2019-05-01 Emotet

2019-05-01 Emotet
=================
Hash for attachment
---------------------
418966916a85723a439c39665d05a1df

Hash of 'promptrelated'
------------------------
1BCE8E19F6CD5A1BE722A687EA00A81B --> https://www.virustotal.com/#/file/8b90a4fc2facead1c71323f5addce373cbb043985bdae943db55a330532f452c/detection

Hash of javascript
------------------
b50a6c7c8bca3313098edf0bb7e37029 --> https://www.virustotal.com/#/file/0920828ff5b7ceb1d38a80e3f89e8d5a3cce36bfec0d134df331abcd5acccd38/detection

Domains used
-------------
CONNECT hatmem.com:443
GET http://icv.edu.au/wp-includes/RH_Xw/
GET http://driveless.pt/wp-content/PB_D/
GET http://egd.jp/wp-admin/e_H/
GET http://gynet.com.ng/wp-content/Ch_BG/

C2 seen
--------
POST http://103.255.150.84/merge/
POST http://103.255.150.84/publish/
POST http://103.53.44.20/chunk/
POST http://103.53.44.20/window/
POST http://109.194.50.231/merge/
POST http://109.194.50.231/schema/publish/
POST http://119.15.153.237/schema/
POST http://119.15.153.237/sess/
POST http://119.93.243.2:50000/attrib/
POST http://119.93.243.2:50000/sess/
POST http://124.123.42.93/free/
POST http://124.123.42.93/json/
POST http://133.242.156.30:7080/results/
POST http://133.242.156.30:7080/tpt/
POST http://136.243.117.85:8080/pnp/
POST http://136.243.117.85:8080/vermont/
POST http://138.201.140.110:8080/attrib/srvc/ringin/
POST http://138.201.140.110:8080/usbccid/
POST http://144.202.9.18:8080/entries/ringin/ringin/
POST http://144.202.9.18:8080/publish/
POST http://147.135.210.39:8080/ringin/
POST http://147.135.210.39:8080/schema/
POST http://149.167.86.174:990/free/
POST http://149.167.86.174:990/results/
POST http://149.255.56.242:8080/forced/nsip/
POST http://149.255.56.242:8080/pnp/
POST http://162.243.125.212:8080/chunk/
POST http://162.243.125.212:8080/merge/
POST http://167.114.210.191:8080/cab/
POST http://167.114.210.191:8080/rtm/
POST http://173.255.196.209:8080/merge/
POST http://173.255.196.209:8080/publish/
POST http://174.93.130.148:8443/enabled/
POST http://174.93.130.148:8443/publish/
POST http://175.100.138.82:22/results/
POST http://176.63.173.71:995/raster/
POST http://176.63.173.71:995/usbccid/
POST http://177.230.108.144:22/publish/
POST http://177.230.108.144:22/window/
POST http://177.242.214.30/acquire/
POST http://178.152.78.149:20/between/
POST http://178.152.78.149:20/usbccid/
POST http://178.62.37.188:443/nsip/
POST http://178.62.37.188:443/rtm/
POST http://178.79.161.166:443/raster/
POST http://178.79.161.166:443/usbccid/
POST http://180.150.87.75:22/schema/
POST http://180.150.87.75:22/sess/
POST http://182.176.132.213:8090/balloon/
POST http://182.176.132.213:8090/json/
POST http://182.188.47.206:990/raster/
POST http://182.188.47.206:990/sym/
POST http://183.82.110.170:53/between/
POST http://183.82.110.170:53/rtm/
POST http://186.4.234.27:443/cab/
POST http://186.4.234.27:443/stubs/
POST http://186.85.38.31:443/free/iab/ringin/merge/
POST http://186.85.38.31:443/ringin/attrib/nsip/
POST http://187.189.195.208:8443/bml/
POST http://187.189.195.208:8443/walk/
POST http://189.134.78.42:50000/acquire/
POST http://189.134.78.42:50000/forced/
POST http://190.112.228.47:443/publish/
POST http://190.112.228.47:443/window/
POST http://190.193.18.37:20/attrib/
POST http://190.193.18.37:20/sess/
POST http://2.50.4.159:443/publish/
POST http://2.50.4.159:443/window/
POST http://2.50.52.255:20/raster/
POST http://2.50.52.255:20/sym/
POST http://201.220.152.101/merge/
POST http://201.220.152.101/publish/
POST http://208.78.100.202:8080/merge/
POST http://208.78.100.202:8080/publish/
POST http://211.63.71.72:8080/free/
POST http://211.63.71.72:8080/vermont/
POST http://212.22.215.140/pnp/badge/nsip/
POST http://212.22.215.140/stubs/
POST http://213.14.166.152:990/publish/
POST http://213.14.166.152:990/window/
POST http://216.98.148.156:8080/enable/
POST http://216.98.148.156:8080/ringin/
POST http://217.13.106.160:7080/vermont/
POST http://217.199.175.217:8080/nsip/forced/
POST http://217.199.175.217:8080/taskbar/xian/ringin/merge/
POST http://37.211.38.50/child/
POST http://37.211.38.50/nsip/
POST http://41.220.119.246/nsip/
POST http://45.123.3.54:443/pnp/
POST http://45.123.3.54:443/results/
POST http://45.33.49.124:443/chunk/
POST http://45.33.49.124:443/merge/
POST http://5.230.147.179:8080/between/
POST http://5.230.147.179:8080/json/
POST http://50.31.0.160:8080/cab/
POST http://50.31.0.160:8080/stubs/
POST http://50.99.132.7:465/balloon/
POST http://50.99.132.7:465/results/
POST http://58.65.211.99:50000/jit/
POST http://58.65.211.99:50000/vermont/
POST http://58.9.168.7:990/results/
POST http://59.103.164.174/stubs/
POST http://62.75.187.192:8080/prep/
POST http://62.75.187.192:8080/window/
POST http://64.13.225.150:8080/chunk/
POST http://64.13.225.150:8080/window/
POST http://67.205.149.117:8080/attrib/
POST http://67.205.149.117:8080/sess/
POST http://69.198.17.7:8080/json/
POST http://69.198.17.7:8080/pnp/
POST http://69.45.19.145:8080/between/
POST http://69.45.19.145:8080/xian/img/nsip/merge/
POST http://69.45.19.252:8080/forced/img/ringin/
POST http://69.45.19.252:8080/raster/arizona/ringin/
POST http://75.177.169.225/child/taskbar/ringin/
POST http://75.177.169.225/prov/
POST http://77.56.253.112/attrib/
POST http://77.56.253.112/srvc/
POST http://78.100.187.118/free/
POST http://78.100.187.118/json/
POST http://78.186.5.109:443/merge/
POST http://78.186.5.109:443/publish/
POST http://78.188.7.213:8090/ringin/
POST http://78.188.7.213:8090/schema/
POST http://83.110.155.238:8090/nsip/
POST http://83.110.155.238:8090/stubs/
POST http://84.241.10.111:53/raster/
POST http://84.241.10.111:53/usbccid/
POST http://85.104.59.244:20/raster/
POST http://85.104.59.244:20/usbccid/
POST http://86.99.35.122:20/enable/attrib/ringin/
POST http://86.99.35.122:20/entries/
POST http://87.106.139.101:8080/raster/
POST http://87.106.139.101:8080/usbccid/
POST http://91.205.215.66:8080/balloon/
POST http://92.154.101.154:50000/merge/
POST http://92.154.101.154:50000/publish/
POST http://94.130.35.140:443/balloon/
POST http://94.130.35.140:443/vermont/
POST http://94.76.200.114:8080/acquire/
POST http://94.76.200.114:8080/sym/
POST http://95.128.43.213:8080/merge/enable/nsip/
POST http://95.128.43.213:8080/splash/