Emotet_Feodo_IOC's_08-08-2018

#Emotet #Banking #Trojan #Malware
-------------------------------------
08-08-2018				IOC's
-------------------------------------
Main object- "NWM-CSLA"
	url	http://nizansigorta.com/Download/HTJJ87600868HRGPTO/098020657/NWM-CSLA/
	sha256	909c780364fe407032ed36022abd3054721fef762fb1e372472d888c3e60c81a
	sha1	f8de2a6d90bc4762909987801db5306ab8ff33ee
	md5	35c4d773782d7cfc379e85f8d1195469
DNS requests
	domain	scandryer.se
	domain	leisurecoinmachine.com
	domain	serborek.com
	domain	nase-rodina.cz
	domain	santacharityevent.com
Connections
	ip	198.143.149.12
	ip	81.2.195.172
	ip	45.40.182.41
	ip	94.73.150.147
	ip	93.188.2.51
HTTP/HTTPS requests
	url	http://scandryer.se/Y
		C2:
			http://54.39.58.168/
			http://96.3.21.210:20/
			http://23.25.83.53/
			http://216.21.168.27/
			http://173.184.118.165/
			http://109.75.36.105/
			http://173.195.17.3:443/
			http://108.170.54.171:8080/
			http://199.119.78.38:443/
			http://149.62.173.247:8080/
			http://103.59.201.76:443/
			http://111.93.226.226:465/
			http://100.38.109.244/
			http://209.15.84.54/
			http://73.70.43.159/
			http://222.214.218.192:4143/
			http://172.95.38.36:7080/
			http://81.154.227.235:8080/
			http://146.185.170.222:8080/
			http://118.244.214.210:443/
			http://199.119.78.9:443/
			http://46.105.131.87/
			http://78.47.182.42:8080/
			http://186.71.69.226/
			http://46.105.131.69:8080/
			http://202.141.245.30:443/
			http://24.245.228.104:8090/
			http://173.184.118.165:443/
			http://27.50.89.209:8080/
			http://157.7.164.23:8080/
			http://54.37.131.63/
			http://194.88.246.242:443/
			http://80.69.56.5:50000/
			http://173.197.222.214:443/
			http://71.244.60.231:4143/
			http://82.28.208.186/
			http://162.212.100.241:8443/
			http://54.38.40.148/
			http://194.150.118.8:443/

	url	http://leisurecoinmachine.com/XxO
			C2:
			http://54.39.58.168/
			http://216.21.168.27/
			http://173.195.17.3:443/
			http://96.3.21.210:20/
			http://173.184.118.165/
			http://109.75.36.105/
			http://23.25.83.53/
			http://108.170.54.171:8080/
			http://103.59.201.76:443/
			http://149.62.173.247:8080/
			http://199.119.78.38:443/
			http://100.38.109.244/
			http://209.15.84.54/
			http://81.154.227.235:8080/
			http://73.70.43.159/
			http://111.93.226.226:465/
			http://222.214.218.192:4143/
			http://46.105.131.69:8080/
			http://202.141.245.30:443/
			http://172.95.38.36:7080/
			http://78.47.182.42:8080/
			http://186.71.69.226/
			http://24.245.228.104:8090/
			http://199.119.78.9:443/
			http://80.69.56.5:50000/
			http://194.88.246.242:443/
			http://157.7.164.23:8080/
			http://46.105.131.87/
			http://146.185.170.222:8080/
			http://118.244.214.210:443/
			http://173.184.118.165:443/
			http://71.244.60.231:4143/
			http://194.150.118.8:443/
			http://27.50.89.209:8080/
			http://54.38.40.148/
			http://162.212.100.241:8443/
			http://54.37.131.63/
			http://82.28.208.186/
			http://173.197.222.214:443/

	url	http://santacharityevent.com/QKkQ
			C2:
			http://54.39.58.168/
			http://80.69.56.5:50000/
			http://173.197.222.214:443/
			http://216.21.168.27/
			http://96.3.21.210:20/
			http://173.195.17.3:443/
			http://173.184.118.165/
			http://109.75.36.105/
			http://103.59.201.76:443/
			http://23.25.83.53/
			http://108.170.54.171:8080/
			http://149.62.173.247:8080/
			http://199.119.78.38:443/
			http://209.15.84.54/
			http://73.70.43.159/
			http://100.38.109.244/
			http://81.154.227.235:8080/
			http://111.93.226.226:465/
			http://172.95.38.36:7080/
			http://186.71.69.226/
			http://222.214.218.192:4143/
			http://78.47.182.42:8080/
			http://202.141.245.30:443/
			http://46.105.131.69:8080/
			http://199.119.78.9:443/
			http://46.105.131.87/
			http://146.185.170.222:8080/
			http://118.244.214.210:443/
			http://24.245.228.104:8090/
			http://173.184.118.165:443/
			http://54.37.131.63/
			http://194.88.246.242:443/
			http://54.38.40.148/
			http://157.7.164.23:8080/
			http://27.50.89.209:8080/
			http://162.212.100.241:8443/
			http://194.150.118.8:443/
			http://71.244.60.231:4143/
			http://82.28.208.186/

	url	http://nase-rodina.cz/xoV9W6
			C2:
			http://54.39.58.168/
			http://173.195.17.3:443/
			http://96.3.21.210:20/
			http://216.21.168.27/
			http://173.184.118.165/
			http://108.170.54.171:8080/
			http://149.62.173.247:8080/
			http://109.75.36.105/
			http://23.25.83.53/
			http://103.59.201.76:443/
			http://199.119.78.38:443/
			http://209.15.84.54/
			http://73.70.43.159/
			http://81.154.227.235:8080/
			http://100.38.109.244/
			http://111.93.226.226:465/
			http://172.95.38.36:7080/
			http://46.105.131.69:8080/
			http://222.214.218.192:4143/
			http://186.71.69.226/
			http://202.141.245.30:443/
			http://78.47.182.42:8080/
			http://199.119.78.9:443/
			http://24.245.228.104:8090/
			http://46.105.131.87/
			http://118.244.214.210:443/
			http://146.185.170.222:8080/
			http://157.7.164.23:8080/
			http://80.69.56.5:50000/
			http://162.212.100.241:8443/
			http://54.38.40.148/
			http://54.37.131.63/
			http://173.184.118.165:443/
			http://27.50.89.209:8080/
			http://194.88.246.242:443/
			http://82.28.208.186/
			http://71.244.60.231:4143/
			http://173.197.222.214:443/
			http://194.150.118.8:443/

	url	http://serborek.com/b3eoWq
			C2:
			http://54.39.58.168/
			http://96.3.21.210:20/
			http://216.21.168.27/
			http://173.195.17.3:443/
			http://173.184.118.165/
			http://109.75.36.105/
			http://103.59.201.76:443/
			http://23.25.83.53/
			http://108.170.54.171:8080/
			http://149.62.173.247:8080/
			http://100.38.109.244/
			http://199.119.78.38:443/
			http://209.15.84.54/
			http://73.70.43.159/
			http://81.154.227.235:8080/
			http://111.93.226.226:465/
			http://172.95.38.36:7080/
			http://186.71.69.226/
			http://78.47.182.42:8080/
			http://222.214.218.192:4143/
			http://202.141.245.30:443/
			http://46.105.131.69:8080/
			http://146.185.170.222:8080/
			http://118.244.214.210:443/
			http://199.119.78.9:443/
			http://46.105.131.87/
			http://80.69.56.5:50000/
			http://24.245.228.104:8090/
			http://157.7.164.23:8080/
			http://54.37.131.63/
			http://54.38.40.148/
			http://194.88.246.242:443/
			http://27.50.89.209:8080/
			http://173.184.118.165:443/
			http://162.212.100.241:8443/
			http://71.244.60.231:4143/
			http://194.150.118.8:443/
			http://173.197.222.214:443/
			http://82.28.208.186/
-------------------------------------------
sorted
-------------------------------------------
54.39.58.168
96.3.21.210
23.25.83.53
216.21.168.27
173.184.118.165
109.75.36.105
173.195.17.3
108.170.54.171
199.119.78.38
149.62.173.247
103.59.201.76
111.93.226.226
100.38.109.244
209.15.84.54
73.70.43.159
222.214.218.192
172.95.38.36
81.154.227.235
146.185.170.222
118.244.214.210
199.119.78.9
46.105.131.87
78.47.182.42
186.71.69.226
46.105.131.69
202.141.245.30
24.245.228.104
173.184.118.165
27.50.89.209
157.7.164.23
54.37.131.63
194.88.246.242
80.69.56.5
173.197.222.214
71.244.60.231
82.28.208.186
162.212.100.241
194.150.118.8