EMOTET IOC's LATAM (Chile) Dropper Pattern 21-11-2018

##############################
Ultimate EMOTET IOC's LATAM
1ZRR4H, 21-11-2018, Chile.
##############################

- Dropper: ^(facture|fa|fact|factura|inv|invoice|recibo|boleta|untitled|nuevo)?([_\-\.]+)+(num|nro|no|inv|documento|acuerdo)?([_\-\.]?)(\w{7,10})?(\.)+(doc|pdf)+

- Email Subject: ^(factura|invoice|recibo|payment|reminder)?(.*)?(([a-zA-Z0-9]{8,10}))+/gmi

Patrón User-Agent de comunicación al C&C:

- User-agent: mozilla/4.0 (compatible; msie 7.0; windows nt 6.1; wow64; trident/7.0; slcc2; .net clr 2.0.50727; .net clr 3.5.30729; .net clr 3.0.30729; infopath.3; .net4.0c; .net4.0e)

EOF