2020-10-01 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

CYBERCHEF RECIPE TO DECODE POWERSHELL SCRIPT
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Extract_URLs(false)

SENDERS OBSERVED
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

MALDOC DISTRIBUTION URLS
http://gustosoesemplice.com/m1owt/browse/xSVV1qjDSNdBB60qJMNv/
https://gncnacionaldeconsultores.com/wp-admin/docs/gJvCmGFHW46/
https://www.erfa.web.tr/wp-admin/parts_service/PMI0MTmVu4I/
https://hian.vn/wp-content/uploads/elementor/FGMZR3A8IQ6UK1/4fe5VO9t7viTQQBYc5O/
http://infoquick.co.uk/business_card/browse/xXUc1CrZr378je64W65/
http://ganeshkulariya.com/wp-includes/SFIZNsASdtrsroTw7o/
http://jegsnet.com/wp-content/browse/MXLm4RagesLCAcKap6f/
http://rezvankosar.ir/dpqbUXK3el/jMk8jBlFFmx/
http://zabor-pro.store/bfn/Reporting/mu3sHgNkdLAKvynPSWP/
http://www.sifesro.com/wp-includes/0EM6NXHC9OXU4B/NkMmTWIVsbYkyF2Ilc3I/
http://qutiche.cn/wp-admin/Document/edxJZZaYURAGsWWWP/
https://hao.fengxiaopeng.cn/wp-includes/VPRZSX0F5PE/sFAS1JsUPoLc7TwZDge/
http://amberadvisors.com.hk/wp-admin/browse/2179pirozapdgyqu/
http://hianstore.com/wp-content/swift/13eul7/
http://thietkenoithatthongminh.org/wp-content/statement/
http://vanphongmau.com/swift/ree11m4o21hfjjxk55/
http://enetra.in/wp-content/DOC/9pixkh/
http://metube.world/wp-admin/report/
http://profblogging.com/wp-admin/esp/
http://360wifi.com.cn/wp-admin/css/parts_service/
http://pailingroup.net/wp-admin/8iwwnxts6wtq9twp75kpv/
http://partohesab.ir/www/paclm/g682w/
https://pixelwalkerrproduction.com/model/sites/
http://siyahkalemresim.com/yedek/invoice/kpz9b3ruixkp/uaaoutps/
http://mail.jogjatraveling.com/Drupa/eTrac/
http://scaierp.com/wp-content/DOC/udxfi9hiq/n8qgmqd5b4o25ye967kvq/
http://hcrg.com.cn/temp/90m4ehxxtgy/ka8h23ffp/
https://pablobrothel.com.ar/local-cgi/jrxl2ncx/
http://viser.in/indexing/browse/
https://rtgpanama.com/eviltwin_sym/attachments/qiyukxs/
http://woodmet.eu/ayeu/y4grqbd/
https://avozdecamacari.com/wordpress/docs/7c6xb589f1cqxjxv335m6g1htflpp4/
https://sylhetibeautiespower.com/wp-includes/212/
http://91idea.cn/28k/paclm/nlyphoos/
http://dev.pearsonsystemofcourses.com/home-v/5ueeswuld943/
http://polotshirts.in/wp-admin/pzjxjd9vy3j/
http://www.dsupay.com/wp-includes/statement/

360wifi.com.cn
91idea.cn
amberadvisors.com.hk
avozdecamacari.com
dsupay.com
enetra.in
erfa.web.tr
fengxiaopeng.cn
ganeshkulariya.com
gncnacionaldeconsultores.com
gustosoesemplice.com
hcrg.com.cn
hian.vn
hianstore.com
infoquick.co.uk
jegsnet.com
jogjatraveling.com
metube.world
pablobrothel.com.ar
pailingroup.net
partohesab.ir
pearsonsystemofcourses.com
pixelwalkerrproduction.com
polotshirts.in
profblogging.com
qutiche.cn
rezvankosar.ir
rtgpanama.com
scaierp.com
sifesro.com
siyahkalemresim.com
sylhetibeautiespower.com
thietkenoithatthongminh.org
vanphongmau.com
viser.in
woodmet.eu
zabor-pro.store

DOCUMENT FILE HASHES
0243cf093d73e2674286d3abef15ba88
557571e2f5c9d58a43041fbfefd8cdb4
a95e7e92bb1b841374a0bd7cb7d38b95
d21e1d25494dde142bd9903ecc1cb4e1
d2fa39377308477182334bfbb0db6cee
f0883d1ebd68625a669d9170ee8ac8de

ZIP FILE HASHES
5e6537c953536ec7cbcb6fca63ab626f
3eda6bc01ae448f3d9eb901596dbef53
658af3c2cb0f03f5bd78c133a7c6cab5

PAYLOAD FILE HASHES
235eb871cc45547cadf7295bce527a5e
750b5f92b78b5a74631638818185a9c5
e5231879765859945650d5da7122164d
ec753fb223e613e2e1f18e089849bf03
fa8cfb25e530f508aa8cf0a3e5f7f958
fc871f902715aea1511649abd98ec7ce

EMOTET PAYLOAD URLs
http://1999beats.com/torrent/Wg8iT/
http://3ilogics.net/dprj/serviceapi/TU/
http://ashgroup.org/wp-snapshots/Ap/
http://banglashongbad.com/wp-content/sW/
http://blog.zunapro.com/wp-admin/i/
http://brycebrumley.com/wp-admin/IR/
http://buddinosaur.us/wp-includes/gdNzHVmMo/
http://cannabisdiscoverycenter.com/wp-includes/hvzL/
http://carewanderlust.com/wp-includes/zgz0N/
http://carstarai.com/stats/D/
http://codienvietnhat.com/dieuhoavietnhat/oYL/
http://coinketchup.com/wp-content/uploads/Dedzk1U/
http://criterianexpress.com/cgi-bin/q9Ghl/
http://cse-engineer.com/cgi-bin/jm/
http://damaniasons.com/images/1sWs7WMJUW/
http://drdlwallace.com/wp-admin/qo8kgFkc/
http://electronicsvibes.com/wp-includes/A9n/
http://ezisync.com/home/wp-content/tMe/
http://financiamentointeligente.com/wp-content/F/
http://gncnacionaldeconsultores.com/videos/wMS0CC2H/
http://healthcureathome.com/ALFA_DATA/ZD/
http://huaibangchina.com/kic3kc/fq4/
http://packzon.in/wp-content/DFKpVL1b/
http://pattanitkpark.com/gipe2h/BIY/
http://ps.sywwl.cn/web/QQT7D/
http://stockspert.co.in/wp-admin/gxi3lwcB/
http://techinotebook.com/wp-includes/GTu/
http://techinull.com/journal/euW/
http://techisquare.com/blog/zFj/
http://veepeeinternational.co.in/wp-admin/m7/
http://www.bionet.nsc.ru/core/cache/8/
http://www.hnqdyq.com/wp-content/wEr/
http://www.jornco.com/wp-admin/z/
http://www.kheshtkhane.com/wp-admin/d4/
http://www.removepctrojan.com/wp-admin/K/
http://www.sabbathcovenant.com/wp-content/HgFPlMBeU/
http://www.sff3d.com/3d/D/
http://youthhub.tk/icon/DOP1kC/
http://zwawish.com/lagais/w/
https://acupuncture-sandiego.com/Deutsche2/O6/
https://amazinlash.com/huuks/vFkAptcAV/
https://beu-hr.com/9gqqi5eat/K2y/
https://blog.zunapro.com/wp-admin/i/
https://buildmarker.com/wp-content/uploads/N/
https://burbujitasplash.com/sprites/Xp7y/
https://devanyastore.com/wp-content/K/
https://emmaidea.com/wp-includes/q/
https://krishnaoilindustries.com/wp-admin/545HlW/
https://listingera.com/wp-includes/RMM/
https://manhtien.net/wp-includes/Tw3/
https://sandonato.beer/wp-admin/NIpUBO98/
https://shopdocauca.com/wp-includes/CKq8j/
https://theshaywest.com/wp-admin/V/
https://tvinstallationofatlanta.com/wp-includes/nMZ/
https://www.laoyebh.com/phpMyAdmin4.8.5/QY0T/
https://www.moragphotography.co.uk/wp-admin/VEuMa540C/
https://www.mycollegecp.com/wp-admin/W/

1999beats.com
3ilogics.net
acupuncture-sandiego.com
amazinlash.com
ashgroup.org
banglashongbad.com
beu-hr.com
bionet.nsc.ru
brycebrumley.com
buddinosaur.us
buildmarker.com
burbujitasplash.com
cannabisdiscoverycenter.com
carewanderlust.com
carstarai.com
codienvietnhat.com
coinketchup.com
criterianexpress.com
cse-engineer.com
damaniasons.com
devanyastore.com
drdlwallace.com
electronicsvibes.com
emmaidea.com
ezisync.com
financiamentointeligente.com
gncnacionaldeconsultores.com
healthcureathome.com
hnqdyq.com
huaibangchina.com
jornco.com
kheshtkhane.com
krishnaoilindustries.com
laoyebh.com
listingera.com
manhtien.net
moragphotography.co.uk
mycollegecp.com
packzon.in
pattanitkpark.com
removepctrojan.com
sabbathcovenant.com
sandonato.beer
sff3d.com
shopdocauca.com
stockspert.co.in
sywwl.cn
techinotebook.com
techinull.com
techisquare.com
theshaywest.com
tvinstallationofatlanta.com
veepeeinternational.co.in
youthhub.tk
zunapro.com
zwawish.com

EMOTET C2s
http://116.91.240.96
http://167.71.227.113:8080
http://190.85.46.52:7080
http://162.144.42.60:8080
http://202.166.170.43
http://95.216.205.155:8080
http://120.51.34.254
http://103.93.220.182
http://111.89.241.139
http://60.125.114.64:443
http://45.177.120.37:8080
http://185.86.148.68:443
http://75.127.14.170:8080
http://119.92.77.17
http://203.153.216.178:7080
http://172.96.190.154:8080
http://179.5.118.12
http://153.229.219.1:443
http://139.59.12.63:8080
http://115.79.195.246
http://103.229.73.17:8080
http://195.201.56.70:8080
http://190.192.39.136
http://183.77.227.38
http://45.239.204.100
http://192.163.221.191:8080
http://46.32.229.152:8080
http://73.55.128.120
http://113.203.238.130
http://138.201.45.2:8080
http://180.148.4.130:8080
http://77.74.78.80:443
http://115.79.59.157
http://91.83.93.103:443
http://181.80.129.181
http://41.185.29.128:8080
http://178.33.167.120:8080
http://185.208.226.142:8080
http://91.75.75.46
http://86.57.216.23
http://143.95.101.72:8080
http://118.33.121.37
http://116.202.10.123:8080
http://103.80.51.61:8080
http://54.38.143.245:8080
http://50.116.78.109:8080
http://128.106.187.110
http://139.59.61.215:443
http://190.191.171.72
http://58.27.215.3:8080
http://223.17.215.76
http://37.205.9.252:7080
http://37.46.129.215:8080
http://46.105.131.68:8080
http://192.241.220.183:8080
http://24.231.51.190
http://113.161.148.81
http://109.206.139.119
http://118.243.83.70
http://185.142.236.163:443
http://172.105.78.244:8080
http://185.80.172.199
http://190.194.12.132
http://36.91.44.183
http://200.116.93.61
http://192.210.217.94:8080
http://93.20.157.143
http://198.57.203.63:8080
http://78.186.65.230
http://175.103.38.146
http://115.135.158.13
http://113.160.248.110
http://88.247.58.26
http://157.7.164.178:8081
http://67.121.104.51:20
http://74.208.173.91:8080
http://113.156.82.32
http://51.38.201.19:7080
http://14.241.182.160
http://79.133.6.236:8080
http://169.1.211.133
http://202.153.220.157
http://8.4.9.137:8080
http://220.106.127.191:443
http://5.79.70.250:8080
http://37.187.100.220:7080
http://113.193.239.51:443