EMOTET December 18, 2017

EMOTET December 18, 2017 IOC

-----Original Message-----
From: Joe.Spoof@ [mailto:YourSpoofedCompany.com [email protected]]
Sent: Monday, December 18, 2017 7:37 AM
To: Target, Phishing
Subject: INCORRECT INVOICE

EXTERNAL SENDER: Verify links, attachments and sender before taking action



Payments made by direct debit will be collected 14 days from the date of the Bill.

http://www.danmerkelmedia.com/Final-Account/

Regards
[email protected]
=================================================

Malware SHA256: fdd6288747eb976a863966935b7800b1ed839ded3fe15dfa039a2c6f68b940b5
Payload: Word Document
https://www.hybrid-analysis.com/sample/fdd6288747eb976a863966935b7800b1ed839ded3fe15dfa039a2c6f68b940b5?environmentId=100

Phishing URLs
http://www.chooseordie.me/Outstanding-Invoices/
http://www.lazuria.co.uk/Invoice-Number-178550/
http://www.elastika-mitoglou.gr/Sales-Invoice/
http://www.fmedia.org/Outstanding-Invoices/
http://www.damoa.pro/Overdue-payment/
http://www.cableweb.org/Overdue-payment/
http://logoswift.net/Invoice/
http://www.exxecutive.com/Invoice-Number-35464/
https://enterpriseupdates.teamwork.com/Sales-Invoice/
http://www.chooseordie.me/Outstanding-Invoices/
www.finditinfondren.net/INCORRECT-INVOICE/
www.nagelpilzbehandeln.info/Outstanding-Invoices
http://www.nagelpilzbehandeln.info/Outstanding-Invoices/
www.imagemirror.ru/Invoice-Number-19700/
http://www.klesarstvo-antolasic.com/Invoices-Overdue/
http://www.farggrossisten.se/Sales-Invoice/
www.hollywoodproducts.us/Invoices-Overdue
http://www.danmerkelmedia.com/Final-Account/
http://oceangroup.pl/Outstanding-INVOICE-NZXZ/5166934/2962/
www.cableweb.org/Overdue-payment/
http://www.insuredmeds.com/Invoice/
http://www.finditinfondren.net/INCORRECT-INVOICE/
https://www.focussup.com/Outstanding-INVOICE-ECLPR/9243051/742/
http://www.jarealestateguide.com/Overdue-payment/
http://www.brewer.designgrotto.com/Invoice/