2020-09-02 Emotet IOCs


CYBERCHEF RECIPE TO DECODE POWERSHELL
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Extract_URLs(false)

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
[email protected]
[email protected]
[email protected]
[email protected]

MALDOC DISTRIBUTION URLS
http://atomek.eu/g4/http://FILE/9e24ckOJ03kGy0/
http://benjamin-follert.de/walkenhorst/https://INC/ojEezCNhNwH/
http://centrolegnoambiente.it/test/http://FILE/FFDMjocqzsSfcg/
http://conny-dethloff.de/cgi-bin/http://LLC/o0EkDzcgyC1MUJD/
http://danidatos.com/wp_01/http://public/koZtD3MTFWv7V113/
http://daniel-bergmann.eu/cgi-bin/https://Documentation/bq4FO78Bs7yr8c/
http://datawyse.net/cgi-bin/http://lm/Z38zZk7Lsh/
http://denzler-net.de/ce_vcounter/http://Document/ApCqqLRnMyrvWB/
http://dieterstula.de/cgi-bin/http://DOC/c4S5GlVo6M34IAbN/
http://gueler-pl.de/blog/https://parts_service/ItmTBR6u9Wnqt3VPx/
http://htkj.de/WordPress_01/https://esp/OiNU7fJml8RgO7bP/
http://infoestudio.es/cursos/http://Pages/gWQn6NCdsIfwrtzdf/
http://ivanmartinez.es/img/http://browse/Vyln3RL4p91g/
http://ivii.de/cgi-bin/http://parts_service/peGa6jL0l8AmYkQA/
http://jewefa.de/bearbeitet-hochzeit-gross/http://IpzbzJXQ0f4gZ/
http://joba-mikasch.de/Engel-Dateien/http://eTrac/z4cIykmpL6QOLKKMy/
http://jss-elektronik.de/lora/http://sites/brJPEX2K0kuusp3G/
http://juergens-gebaeudeservice.de/cgi-bin/http://OCT/rnZjFZAKfiSoGGbz8/
http://julegaveregn.dk/wp-admin/http://FILE/tJdkmCy7t7wIMk3sxch/
http://jung-inet.de/cgi-bin/http://117352951704/Ebazh5T2KFyPtniV/
http://justanotherrichkid.de/bilder/http://Overview/2jkW4DvghX/
http://karnival.es/coutot/https://Reporting/nqWc6ClaIeDvuBJVn8/
http://karsten2000.de/daten/http://DOC/S0RQXGFZXfqlj/
http://kbiinformatica.com.br/wU/http://Scan/6TCHQoF2O1TcF/
http://kedenburg.de/cgi-bin/https://public/j4E1pYUpOR1fYwGHbNtu/
http://klaschusnet.de/cgi-bin/http://sites/0xsjoP1018/
http://klein-stephan.de/cgi-bin/http://sites/UgkXWPxjA0y/
http://klotzprint.de/cgi-bin/https://browse/F4NglvCvcJNxBrYxpb/
http://kraus-world.com/cgi-bin/https://Scan/XCAYn3HTTlOhg8/
http://labers.de/linus/http://Reporting/bmLL3xVXEIFOEb4yy8m/
http://lapit.de/cgi-bin/https://lm/C5Xdyduia218/
http://lapit.de/cgi-bin/https:/lm/C5Xdyduia218/
http://m-kayser.de/DTCam/http://LLC/zQZ5KPFPZC/
http://marcus-kuehl.de/cgi-bin/https://browse/vh3tQA572BVQgOjcoq/
http://mariaseeds.es/wp-admin/https://FILE/VyJHvxduY5VEX/
http://mazzolas.ch/www.mazzolas.ch/http://OCT/9cAc3oxX99jTLMh1uqka/
http://minerva-bg.net/tutorials/http://lm/pRqWSkDIvzW/
http://mmanke.de/cgi-bin/https://lm/XUSXJZn4KXPr6UYVQLEs/
http://mtk-leuchten.de/bilder/http://FILE/7NFaogDXWvx/
http://osberatung.de/cgi-bin/http://esp/HM7r90NdRX3oWK/
http://ozols.de/cgi-bin/https://DOC/XXfaoVfpvcjPfg/
http://pdftechnik.de/bilder/https://Overview/P0jSmSEw89dIZAuIEu/
http://pielagodelmoro.es/captcha/https://esp/WD22my7lsdZrm/
http://pinkesocken.de/css/https://RPBYJISIYN/Db9NbEzGTptYDtDBB0kK/
http://pourcel.eu/cgi-bin/https://public/kOHD9xbHSHVwyIHu/
http://qualitysale.de/cgi-bin/http://OCT/gQWoTboPyX1kRTeqi/
http://rdbrd.de/assets/https://LLC/T9f7LbkEhym/
http://rdbrd.de/assets/https:/LLC/T9f7LbkEhym/
http://rechtsanwalt-storek.de/cgi-bin/http://Documentation/gKPYlDqI8y/
http://reifendienst-bender.de/Startseite/http://mTvNGgqdZ2CBKyVMGP/
http://reiten-in-stuttgart.de/cgi-bin/https://lm/W1C61q68YQG/
http://reprodesign-lobbe.de/_notes/https://OCT/YrIsgJyBQu/
http://reprodesign-lobbe.de/_notes/https:/OCT/YrIsgJyBQu/
http://rmc-schnecken.de/_private/http://Pages/oDDDuYxGyoFxePjT6v/
http://s-b-b.de/buehnenscout/https://attachments/5SGoMEVarp9XICTcpp/
http://s-b-b.de/buehnenscout/https:/attachments/5SGoMEVarp9XICTcpp/
http://sayn-net.de/MAF/http://sites/3kpJWvqdsIZfhv/
http://schmidt-lev.de/HIT_Hunde/https://browse/M7lmH9zO7KKPLB1SQUXx/
http://schockverlag.de/cgi-bin/https://attachments/39RXF3io1EN6YndK/
http://schockverlag.de/cgi-bin/https:/attachments/39RXF3io1EN6YndK/
http://seeger-fahrzeugtechnik.de/ce_photo/http://Document/Q4aCWlXLZK3Q6epxpmFo/
http://showrent.es/Showrent/https://docs/Ete0VZ4CmtXIFjjY7c/
http://siamimplement.co.th/download/http://docs/emN0lTNuYvvmz/
http://slugger.de/cgi-bin/https://INC/5RBnbwVIvevkQXg0/
http://socylmediapc.es/tools/https://Pages/UsrKpla3nV/
http://stadtkapelle-gaildorf.de/Bilder/http://INC/7oZYOI2imMaQgXo/
http://team-stark.de/cgi-bin/https://Scan/Od2iMqYVLThNyd/
http://tecnicadigital.es/cgi-bin/http://234586536483/5tBR4GnvkYsY/
http://tobias-erles.de/joomla_02/https://OCT/jV850cSu5KT6k/
http://tomreif.de/cgi-bin/http://DOC/9wfhPTWtmVjWXzEFw6G/
http://tuintrein.nl/cgi-bin/http://sites/AchNjBflu6r/
http://ugira.lt/cli/http://docs/LLTiiyXpavh69XwN/
http://ugira.lt/cli/http:/docs/LLTiiyXpavh69XwN/
http://ulrichjohn.de/Rammstein/http://DOC/D9MVqIteLUA0HkGD/
http://ultrawhite.nl/wp-includes/https://Overview/c7QWqzzekUQNLeSjLq1/
http://umeoka.co.jp/js/http://Scan/GE2y8QMiRe4WwNfkC9U/
http://wi-ne.de/cgi-bin/https://Documentation/L7KjTTT2wk2zg1ldLjqd/
http://wiebisa.de/cgi-bin/http://DOC/M24Thm8NFJA/
http://woitl.de/cgi-bin/https://Overview/i4LejrfHLZK/
https://chrisjatiplus.com/wp-content/uploads/2020/08/FB6260125790SF.doc
https://dziambor.net/[old]ufo361-vvs-promo/https://browse/y1olkqFHpWgJ2/
https://gutachter-kanzlei.de/wp-admin/http://public/PswTL1ZoiH16dCh47Q/
https://jpid.nl/data/https://sites/jl0fm5LmCXaJ3zxZ2/
https://kinesiolog.de/admin/http://Pages/ZCSMJdBrlrmDNHHWi92S/
https://krieger-family.de/alex42/https://lm/qH8NT1T7js4c/
https://nwfinanz.de/m/http://Documentation/aaWHOK4slhw/
https://obazda.de/WebCalendar_01/https://LLC/WV755sTkod/
https://tpw.es/wp-includes/http://INC/ldUriluUxtY6TbCI0Ac/
https://vogt-nrw.de/admin/http://YRP26Y8TKB3W2/VqfN3Yg0onEPmaf5H3/
https://wandelknooppunt.nl/cgi-bin/https://docs/nGYmJwssQl/
https://yoga-ein-lebensweg.de/cgi-bin/https://eTrac/A9GX8FUcM8ELyoCS/

atomek.eu
benjamin-follert.de
centrolegnoambiente.it
chrisjatiplus.com
conny-dethloff.de
danidatos.com
daniel-bergmann.eu
datawyse.net
denzler-net.de
dieterstula.de
dziambor.net
gueler-pl.de
gutachter-kanzlei.de
htkj.de
infoestudio.es
ivanmartinez.es
ivii.de
jewefa.de
joba-mikasch.de
jpid.nl
jss-elektronik.de
juergens-gebaeudeservice.de
julegaveregn.dk
jung-inet.de
justanotherrichkid.de
karnival.es
karsten2000.de
kbiinformatica.com.br
kedenburg.de
kinesiolog.de
klaschusnet.de
klein-stephan.de
klotzprint.de
kraus-world.com
krieger-family.de
labers.de
lapit.de
m-kayser.de
marcus-kuehl.de
mariaseeds.es
mazzolas.ch
minerva-bg.net
mmanke.de
mtk-leuchten.de
nwfinanz.de
obazda.de
osberatung.de
ozols.de
pdftechnik.de
pielagodelmoro.es
pinkesocken.de
pourcel.eu
qualitysale.de
rdbrd.de
rechtsanwalt-storek.de
reifendienst-bender.de
reiten-in-stuttgart.de
reprodesign-lobbe.de
rmc-schnecken.de
s-b-b.de
sayn-net.de
schmidt-lev.de
schockverlag.de
seeger-fahrzeugtechnik.de
showrent.es
siamimplement.co.th
slugger.de
socylmediapc.es
stadtkapelle-gaildorf.de
team-stark.de
tecnicadigital.es
tobias-erles.de
tomreif.de
tpw.es
tuintrein.nl
ugira.lt
ulrichjohn.de
ultrawhite.nl
umeoka.co.jp
vogt-nrw.de
wandelknooppunt.nl
wi-ne.de
wiebisa.de
woitl.de
yoga-ein-lebensweg.de

DOCUMENT FILE HASHES
337f367cf129b577295ed30e93fce0ae
90b1d02dc5056ce59a4676ee822e9fb6
bf41c627046a70a5809edb9d6c2e6e5e
d09ad9f2fdd568ad5e9a1994741ec74c

PAYLOAD FILE HASHES
03b1b9c059c319495f7818cb47d9569c
2cb5d4a19aa5438ed5240d663c348070
38e4cbe701b1779cc8cc1a63a2ee4f4a
3dc5feab87689f99d555606a5993a3d6
5219c85e93248e5c1995bac14ef95e4b
52b589d01a9a64444b6d1657dcc135fb
548fac349881d59544f7a023bc982fa0
63fafb0c7d8144b32a684043bc15a268
743ab81757a3971246ec4eacd671e0e5
7c2da5e6a35a9580e279aec11eadddf5
9336f2824c9f63a145d11b7f0a050901
a5bf704c2494b983964ecc18e84521ea
a899debf87e215e0deaeafc53ff30d1e
c0f9a3127a22238e9b5a65b9d11b8bb3
c41978c2f759bc1e6480e6fb02a37ac5
c97a0c293dfab2f02190dcd652b7635a
dc786276f9317c91c73e32b1ddf37716
f3febb5bea5a5da4d1d15e4c422e39fe
f5ea64a9d5c83c8c486f33036a17fd78

EMOTET PAYLOAD URLs
http://easyclipping.com/cgi-bin/Ym/
http://edenthedoors.com/wp-includes/nN/
http://elsolivers.com/tpv/DXo/
http://eltrafalgar.com/wp-includes/uYK/
http://entrenofutbol.com/C2/
http://evilnerd.org/cgi-bin/nUi/
http://fcf.net/wentzville/maK/
http://fortcollinsathletefactory.com/wp-admin/i/
http://frankfurtelfarolillo.com/laseu/c7/
http://gaffa-music.com/cgi-bin/UM/
http://gapesmm.org/old/M/
http://getming.com/forum/p/
http://gnadl.net/cgi-bin/cD/
http://goldschmiedemeister.net/bilder/9/
http://grabner-online.org/Bibelkonverter/GCH/
http://graficon.es/SOPORTE/PFY2b1s5v35546172/
http://greiser.net/Ebay/m/
http://grml.net/wp/C/
http://hoepfner-thoma.de/Resources/file/POyhgRg/
http://hubrich-hannover.de/Filme/file/CzHV/
http://lektorat-rauthe.de/cgi-bin/oiwqqIFJcs/
http://lember.de/cgi-bin/file/jOQmgRrKjAYB/
http://malini-design.de/cgi-bin/xtRegzHUptd/
http://mamakumpir.de/bilder/file/UbubmSFOLBYF/
http://mmoehring.de/alt-strato/ENQnQbMFcyz/
http://mmxiv.org/wp-snapshots/hwC/
http://musiversum.com/cgi-bin/attach/wJmPmWFZRU/
http://mym-buch.de/Alt/attach/iSd/
http://neotechnology.info/cgi-bin/C6wBSadg9e0313/
http://niokolo.com/0-Accueil_ALBUMS/ua/
http://schlink.net/file/file/AYcTpgPvKrjnc/
http://wernergansbergen.de/cgi-bin/file/dnxsUNfow/
http://www.luxurygt.com/wordpress/a73/
https://hopfenziz.de/bilder/attach/HsiZAvCRQwBx/
https://www.flexoarquitectura.com/wp-includes/Iu/

easyclipping.com
edenthedoors.com
elsolivers.com
eltrafalgar.com
entrenofutbol.com
evilnerd.org
fcf.net
flexoarquitectura.com
fortcollinsathletefactory.com
frankfurtelfarolillo.com
gaffa-music.com
gapesmm.org
getming.com
gnadl.net
goldschmiedemeister.net
grabner-online.org
graficon.es
greiser.net
grml.net
hoepfner-thoma.de
hopfenziz.de
hubrich-hannover.de
lektorat-rauthe.de
lember.de
luxurygt.com
malini-design.de
mamakumpir.de
mmoehring.de
mmxiv.org
musiversum.com
mym-buch.de
neotechnology.info
niokolo.com
schlink.net
wernergansbergen.de

EMOTET C2s
http://50.121.220.50
http://51.75.33.122
http://54.37.42.48:8080
http://91.121.54.71:8080
http://45.16.226.117:443
http://68.69.155.181
http://213.60.96.117
http://77.55.211.77:8080
http://152.169.22.67
http://110.142.219.51
http://2.47.112.152
http://206.15.68.237:443
http://217.13.106.14:8080
http://191.99.160.58
http://189.131.57.131
http://213.197.182.158:8080
http://94.176.234.118:443
http://61.92.159.208:8080
http://190.128.173.10
http://219.92.8.17:8080
http://190.115.18.139:8080
http://190.147.137.153:443
http://5.196.35.138:7080
http://190.163.31.26
http://70.32.115.157:8080
http://114.109.179.60
http://58.171.153.81
http://174.100.27.229
http://104.131.103.37:8080
http://68.183.190.199:8080
http://181.30.61.163:443
http://184.66.18.83
http://87.106.46.107:8080
http://82.76.111.249:443
http://192.241.146.84:8080
http://73.213.208.163
http://104.131.41.185:8080
http://181.129.96.162:8080
http://82.196.15.205:8080
http://186.70.127.199:8090
http://68.183.170.114:8080
http://111.67.12.221:8080
http://172.104.169.32:8080
http://219.92.13.25
http://45.33.77.42:8080
http://185.94.252.12
http://46.28.111.142:7080
http://51.255.165.160:8080
http://45.173.88.33
http://190.24.243.186
http://45.161.242.102
http://77.238.212.227
http://177.72.13.80
http://65.36.62.20
http://190.2.31.172
http://212.71.237.140:8080
http://64.201.88.132
http://91.219.169.180
http://212.174.55.22:443
http://95.9.180.128
http://72.135.200.124
http://178.250.54.208:8080
http://187.162.248.237
http://178.79.163.131:8080
http://77.90.136.129:8080
http://70.32.84.74:8080
http://98.13.75.196
http://190.6.193.152:8080
http://192.241.143.52:8080
http://83.169.21.32:7080
http://138.97.60.141:7080
http://137.74.106.111:7080
http://209.236.123.42:8080
http://199.203.62.165
http://51.159.23.217:443
http://50.28.51.143:8080
http://24.135.1.177
http://177.73.0.98:443
http://188.2.217.94
http://170.81.48.2
http://186.103.141.250:443
http://188.135.15.49
http://185.94.252.27:443
http://72.47.248.48:7080
http://177.74.228.34
http://216.10.40.16
http://103.106.236.83:8080
http://217.199.160.224:7080
http://190.190.148.27:8080
http://12.162.84.2:8080
http://85.109.159.61:443
http://85.105.140.135:443
http://204.225.249.100:7080
http://67.247.242.247
http://191.182.6.118
http://189.2.177.210:443
http://178.148.55.236:8080
http://72.167.223.217:8080
http://71.197.211.156
http://190.195.129.227:8090

http://118.110.236.121:8080
http://149.202.5.139:443
http://153.92.4.96:8080
http://51.75.163.68:7080
http://105.209.235.113:8080
http://77.74.78.80:443
http://51.38.201.19:7080
http://71.57.180.213
http://139.59.12.63:8080
http://185.86.148.68:443
http://179.62.238.49
http://58.27.215.3:8080
http://81.214.253.80:443
http://46.32.229.152:8080
http://197.221.158.162
http://81.17.93.134
http://118.101.24.148
http://86.98.143.163
http://46.105.131.68:8080
http://24.26.151.3
http://41.185.29.128:8080
http://54.38.143.245:8080
http://220.254.198.228:443
http://210.1.219.238
http://185.208.226.142:8080
http://91.75.75.46
http://157.7.164.178:8081
http://181.137.229.1
http://190.212.140.6
http://190.225.150.234
http://103.80.51.61:8080
http://190.53.144.120
http://177.144.130.105:443
http://101.50.232.218
http://162.144.42.60:8080
http://172.105.78.244:8080
http://185.142.236.163:443
http://45.182.161.17
http://8.4.9.137:8080
http://179.5.118.12
http://190.55.186.229
http://5.79.70.250:8080
http://88.249.181.198:443
http://73.84.105.76
http://198.57.203.63:8080
http://143.95.101.72:8080
http://190.190.15.20
http://2.144.244.204:443
http://190.164.75.175
http://189.39.32.161
http://115.78.11.155
http://186.227.146.102
http://192.210.217.94:8080
http://157.245.138.101:7080
http://60.125.114.64:443
http://179.191.239.255
http://37.205.9.252:7080
http://181.122.154.240
http://50.116.78.109:8080
http://91.83.93.103:443
http://82.239.200.118
http://113.161.148.81
http://192.163.221.191:8080
http://173.94.215.84
http://181.113.229.139:443
http://201.235.10.215
http://162.249.220.190
http://175.29.183.2
http://190.136.179.102
http://75.127.14.170:8080
http://115.79.195.246
http://188.0.135.237
http://223.17.215.76
http://74.208.173.91:8080
http://192.241.220.183:8080
http://37.187.100.220:7080
http://66.61.94.36
http://172.96.190.154:8080
http://95.216.205.155:8080
http://177.94.227.143
http://222.159.240.58
http://188.251.213.180:443
http://37.46.129.215:8080
http://190.96.15.50
http://203.153.216.178:7080
http://195.201.56.70:8080
http://113.203.250.121:443
http://197.232.36.108
http://178.33.167.120:8080
http://175.139.144.229:8080
http://168.0.97.6
http://201.213.177.139