78.38:443/
			http://173.68.6.147/
			http://118.174.151.25:8080/
			http://24.194.235.193/
			http://157.7.164.23:8080/
			http://67.245.84.8/
			http://24.253.16.214:50000/
			http://194.150.118.8:443/
			http://222.214.218.192:4143/
			http://201.183.153.243:8080/
			http://82.19.6.143/
			http://173.70.36.136:443/
			http://199.119.78.23:443/
			http://146.185.170.222:8080/
			http://199.119.78.9:443/
			http://71.251.192.132/
			http://199.119.78.19:443/
			http://211.115.111.19:443/
			http://118.244.214.210:443/
			http://69.198.17.7:8080/
			http://46.105.131.69:8080/
			http://93.103.89.117/
			http://201.142.170.69:8443/
			http://47.206.102.188:443/
			http://118.41.9.171/
			http://84.200.106.120:8080/
			http://184.70.141.226:8080/
			http://14.1.39.3:443/
			http://78.102.51.229/

	url	http://www.yuanjhua.com/OwUzt
			C2:
			http://201.183.153.243:8080/
			http://24.90.102.247:443/
			http://213.79.36.67/
			http://189.250.174.245:7080/
			http://24.98.3.183:990/
			http://67.251.11.28:443/
			http://199.38.204.218/
			http://50.125.99.70:443/
			http://2.220.176.75/
			http://201.170.115.201:443/
			http://157.7.164.23:8080/
			http://118.174.151.25:8080/
			http://24.194.235.193/
			http://199.119.78.38:443/
			http://173.68.6.147/
			http://24.40.230.254/
			http://81.16.240.39/
			http://78.47.182.42:8080/
			http://222.214.218.192:4143/
			http://67.245.84.8/
			http://82.19.6.143/
			http://71.251.192.132/
			http://194.150.118.8:443/
			http://173.70.36.136:443/
			http://24.253.16.214:50000/
			http://146.185.170.222:8080/
			http://211.115.111.19:443/
			http://95.141.175.240:443/
			http://69.198.17.7:8080/
			http://118.244.214.210:443/
			http://199.119.78.23:443/
			http://199.119.78.9:443/
			http://199.119.78.19:443/
			http://14.1.39.3:443/
			http://46.105.131.69:8080/
			http://93.103.89.117/
			http://201.142.170.69:8443/
			http://47.206.102.188:443/
			http://118.41.9.171/
			http://78.102.51.229/
			http://84.200.106.120:8080/
			http://184.70.141.226:8080/
-------------------------------------------------
Main object- "INV-010-0748.doc.zip"
	sha256	6eca2af8c63dc5701c3e42a308abfcc3c7ad4386a161a08833be17becce72b18
	sha1	b25a480b906d928a64e133f9be01eb77c2f81ca1
	md5	9ae099f5e3cc8257e0c7f21df95593a3
DNS requests
	domain	nossositio.pt
	domain	khalyndawholehealthservice.com.au
	domain	mainlis.pt
	domain	ar-text.nl
	domain	sigmanqn.com.ar
Connections
	ip	130.185.84.61
	ip	200.26.189.189
	ip	94.46.176.210
	ip	95.170.72.219
	ip	43.241.54.247
HTTP/HTTPS requests
	url	http://nossositio.pt/DHnw8iKCZM
			C2:
			http://192.226.247.73:7080/
			http://202.134.191.142:443/
			http://184.149.48.160:8443/
			http://181.48.19.4:8080/
			http://190.233.119.42:8090/
			http://51.52.210.93/
			http://189.193.88.137/
			http://87.140.80.252:8080/
			http://49.212.135.76:443/
			http://68.14.221.174:8080/
			http://45.33.14.245:8080/
			http://99.234.31.250/
			http://209.213.232.117/
			http://210.2.86.94:8080/
			http://178.63.118.195:8080/
			http://76.65.107.103:8443/
			http://189.154.155.174:443/
			http://67.184.210.222/
			http://190.120.22.227:8080/
			http://104.236.24.85:8080/
			http://37.120.175.15/
			http://80.153.203.197/
			http://203.198.129.4:8080/
			http://187.236.143.141:7080/
			http://186.1.5.138:443/
			http://198.199.185.25:443/
			http://217.13.106.203:4143/
			http://133.242.208.183:8080/
			http://209.213.232.117:443/

	url	http://khalyndawholehealthservice.com.au/cache/86ZilPJwz
			C2:
			http://184.149.48.160:8443/
			http://202.134.191.142:443/
			http://192.226.247.73:7080/
			http://209.213.232.117:443/
			http://181.48.19.4:8080/
			http://51.52.210.93/
			http://189.193.88.137/
			http://99.234.31.250/
			http://68.14.221.174:8080/
			http://87.140.80.252:8080/
			http://190.233.119.42:8090/
			http://209.213.232.117/
			http://45.33.14.245:8080/
			http://49.212.135.76:443/
			http://178.63.118.195:8080/
			http://67.184.210.222/
			http://76.65.107.103:8443/
			http://190.120.22.227:8080/
			http://210.2.86.94:8080/
			http://189.154.155.174:443/
			http://80.153.203.197/
			http://37.120.175.15/
			http://187.236.143.141:7080/
			http://198.199.185.25:443/
			http://133.242.208.183:8080/
			http://217.13.106.203:4143/
			http://104.236.24.85:8080/
			http://203.198.129.4:8080/
			http://186.1.5.138:443/

	url	http://sigmanqn.com.ar/r3GhhzLd
			C2:
			http://192.226.247.73:7080/
			http://181.48.19.4:8080/
			http://184.149.48.160:8443/
			http://202.134.191.142:443/
			http://190.233.119.42:8090/
			http://189.193.88.137/
			http://45.33.14.245:8080/
			http://49.212.135.76:443/
			http://99.234.31.250/
			http://209.213.232.117/
			http://87.140.80.252:8080/
			http://51.52.210.93/
			http://68.14.221.174:8080/
			http://189.154.155.174:443/
			http://67.184.210.222/
			http://210.2.86.94:8080/
			http://178.63.118.195:8080/
			http://76.65.107.103:8443/
			http://190.120.22.227:8080/
			http://104.236.24.85:8080/
			http://37.120.175.15/
			http://203.198.129.4:8080/
			http://80.153.203.197/
			http://187.236.143.141:7080/
			http://186.1.5.138:443/
			http://198.199.185.25:443/
			http://209.213.232.117:443/
			http://133.242.208.183:8080/
			http://217.13.106.203:4143/

	url	http://ar-text.nl/LYPBPas
			C2:
			http://202.134.191.142:443/
			http://217.13.106.203:4143/
			http://192.226.247.73:7080/
			http://184.149.48.160:8443/
			http://190.233.119.42:8090/
			http://181.48.19.4:8080/
			http://189.193.88.137/
			http://87.140.80.252:8080/
			http://209.213.232.117/
			http://51.52.210.93/
			http://99.234.31.250/
			http://45.33.14.245:8080/
			http://49.212.135.76:443/
			http://68.14.221.174:8080/
			http://178.63.118.195:8080/
			http://67.184.210.222/
			http://189.154.155.174:443/
			http://210.2.86.94:8080/
			http://76.65.107.103:8443/
			http://190.120.22.227:8080/
			http://187.236.143.141:7080/
			http://80.153.203.197/
			http://104.236.24.85:8080/
			http://37.120.175.15/
			http://203.198.129.4:8080/
			http://198.199.185.25:443/
			http://186.1.5.138:443/
			http://133.242.208.183:8080/
			http://209.213.232.117:443/

	url	http://mainlis.pt/ZfpsEep
			C2:
			http://184.149.48.160:8443/
			http://192.226.247.73:7080/
			http://202.134.191.142:443/
			http://181.48.19.4:8080/
			http://189.193.88.137/
			http://51.52.210.93/
			http://87.140.80.252:8080/
			http://190.233.119.42:8090/
			http://45.33.14.245:8080/
			http://49.212.135.76:443/
			http://99.234.31.250/
			http://209.213.232.117/
			http://68.14.221.174:8080/
			http://67.184.210.222/
			http://189.154.155.174:443/
			http://178.63.118.195:8080/
			http://210.2.86.94:8080/
			http://190.120.22.227:8080/
			http://76.65.107.103:8443/
			http://104.236.24.85:8080/
			http://203.198.129.4:8080/
			http://37.120.175.15/
			http://80.153.203.197/
			http://186.1.5.138:443/
			http://198.199.185.25:443/
			http://187.236.143.141:7080/
			http://217.13.106.203:4143/
			http://209.213.232.117:443/
			http://133.242.208.183:8080/


---------------------------------
			CREDITS
---------------------------------
@AmirRedh @dvk01uk