2017-12-11 Emotet IOC's

SENDER:
sue6501[@]msn.com

SUBJECT:
PayPal Receipt Notice

MALDOC DISTRIBUTION:
hxxp://www.limsurat[.]ga/PayPal-US/DOC/
hxxp://goldennard[.]com/Dokumente/
hxxp://greenvelvetlandscape[.]com/Dokumente/
hxxp://derfrisoerladen[.]com/Information/
hxxp://dongnamduochoanganh[.]com/Dokumente/
hxxp://prem-company[.]com/Scan/
hxxps://ilkin[.]ru/Rechnung/
hxxp://blog.notesmaster[.]com/Informationen/
hxxp://www.stokenewingtoncricketclub[.]com/assets/export/Outstanding-INVOICE-AUWU/1305754/813/
hxxp://thebighorntechnologies[.]com/PayPal/LLC/
hxxp://smartcomercio[.]com/Order-Confirmation/

MALDOC DELIVERED:
30b30e8f521f6345fb03bf925385675b    (Paypal #1EN97J0EE7TU01M.doc)

PAYLOAD DISTRIBUTION:
hxxp://dota-store[.]ru/KsqcR1V/
hxxp://karpetmurah[.]net/hJ3ap/
hxxp://pittmans[.]ca/kpJJ/
hxxp://greencarpetpbc[.]com/pTKsoL/
hxxp://www.severingroup[.]ru/QV0PddQ/

PAYLOAD:
0679fc0bddb14183f71323a28f480304    (taskdhcp.exe)

C2:
hxxp://62.210.187[.]97:443/
hxxp://81.4.124[.]134:8080/
hxxp://173.255.217[.]114:443/
hxxp://180.131.139[.]203:8080/