2017-12-27 EMOTET INDICATORS

DOC DISTRIBUTION:
http://balloons-suppliers.com/Christmas-Gift-Card/
http://christythematchmaker.com/Gift-Card-for-you/
http://pcmp.sheratonwalls.com/Holidays-Card/
http://sashapikula.com/Your-Holidays-eCard/
http://setupstaffing.com/Holidays-gift-card/
http://www.mini-kuehlschrank.com/Outstanding-Invoices/Outstanding-Invoices/

DOC DELIVERED:
64e1d71670e880b74f41ac33c6739078
98461340a03e38489be1d94d658fed973f09572733a0077ba64ed69524104391

DOC LURES OBSERVED:
Awaiting for your confirmation.doc
Christmas card.doc
Christmas eCard.doc
Christmas Gift Card.doc
eCard.doc
eGift Card.doc
Gift Card for you.doc
Gift Card.doc
Happy Holidays Card.doc
Holidays Card.doc
Holidays eCard.doc
Holidays gift card.doc
INCORRECT INVOICE.doc
Invoice# 28593517.doc
Invoice# 82827957.doc
Invoice.doc
Invoices attached.doc
Invoices Overdue.doc
Outstanding INVOICE BNEQ-4331987-4638.doc
Outstanding INVOICE RCIPM-1479635-9978.doc
Outstanding INVOICE SMYKQ-399065-126.doc
Outstanding INVOICE UCGHD-1361203-6593.doc
Outstanding Invoices.doc
Overdue payment.doc
Please send copy invoice.doc
Purchases 2017.doc
Sales Invoice.doc
Your Card.doc
Your Christmas Card.doc
Your Christmas Gift Card.doc
Your eCard.doc
Your eGift Card.doc
Your Gift Card.doc
Your Holidays Card.doc
Your Holidays eCard.doc
ZUTAP6-31198304156.doc

PAYLOAD DISTRIBUTION:
http://bigeggdrop.com/WpDpV1/
http://blog.siplik.com/vTW5jY/
http://charlesdundas.co.uk/iMpi/
http://ericvu.space/wp-content/yfOqkf/
http://henrycorreadearaujo.com/lV92j/
http://manisahaber724.com/UoJtK/
http://missajj.com/Es3Vfu/

PAYLOADS DELIVERED:
ee6dcb546ca9e0871fe85bf2696f2b4b
47d18a04eba1a830628d7ac85339741dd6585375165ec109064b246e6c74fc55
9d77ab34ec61191c30c39ee42fa5aa2e
581d04a0e2cd45b09e48d827eb75d3d15263fbe98344d65967bb428cec1e614f
6fb78ca4eef9d0c4179735904dc1d1d6
e3f6ba8e8f4289b63a772baa7387eb823fe69f88242463603700bd6457176be0

C2:
http://149.202.153.252:8080
http://198.20.243.145:8080
http://82.131.166.44:8080
http://87.106.247.42:8080
http://194.88.246.242:443
http://85.214.219.12:443

REFS:
https://www.hybrid-analysis.com/sample/98461340a03e38489be1d94d658fed973f09572733a0077ba64ed69524104391?environmentId=100 (doc)
https://www.virustotal.com/#/file/98461340a03e38489be1d94d658fed973f09572733a0077ba64ed69524104391/details (doc)
https://www.virustotal.com/#/file/47d18a04eba1a830628d7ac85339741dd6585375165ec109064b246e6c74fc55/detection (payload1)
https://www.virustotal.com/#/file/581d04a0e2cd45b09e48d827eb75d3d15263fbe98344d65967bb428cec1e614f/community (payload2)
https://www.virustotal.com/#/file/e3f6ba8e8f4289b63a772baa7387eb823fe69f88242463603700bd6457176be0/community (payload3)