Emotet_Feodo_IOC's_07-07-2018

#Emotet #Feodo #Trojan #Banking #Malware
------------------------------------
07-07-2018			IOC's
------------------------------------
Main object- "Rech"
	url	http://clefhotel.com/wp-content/uploads/gescanntes-Dokument/RECHNUNG/Rech/
	md5	8e70efa38152a47c9b38de00e63db400
	sha1	1486b7bdc19016a3d4bb159a51a6295af92f1920
	sha256	fe590dbdd320aba2e342ba3da11a4d5f1a444c6dbfdbb2cb52828a353ba270de
DNS requests
	domain	www.srimahanspares.com
	domain	www.stmaryskarakolly.com
	domain	www.sisdecar.co
	domain	baute.org
	domain	www.standout.properties
Connections
	ip	160.153.137.59
	ip	160.153.137.19
	ip	160.153.137.166
	ip	69.65.3.251
HTTP/HTTPS requests
	url	http://www.stmaryskarakolly.com/ZsOzUr/
	url	http://www.srimahanspares.com/jhEGnt/
	url	http://baute.org/F26PYur/
	url	http://www.standout.properties/TIi4xt/
	url	http://www.sisdecar.co/xRpge/
-------------------------------------
Main object- "Invoice-9804489"
	url	http://www.serviciiseosem.ro/Jul2018/US/Client/Invoice-9804489/
	md5	f51dbf79dd7bac307dae0920f772ba14
	sha1	0ee179673f0dd8a512a651677741c529879614d1
	sha256	dcc2f0505200561b763882c2a1267a5c3b5708c6fba9c01eb4e12c871de22c31
DNS requests
	domain	www.shamelesslyjamie.com
	domain	www.srinivastata.net
	domain	www.enjoyuk.com.cn
	domain	call4soft.com
	domain	www.xn---1-dlcmp7ch.xn--p1ai
Connections
	ip	204.9.187.75
	ip	114.115.201.114
	ip	160.153.137.59
	ip	160.153.137.167
	ip	31.31.196.178
HTTP/HTTPS requests
	url	http://www.srinivastata.net/vdMRwHc/
	url	http://www.shamelesslyjamie.com/VAdTQ/
	url	http://www.enjoyuk.com.cn/RhtgMgw/
	url	http://www.xn---1-dlcmp7ch.xn--p1ai/fUrd/
	url	http://call4soft.com/5YSGMO/
-------------------------------------
Main object- "701119"
	url	http://izumrude.ru/newsletter/US_us/Purchase/701119/
	md5	1f639672921d96ee7af878d511c7c254
	sha1	e025c1824d7683ca1a9a5dae4e15054ef5989717
	sha256	ec71ae3910edb9d54d51b10e06885a0ef8d0d00e73db29774df45a06fc85c624
DNS requests
	domain	www.docgihomnay.org
	domain	www.elearning.stkippersada.ac.id
	domain	www.egesatizmir.com
	domain	www.dnaadv.org
	domain	www.crystaldesignerstudio.com
Connections
	ip	45.119.83.225
	ip	132.148.253.120
	ip	31.220.58.163
	ip	160.153.44.4
	ip	89.252.180.152
HTTP/HTTPS requests
	url	http://www.docgihomnay.org/Qi1lYCO/
	url	http://www.elearning.stkippersada.ac.id/theme/eJUff/
	url	http://www.egesatizmir.com/m6jUP/
	url	http://www.dnaadv.org/u6/
	url	http://www.crystaldesignerstudio.com/Q/
-------------------------------------
Main object- "Greeting-Cards-2018"
	url	http://nutriglobe.com/Greeting-Cards-2018/
	md5	e679f63abdaed4de212ac31bc5b613e7
	sha1	92ba51d0583b256752d3ec165d6d5281c4855696
	sha256	3f83f98dc636339d2bc5f361b4e3699888f123092f1bacb234e0704be26319f6
DNS requests
	domain	www.asifabih.com
	domain	www.dispozicija.viamedia.ba
	domain	www.bodyarmor.nu
	domain	www.disp.viamedia.ba
	domain	www.anadolu-yapi.com
Connections
	ip	64.13.232.218
	ip	195.74.38.97
	ip	94.73.146.86
HTTP/HTTPS requests
	url	http://www.asifabih.com/jzo/
	url	http://www.dispozicija.viamedia.ba/JpDFY/
	url	http://www.disp.viamedia.ba/EdsQhMy1/
	url	http://www.bodyarmor.nu/PNNma/
	url	http://www.anadolu-yapi.com/U4/

-------------------------------------
Main object- "Invoice-3783726981-07-05-2018"
	url	http://vinlotteri.jenszackrisson.se/En/Jul2018/Invoice-3783726981-07-05-2018/
	md5	373a638b0dba94d564e52d0b61bf0842
	sha1	95de0e6be5c2945a7b56aea86abd4e6c26777188
	sha256	304c2fd63a14d5afdd567ba816bb6db6592f34629df70b0065e99ef6eab4113c
DNS requests
	domain	www.l600.ru
	domain	www.trakyapeyzajilaclama.com
	domain	epsl.fr
	domain	www.cryptoguy.xyz
	domain	amc.gov.co
Connections
	ip	31.169.92.162
	ip	37.252.102.185
	ip	64.90.34.209
	ip	217.160.0.133
	ip	81.177.139.233
HTTP/HTTPS requests
	url	http://www.trakyapeyzajilaclama.com/6ixMfeC/
	url	http://www.l600.ru/0Lc0/
	url	http://epsl.fr/7t/
	url	http://www.cryptoguy.xyz/ZG/
	url	http://amc.gov.co/GVA/
-------------------------------------
Main object- "Rechnungs"
	url	http://www.manzoti.com/testeab/Rechnungs/
	md5	0ded1e121234d69958f96b0801801a0a
	sha1	f0f2bd2bd29ecf27e4d14e3ec7b4e8017a1ee821
	sha256	4b0d67d68a8feb662b08bd902fe0123571db5cd7b7fc94644621dddc1ac809de
DNS requests
	domain	www.saekaruniacemerlang.com
	domain	www.shop-weave.com
	domain	www.smartideasart.com
	domain	www.luganaparcoallago.com
	domain	www.yann-artes.com
Connections
	ip	103.28.22.60
	ip	160.153.137.59
	ip	160.153.137.167
	ip	195.242.191.68
	ip	95.110.162.154
HTTP/HTTPS requests
	url	http://www.saekaruniacemerlang.com/vEtash0DW/
	url	http://www.shop-weave.com/aqldgd/
	url	http://www.yann-artes.com/h0QFEQ7/
	url	http://www.smartideasart.com/cuVEB6/
	url	http://www.luganaparcoallago.com/wp-content/languages/n1Jd7LWwy/

-------------------------------------
Main object- "Invoice-64060"
	url	http://www.sher-e-sadaf.com/sites/US/DOC/Invoice-64060/
	md5	1fe45b8bb97bd71225db1421a6c50b77
	sha1	30453913a1d53972f832f6466388b296297b82d6
	sha256	c739364981a283eefc63a7ec98a1786331e2a16ec4a955fc1a06085ed784e51b
DNS requests
	domain	www.shangrila-escapes.com
	domain	www.simblissity.co.uk
	domain	www.shelleylamb.com
	domain	www.stmlenergy.co.uk
	domain	www.stonedesigncenter.es
Connections
	ip	160.153.137.153
	ip	160.153.137.167
	ip	160.153.137.20
	ip	160.153.137.166
	ip	160.153.138.74
HTTP/HTTPS requests
	url	http://www.shangrila-escapes.com/4Z69ffL/
	url	http://www.simblissity.co.uk/D8zsDLV/
	url	http://www.stonedesigncenter.es/Yk2wT89/
	url	http://www.stmlenergy.co.uk/JxbI/
	url	http://www.shelleylamb.com/TKf2J/

-------------------------------------
-------------------------------------
-------------------------------------