2019-01-18 EMOTET INDICATORS

SENDER:
sales[@]future-techit[.]com

SUBJECT:
Re: Invoice: 7337

ORIGINATING IP:
69.89.24[.]40

BODY LINK:
hxxp://www.apresearch[.]in/DLmp-xu_OLaIwMvn-LI/INVOICE/63494/OVERPAYMENT/US_us/Invoice-Corrections-for-22/75

DOCS OBSERVED:
99c117751f0dafe09ffba970c2ee8c36
7a3ff399ae0e54ae6fa2397bf53fb857948733d335f0dc96f13d062f932ffe9d

0f1ea7f77892a45314f75b4d956fb153
2fb2dd2ea0e4e28a2e9441c26d3cd363f3193ed5caac2b9a1b5a4e382cd42e4d

PAYLOAD DISTRIBUTION DOMAINS:
hxxp://mimiabner[.]com/22D_ZGrV5aY_AvvRf
hxxp://nt-group[.]kz/86Rzn_wmF7RyQ7F
hxxp://hartarizkigraha.co[.]id/wp-admin/JF0bdEb_lnQt6dKQ
hxxp://tasmatbaa[.]com/1MXeJC9_KSsQ7B
hxxp://trend-studio[.]art/k6jaCgS_Ukfd_apNei38I6

PAYLOADS OBSERVED:
351f386cd0f879e462e6c8e7e7c27bb7
a8af5012288a755f26a7110dd9c3e3f353a760243659afdb9d589a11a9609ee4

c7b610b49191ab824db786a3ac1c546d
9913f5482dd2e93fddf77ad2fc8c9c02a0f9712fe6253110369978c3c298f920

C2 TRAFFIC OBSERVED:
hxxp://118.175.93[.]254:995/
hxxp://186.67.88[.]242:465/
hxxp://187.144.78[.]190:20/
hxxp://189.129.160[.]167:20/
hxxp://190.138.221[.]70:53/
hxxp://196.210.47[.]216:443/
hxxp://59.102.162[.]246:995/
hxxp://96.22.189[.]104:990/