Emotet IoC 23092020

Compromised sites:

*https://theonesmartpiano.com/wp-content/KP/
*http://elcastilloencantado.es/wp-content/frCFOI/
*https://comunicacaovertical.com.br/agencia/B1/
*https://www.altopropiedades.cl/fonts/j/
*http://rootsroundup.com/css/n1xlBA/
*https://idilsoft.com/admin/oHOD0ih/
*http://inso.asia/administrator/KMAJZZb/

CnC :
http://162.241.41.111:7080/o1PdcyI/cGNEdqbyxr/3G3CCVwc/Gd2YXYd2ITuEG/kyuTBHun/Z9qsy1G/

SHA256:
(exe downloaded from compromised sites)

fae6183aeac4cee4162fede5b3ac9dcaa0dc83389fa4ffa36cb1c3672ff23943  20203974509.doc
9db65db53d5ce42d0e5b62484781f3bc2cda06b1c46781f5ca726fadf6bbd696  ASFoz.exe(elcastilloencantado.es)
7e4668167a12c525ebe0be040adf2712f0ef9a23cad5a39f16a248af4478cc8c  bHSxhi.exe(theonesmartpiano.com)
43fa3406daa5ed5d306991705f21063c201c4877c618d2b9085c84f8af94c86b  K.exe(altopropiedades.cl)
76887e987cfca5506c85b3274a157f82db64d8589c067de456403fe36a2933d8  PnkA.exe(idilsoft.com)
3131ee963e93a417868c9d1c4aaf7d8c0b542309c620fdd42a13fc84ed55424e  q0ice6PJuYi95HmM7.exe(inso.asia)
4a58a75a5e15df5d33f4072ad3ca53b3607837a5b0c9c1ec228947316aa16307  Q8q8jtJD9lXKwAZs.exe(comunicacaovertical.com.br)
b5ef8a3d3222312943776e5fd7a2c5cde218406bd96b168286ae91245f1702b3  uOv.exe(rootsroundup.com)

c8564defe91d4f0ad3eb735d87e8faa2ea035490a65ef4e031bded1c36f1be49  cscript.exe

Document not detected from VirusTotal at 09-23-2020 06:43 UTC -3