Emotet-Feodo_C2_IOCs_EPOCH1_25-03-2019

#Emotet #Feodo #Banking #Trojan #C2 #Epoch1 #Payloads
------------------------------------------
25-03-2019			C2 + IOC's
------------------------------------------
Main object- "JZsFf"
http://toolbeltonline.com/wp-content/uploads/JZsFf/
	sha256	dc8552fe2a831aaa9b878a8f6d060c0d75360f6953663056f90564225637654e
	sha1	3f363ec33ff7ce29c2900aa2fa386de547039293
	md5	f9b631a502471840fb3cda49694ebf9e
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe	dc8552fe2a831aaa9b878a8f6d060c0d75360f6953663056f90564225637654e
Connections
	ip	115.75.36.220
	ip	186.5.100.92
	ip	204.138.46.166
	ip	190.121.143.147
	ip	82.73.220.225
	ip	200.125.190.126
	ip	139.59.19.157
	ip	174.109.4.153
	ip	51.255.50.164
	ip	72.47.248.48
	ip	192.163.199.254
	ip	210.2.86.72
	ip	23.254.203.51
	ip	190.117.206.153
	ip	71.43.73.58
	ip	69.163.33.82
	ip	109.104.79.48
	ip	192.155.90.90
	ip	190.15.198.47
	ip	71.11.157.249
	ip	208.180.246.147
	ip	5.9.128.163
	ip	181.56.165.97
	ip	189.208.239.98
	ip	200.116.26.234
	ip	181.228.211.100
	ip	181.61.221.146
	ip	219.94.254.93
	ip	186.138.205.189
	ip	138.68.139.199
	ip	70.28.3.120
	ip	92.48.118.27
	ip	190.185.241.151
	ip	162.104.1.255
	ip	66.209.69.165
	ip	181.16.4.180
	ip	109.73.52.242
	ip	144.76.117.247
	ip	209.159.244.240
	ip	190.146.86.180
	ip	190.210.3.93
	ip	89.211.193.18
	ip	189.250.145.98
	ip	165.227.213.173
	ip	173.248.147.186
	ip	186.3.188.74
	ip	185.86.148.222
	ip	24.137.254.148
	ip	91.205.215.57
	ip	159.65.76.245
HTTP/HTTPS requests
http://115.75.36.220:443
http://186.5.100.92:443
http://82.73.220.225
http://190.121.143.147:20
http://204.138.46.166:7080
http://192.163.199.254:8080
http://174.109.4.153:8090
http://139.59.19.157
http://200.125.190.126:8080
http://51.255.50.164:8080
http://23.254.203.51:8080
http://190.117.206.153:443
http://210.2.86.72:8080
http://72.47.248.48:8080
http://69.163.33.82:8080
http://190.15.198.47
http://192.155.90.90:7080
http://109.104.79.48:8080
http://71.11.157.249
http://71.43.73.58:443
http://189.208.239.98:443
http://200.116.26.234
http://181.56.165.97:53
http://181.228.211.100:443
http://186.138.205.189
http://181.61.221.146
http://5.9.128.163:8080
http://208.180.246.147
http://190.185.241.151:443
http://70.28.3.120:7080
http://66.209.69.165:443
http://219.94.254.93:8080
http://109.73.52.242:8080
http://144.76.117.247:8080
http://190.210.3.93:443
http://189.250.145.98:443
http://209.159.244.240:443
http://138.68.139.199:443
http://162.104.1.255:443
http://92.48.118.27:8080
http://24.137.254.148
http://190.146.86.180:443
http://165.227.213.173:8080
http://89.211.193.18
http://181.16.4.180
http://186.3.188.74
http://186.5.100.92:443
http://91.205.215.57:7080
http://159.65.76.245:443
http://115.75.36.220:443
http://173.248.147.186
http://185.86.148.222:8080
http://82.73.220.225
http://190.121.143.147:20
http://174.109.4.153:8090
http://51.255.50.164:8080
http://200.125.190.126:8080
http://192.163.199.254:8080
http://204.138.46.166:7080
http://139.59.19.157
-------------------------------------
Main object- "598i"
http://firstmnd.com/wp/wp-content/598i/
	sha256	ef094061275f9028e0552aa0460e7bb99b3430fe2e48fd4f6856e4e80779d8f2
	sha1	3268266c7e6350a7f24894e6e957eb2d00ddd899
	md5	7d9512b754b0d0d9c56c137abdd25511
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe	ef094061275f9028e0552aa0460e7bb99b3430fe2e48fd4f6856e4e80779d8f2
Connections
	ip	186.5.100.92
	ip	115.75.36.220
	ip	82.73.220.225
	ip	190.121.143.147
	ip	200.125.190.126
	ip	204.138.46.166
	ip	174.109.4.153
	ip	139.59.19.157
	ip	51.255.50.164
	ip	72.47.248.48
	ip	23.254.203.51
	ip	192.163.199.254
	ip	71.11.157.249
	ip	190.15.198.47
	ip	190.117.206.153
	ip	192.155.90.90
	ip	109.104.79.48
	ip	210.2.86.72
	ip	69.163.33.82
	ip	5.9.128.163
	ip	189.208.239.98
	ip	208.180.246.147
	ip	181.56.165.97
	ip	181.228.211.100
	ip	181.61.221.146
	ip	71.43.73.58
	ip	200.116.26.234
	ip	190.185.241.151
	ip	92.48.118.27
	ip	219.94.254.93
	ip	66.209.69.165
	ip	70.28.3.120
	ip	138.68.139.199
	ip	162.104.1.255
	ip	186.138.205.189
	ip	144.76.117.247
	ip	24.137.254.148
	ip	165.227.213.173
	ip	186.3.188.74
	ip	190.146.86.180
	ip	189.250.145.98
	ip	181.16.4.180
	ip	209.159.244.240
	ip	89.211.193.18
	ip	109.73.52.242
	ip	190.210.3.93
	ip	185.86.148.222
	ip	91.205.215.57
	ip	173.248.147.186
	ip	159.65.76.245
HTTP/HTTPS requests
http://115.75.36.220:443
http://186.5.100.92:443
http://190.121.143.147:20
http://82.73.220.225
http://204.138.46.166:7080
http://174.109.4.153:8090
http://200.125.190.126:8080
http://51.255.50.164:8080
http://139.59.19.157
http://210.2.86.72:8080
http://190.117.206.153:443
http://192.163.199.254:8080
http://23.254.203.51:8080
http://72.47.248.48:8080
http://109.104.79.48:8080
http://200.116.26.234
http://192.155.90.90:7080
http://71.11.157.249
http://71.43.73.58:443
http://190.15.198.47
http://69.163.33.82:8080
http://181.228.211.100:443
http://181.61.221.146
http://208.180.246.147
http://189.208.239.98:443
http://181.56.165.97:53
http://5.9.128.163:8080
http://186.138.205.189
http://190.185.241.151:443
http://219.94.254.93:8080
http://162.104.1.255:443
http://209.159.244.240:443
http://144.76.117.247:8080
http://189.250.145.98:443
http://92.48.118.27:8080
http://190.210.3.93:443
http://70.28.3.120:7080
http://138.68.139.199:443
http://66.209.69.165:443
http://109.73.52.242:8080
http://181.16.4.180
http://190.146.86.180:443
http://165.227.213.173:8080
http://186.3.188.74
http://89.211.193.18
http://186.5.100.92:443
http://173.248.147.186
http://115.75.36.220:443
http://185.86.148.222:8080
http://159.65.76.245:443
http://82.73.220.225
http://91.205.215.57:7080
http://24.137.254.148
http://139.59.19.157
http://192.163.199.254:8080
http://190.121.143.147:20
http://204.138.46.166:7080
http://200.125.190.126:8080
http://51.255.50.164:8080
http://174.109.4.153:8090
http://23.254.203.51:8080
-----------------------------------
Main object- "ujHQ"
https://vrfantasy.gallery/wp-admin/ujHQ/
	sha256	66b41b1168e20c2d4dbb9b0bd1f745cca8928835b2142b1d8a46a13ac1657c04
	sha1	4f9d68e65ca7f3c3d3f8593a6e2ba0d62fc91032
	md5	9b31c3977f1e9e1d79173512bef0d2c6
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe	66b41b1168e20c2d4dbb9b0bd1f745cca8928835b2142b1d8a46a13ac1657c04
Connections
	ip	115.75.36.220
	ip	186.5.100.92
	ip	190.121.143.147
	ip	82.73.220.225
	ip	174.109.4.153
	ip	139.59.19.157
	ip	200.125.190.126
	ip	204.138.46.166
	ip	23.254.203.51
	ip	72.47.248.48
	ip	192.163.199.254
	ip	210.2.86.72
	ip	51.255.50.164
	ip	109.104.79.48
	ip	69.163.33.82
	ip	192.155.90.90
	ip	190.117.206.153
	ip	71.11.157.249
	ip	190.15.198.47
	ip	200.116.26.234
	ip	71.43.73.58
	ip	208.180.246.147
	ip	5.9.128.163
	ip	181.56.165.97
	ip	189.208.239.98
	ip	70.28.3.120
	ip	66.209.69.165
	ip	190.185.241.151
	ip	219.94.254.93
	ip	181.228.211.100
	ip	186.138.205.189
	ip	138.68.139.199
	ip	181.61.221.146
	ip	92.48.118.27
	ip	181.16.4.180
	ip	144.76.117.247
	ip	190.210.3.93
	ip	162.104.1.255
	ip	209.159.244.240
	ip	89.211.193.18
	ip	189.250.145.98
	ip	109.73.52.242
	ip	173.248.147.186
	ip	190.146.86.180
	ip	165.227.213.173
	ip	186.3.188.74
	ip	91.205.215.57
	ip	159.65.76.245
	ip	185.86.148.222
	ip	24.137.254.148
HTTP/HTTPS requests
http://181.56.165.97:53
http://115.75.36.220:443
http://186.5.100.92:443
http://82.73.220.225
http://190.121.143.147:20
http://204.138.46.166:7080
http://174.109.4.153:8090
http://139.59.19.157
http://200.125.190.126:8080
http://51.255.50.164:8080
http://192.163.199.254:8080
http://210.2.86.72:8080
http://69.163.33.82:8080
http://71.11.157.249
http://192.155.90.90:7080
http://23.254.203.51:8080
http://190.117.206.153:443
http://72.47.248.48:8080
http://109.104.79.48:8080
http://181.56.165.97:53
http://190.15.198.47
http://200.116.26.234
http://189.208.239.98:443
http://5.9.128.163:8080
http://71.43.73.58:443
http://186.138.205.189
http://208.180.246.147
http://66.209.69.165:443
http://219.94.254.93:8080
http://181.61.221.146
http://181.228.211.100:443
http://190.185.241.151:443
http://190.210.3.93:443
http://70.28.3.120:7080
http://189.250.145.98:443
http://109.73.52.242:8080
http://209.159.244.240:443
http://144.76.117.247:8080
http://138.68.139.199:443
http://162.104.1.255:443
http://92.48.118.27:8080
http://89.211.193.18
http://186.3.188.74
http://181.16.4.180
http://190.146.86.180:443
http://165.227.213.173:8080
http://159.65.76.245:443
http://24.137.254.148
http://82.73.220.225
http://186.5.100.92:443
http://91.205.215.57:7080
http://185.86.148.222:8080
http://204.138.46.166:7080
http://173.248.147.186
http://115.75.36.220:443
http://190.121.143.147:20
http://200.125.190.126:8080
http://174.109.4.153:8090
http://139.59.19.157
http://51.255.50.164:8080
http://192.163.199.254:8080
http://23.254.203.51:8080
http://72.47.248.48:8080
http://190.117.206.153:443
http://109.104.79.48:8080
http://71.11.157.249
http://210.2.86.72:8080
http://192.155.90.90:7080
http://69.163.33.82:8080
http://190.15.198.47
http://71.43.73.58:443
http://66.209.69.165:443
http://181.61.221.146
http://189.208.239.98:443
http://208.180.246.147
http://5.9.128.163:8080
http://181.228.211.100:443
http://200.116.26.234
http://186.138.205.189
http://190.185.241.151:443
http://219.94.254.93:8080
http://92.48.118.27:8080
http://70.28.3.120:7080
http://144.76.117.247:8080
http://138.68.139.199:443
http://162.104.1.255:443
http://190.210.3.93:443
http://209.159.244.240:443
http://189.250.145.98:443
--------------------------------
Main object- "7sf9"
http://artecautomaten.com/wp-content/7sf9/
	sha256	2f7400c75c97474ab03afbe741123dd2986419be3c8464320d3649ee9209d1ad
	sha1	a200ce566a8c5dc8ff74695c76b09575eb4ed514
	md5	daeb840ffd3ab06799f52d7ab01427c6
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe	2f7400c75c97474ab03afbe741123dd2986419be3c8464320d3649ee9209d1ad
Connections
	ip	186.5.100.92
	ip	115.75.36.220
	ip	82.73.220.225
	ip	190.121.143.147
	ip	204.138.46.166
	ip	200.125.190.126
	ip	174.109.4.153
	ip	139.59.19.157
	ip	51.255.50.164
	ip	23.254.203.51
	ip	192.163.199.254
	ip	72.47.248.48
	ip	190.117.206.153
	ip	210.2.86.72
	ip	109.104.79.48
	ip	200.116.26.234
	ip	5.9.128.163
	ip	189.208.239.98
	ip	190.15.198.47
	ip	71.43.73.58
	ip	71.11.157.249
	ip	192.155.90.90
	ip	69.163.33.82
	ip	190.185.241.151
	ip	181.61.221.146
	ip	208.180.246.147
	ip	186.138.205.189
	ip	181.56.165.97
	ip	66.209.69.165
	ip	219.94.254.93
	ip	70.28.3.120
	ip	181.16.4.180
	ip	109.73.52.242
	ip	209.159.244.240
	ip	190.210.3.93
	ip	162.104.1.255
	ip	189.250.145.98
	ip	144.76.117.247
	ip	92.48.118.27
	ip	138.68.139.199
	ip	181.228.211.100
	ip	165.227.213.173
	ip	173.248.147.186
	ip	89.211.193.18
	ip	91.205.215.57
	ip	190.146.86.180
	ip	24.137.254.148
	ip	186.3.188.74
	ip	185.86.148.222
	ip	159.65.76.245
HTTP/HTTPS requests
http://115.75.36.220:443
http://82.73.220.225
http://190.121.143.147:20
http://186.5.100.92:443
http://139.59.19.157
http://204.138.46.166:7080
http://174.109.4.153:8090
http://200.125.190.126:8080
http://210.2.86.72:8080
http://72.47.248.48:8080
http://192.163.199.254:8080
http://23.254.203.51:8080
http://51.255.50.164:8080
http://190.117.206.153:443
http://69.163.33.82:8080
http://192.155.90.90:7080
http://71.11.157.249
http://109.104.79.48:8080
http://190.15.198.47
http://5.9.128.163:8080
http://71.43.73.58:443
http://189.208.239.98:443
http://200.116.26.234
http://186.138.205.189
http://181.228.211.100:443
http://181.61.221.146
http://208.180.246.147
http://181.56.165.97:53
http://66.209.69.165:443
http://190.185.241.151:443
http://138.68.139.199:443
http://70.28.3.120:7080
http://219.94.254.93:8080
http://144.76.117.247:8080
http://109.73.52.242:8080
http://189.250.145.98:443
http://209.159.244.240:443
http://190.210.3.93:443
http://162.104.1.255:443
http://92.48.118.27:8080
http://89.211.193.18
http://165.227.213.173:8080
http://190.146.86.180:443
http://181.16.4.180
http://186.3.188.74
http://24.137.254.148
http://159.65.76.245:443
http://185.86.148.222:8080
http://82.73.220.225
http://186.5.100.92:443
http://115.75.36.220:443
http://173.248.147.186
http://91.205.215.57:7080
---------------------------------
Main object- "Jcd0i"
https://codbility.com/fonts/Jcd0i/
	sha256	68b52c634cd6ab505f425ddf1c2fa08ef96ce4471be153121e60317dbf9049ce
	sha1	57b7da4ef625f58770e0bb274299936432f4c80e
	md5	1c3362ea500f5c0749707c342164398d
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe	68b52c634cd6ab505f425ddf1c2fa08ef96ce4471be153121e60317dbf9049ce
Connections
	ip	115.75.36.220
	ip	186.5.100.92
	ip	204.138.46.166
	ip	82.73.220.225
	ip	190.121.143.147
	ip	174.109.4.153
	ip	200.125.190.126
	ip	51.255.50.164
	ip	192.163.199.254
	ip	139.59.19.157
	ip	69.163.33.82
	ip	109.104.79.48
	ip	190.117.206.153
	ip	23.254.203.51
	ip	72.47.248.48
	ip	210.2.86.72
	ip	181.56.165.97
	ip	192.155.90.90
	ip	190.15.198.47
	ip	71.43.73.58
	ip	200.116.26.234
	ip	189.208.239.98
	ip	5.9.128.163
	ip	71.11.157.249
	ip	138.68.139.199
	ip	70.28.3.120
	ip	181.228.211.100
	ip	208.180.246.147
	ip	66.209.69.165
	ip	190.185.241.151
	ip	219.94.254.93
	ip	181.61.221.146
	ip	186.138.205.189
	ip	89.211.193.18
	ip	209.159.244.240
	ip	181.16.4.180
	ip	92.48.118.27
	ip	189.250.145.98
	ip	144.76.117.247
	ip	190.146.86.180
	ip	190.210.3.93
	ip	109.73.52.242
	ip	162.104.1.255
	ip	165.227.213.173
	ip	173.248.147.186
	ip	186.3.188.74
	ip	159.65.76.245
	ip	24.137.254.148
	ip	185.86.148.222
	ip	91.205.215.57
HTTP/HTTPS requests
http://186.5.100.92:443
http://189.250.145.98:443
http://109.73.52.242:8080
http://115.75.36.220:443
http://82.73.220.225
http://204.138.46.166:7080
http://190.121.143.147:20
http://200.125.190.126:8080
http://174.109.4.153:8090
http://192.163.199.254:8080
http://23.254.203.51:8080
http://139.59.19.157
http://51.255.50.164:8080
http://72.47.248.48:8080
http://71.11.157.249
http://109.104.79.48:8080
http://192.155.90.90:7080
http://210.2.86.72:8080
http://190.117.206.153:443
http://69.163.33.82:8080
http://200.116.26.234
http://190.15.198.47
http://71.43.73.58:443
http://5.9.128.163:8080
http://181.56.165.97:53
http://189.208.239.98:443
http://208.180.246.147
http://186.138.205.189
http://181.228.211.100:443
http://66.209.69.165:443
http://181.61.221.146
http://219.94.254.93:8080
http://190.210.3.93:443
http://138.68.139.199:443
http://162.104.1.255:443
http://144.76.117.247:8080
http://70.28.3.120:7080
http://92.48.118.27:8080
http://190.185.241.151:443
http://89.211.193.18
http://190.146.86.180:443
http://165.227.213.173:8080
http://189.250.145.98:443
http://181.16.4.180
http://109.73.52.242:8080
http://209.159.244.240:443
http://186.3.188.74
http://91.205.215.57:7080
http://24.137.254.148
http://159.65.76.245:443
http://173.248.147.186
http://115.75.36.220:443
http://185.86.148.222:8080
http://186.5.100.92:443
http://82.73.220.225
http://200.125.190.126:8080
http://204.138.46.166:7080
http://190.121.143.147:20
http://174.109.4.153:8090
http://139.59.19.157
http://51.255.50.164:8080
http://210.2.86.72:8080
http://72.47.248.48:8080
http://192.163.199.254:8080
http://190.117.206.153:443
http://109.104.79.48:8080
http://23.254.203.51:8080
http://69.163.33.82:8080
http://71.11.157.249
http://208.180.246.147
http://192.155.90.90:7080
http://71.43.73.58:443
http://5.9.128.163:8080
http://189.208.239.98:443
http://181.56.165.97:53
http://200.116.26.234
http://190.15.198.47
http://66.209.69.165:443
http://181.61.221.146
http://186.138.205.189
http://181.228.211.100:443
http://70.28.3.120:7080
http://92.48.118.27:8080
http://190.185.241.151:443
http://138.68.139.199:443
http://219.94.254.93:8080
http://190.210.3.93:443
http://162.104.1.255:443
http://209.159.244.240:443
http://144.76.117.247:8080