Emotet hosted in Japan (herlash[.]cn) 19/Nov/2019

Source: https://urlhaus.abuse.ch/feeds/country/JP/
Reference: https://app.any.run/tasks/e0fbcb30-b03e-4872-bea2-bf22ec403452

-----------------------------------------------------------------------------------
Main object- "sQzSPKQGg"
	url	http://www.herlash.cn/wp-includes/sQzSPKQGg/
	sha256	11aa06fe42f6903cfc4feb92907910b2f955338bacd97bb346e10158b28d6a56
	sha1	44588ada0f0b456a7c64c60237afd8feca4f51f5
	md5	11a984d2a6d22c19a50024020f67705b
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe	11aa06fe42f6903cfc4feb92907910b2f955338bacd97bb346e10158b28d6a56
DNS requests
	domain	mail.rhombuscx.com
	domain	bow.intnet.ne
	domain	mail.hotelgrace21.com
	domain	smtp.yandex.com
	domain	mail.disenarmobiliario.com
	domain	mail.antronexpress.net
	domain	mail.yandex.com.tr
	domain	mail.sili.com.br
	domain	mail.texgengroup.com
	domain	ns1.cp-in-19.bigrockservers.com
	domain	mail.daxtechnologies.co.za
	domain	mail.kilimograndresort.co.ke
	domain	mail.nupeldabosphorushotel.com
	domain	mail.dellasboutiquehotel.com
	domain	imap.gmail.com
	domain	pop.ujoint.co.za
	domain	mail.bestofwaste.org
	domain	vmail.fetnet.net
	domain	mail.sultanestate.co.ke
	domain	mail.gmail.com
	domain	mail.protezione.com.pe
	domain	secure.emailsrvr.com
	domain	smtp.gmail.com
	domain	xemail.axact.com
	domain	mail.yaanartech.com
	domain	smtp.v5global.com
	domain	smtp.1und1.de
	domain	smtp.vodamail.co.za
	domain	mail.dwarikas.com
	domain	smtp.geo-sat.net
	domain	gator4143.hostgator.com
	domain	smtp.hostinger.mx
	domain	mail.mail.yahoo.com
	domain	mail.gmurgente.es
	domain	mail.bcriativo.com.br
	domain	mail.compeve.com
	domain	mail.seargas.com
	domain	envoy.aserv.co.za
	domain	sslin.df.eu
	domain	email-ssl.com.br
	domain	pop3.mkygumruk.com
	domain	smtp.mail.me.com
	domain	pop3.uservers.net
	domain	smtp.orange.fr
	domain	smtp.yandex.com.tr
	domain	syrow.in
	domain	mail.rembrandtbkk.com
	domain	smtp-mail.outlook.com
	domain	pop.umbler.com
	domain	mail.jrawat.co.za
	domain	mail.dulichsoha.vn
	domain	mail.rsvservice.com
	domain	smtp.yandex.ru
	domain	mail.ukraine.com.ua
	domain	shankergroup.com
	domain	mail.hostinger.com
	domain	mail.svsreut.ru
	domain	mail.gh.ge
	domain	smtp.unitechgroup.com
	domain	mail.t-online.de
	domain	mail.pcmlab.cl
	domain	mail.alwaleedcargo.com
	domain	mail.gwazalaw.co.za
	domain	mail.thuruliya.lk
	domain	mail.smartcloudpt.pt
	domain	business29.web-hosting.com
	domain	mail.klintscales.co.za
	domain	mx1.tecnosmart.in
	domain	mail.10digi.com
	domain	mail.reliastics.com
	domain	smtp.entire.com.tw
	domain	mail.acerosjg.cl
	domain	apoyodigital.com.pe
	domain	imap.mail.yahoo.com
	domain	volkswagen.websitewelcome.com
	domain	pop.sincalpinturas.com.br
	domain	mail.mandalaybeach.org
	domain	mail.procofoundrycc.co.za
	domain	mail.boost.com.na
	domain	mail.bizmail.yahoo.com
	domain	smtp.secureserver.net
	domain	pegasus.namhost.com
	domain	cp29-jhb.za-dns.com
	domain	mail.alltechnology.net
	domain	mail.coseducam.cl
	domain	imap.balibeautyandwellness.co.za
	domain	pop3.netnam.vn
	domain	mail.flexsin.com
	domain	mail.dht-za.com
	domain	smtpout.secureserver.net
	domain	tbird.websitewelcome.com
	domain	mail.outlook.com
	domain	mail.synergytechsolutions.in
	domain	mail.alfaairspring.com
	domain	single-priva8.privatednsorg.com
	domain	smtp.orange.tn
	domain	mail.telkomsa.net
	domain	mail.3jsolutions.com.pk
	domain	single-5922.banahosting.com
	domain	mail.iei-co.com
	domain	smtp.grupoaservi.com
	domain	smtp.mail.yahoo.com
	domain	imap.ionos.es
	domain	mail.a11.com.tr
	domain	zmail.naintec.co.kr
	domain	mail.secureserver.net
	domain	smtp.lantic.net
	domain	mail.live.com
	domain	imap.movistarnegocios.com
Connections
	ip	103.53.43.82
	ip	149.202.153.251
	ip	83.169.39.213
	ip	216.25.6.131
	ip	200.170.82.150
	ip	88.99.94.131
	ip	222.239.249.166
	ip	92.119.123.10
	ip	77.88.21.158
	ip	202.191.120.13
	ip	41.138.59.18
	ip	197.242.151.110
	ip	103.197.57.45
	ip	203.188.252.35
	ip	192.185.90.36
	ip	77.88.21.39
	ip	69.73.181.161
	ip	173.254.59.174
	ip	204.80.91.244
	ip	196.11.146.149
	ip	192.185.144.121
	ip	146.20.161.10
	ip	129.232.136.211
	ip	82.145.43.153
	ip	61.20.35.47
	ip	50.87.202.120
	ip	23.235.197.128
	ip	182.76.9.6
	ip	212.227.15.183
	ip	124.41.240.51
	ip	134.119.228.56
	ip	197.242.153.180
	ip	191.252.112.194
	ip	192.185.76.248
	ip	5.189.166.46
	ip	195.42.142.12
	ip	93.89.226.87
	ip	178.162.214.68
	ip	192.185.4.155
	ip	96.9.96.162
	ip	17.56.8.136
	ip	67.210.97.65
	ip	82.98.139.119
	ip	145.14.159.244
	ip	41.185.8.232
	ip	193.252.22.84
	ip	187.84.237.61
	ip	201.148.105.85
	ip	40.101.138.210
	ip	103.27.238.14
	ip	202.166.193.242
	ip	77.104.170.152
	ip	41.185.8.223
	ip	217.26.163.82
	ip	193.169.5.19
	ip	197.242.148.203
	ip	177.84.63.122
	ip	196.40.97.106
	ip	103.228.112.123
	ip	164.160.91.22
	ip	199.201.88.46
	ip	13.251.201.34
	ip	210.64.72.214
	ip	67.227.227.189
	ip	68.178.213.37
	ip	202.151.160.96
	ip	198.54.114.199
	ip	124.43.128.156
	ip	180.180.243.251
	ip	129.232.251.18
	ip	202.162.242.9
	ip	192.185.81.250
	ip	62.153.158.211
	ip	85.238.35.28
	ip	185.104.44.17
	ip	170.10.163.111
	ip	195.201.13.112
	ip	217.146.190.234
	ip	188.125.73.26
	ip	169.48.195.189
	ip	192.185.2.101
	ip	93.89.226.136
	ip	105.187.200.240
	ip	50.87.119.115
	ip	109.232.216.24
	ip	193.95.123.24
	ip	50.31.174.34
	ip	186.64.119.235
	ip	41.185.13.224
	ip	142.4.204.94
	ip	190.107.176.3
	ip	184.154.249.82
	ip	173.201.192.229
	ip	66.96.160.148
	ip	197.242.144.125
	ip	121.254.193.198
	ip	212.227.15.151
	ip	212.227.15.135
	ip	209.203.34.199
	ip	103.11.74.118
	ip	97.74.135.143
	ip	185.53.179.6
HTTP/HTTPS requests
	url	http://222.239.249.166:443/forced/
	url	http://222.239.249.166:443/glitch/
	url	http://92.119.123.10:8080/news.php
	url	http://92.119.123.10:8080/cookies/
	url	http://92.119.123.10:8080/whoami.php
	url	http://92.119.123.10:8080/xian/merge/
	url	http://149.202.153.251:8080/news.php
	url	http://82.145.43.153:8080/news.php
	url	http://217.26.163.82:7080/prep/symbols/
	url	http://92.119.123.10:8080/srvc/
	url	http://92.119.123.10:8080/walk/