IOC Globimposter : 28/10/2017

### Globimposter campaign 28/12/2017 ###

## First Wave ##
# Infos
Tree: 7z archive > script
Archive pattern: "CCE28122017_[0-9]{6}.7z"
Script pattern: "CCE28122017_[0-9]{6}.vbs"
Payload: https://www.virustotal.com/#/file/f8f07c01e2092c1cac889799a17a0f740c057375d105567fc2f31c946ff63232/community

# IOCs:
hxxp://berkahbajamakmur.com/06YefeR?
hxxp://slimthrive.net/06YefeR?
hxxp://smartnewjerseyhomebuyers.com/06YefeR?
hxxp://standardfederalproperties.com/06YefeR?
hxxp://swarm-solutions.com/06YefeR?
hxxp://weserve.world/06YefeR?
hxxp://yourappyourway.com/06YefeR?
hxxp://zeeshanasghar.website/06YefeR?

## Second Wave ##
#Infos:
Tree: 7z archive > script
Archive pattern: "(Scan|Document|PDF)_[0-9]{4,6}.7z"
Script pattern: "(Scan|Copy|File)_[0-9]{8}.vbs"
Payload: https://www.virustotal.com/#/file/eab3c6733e783f0a85608582f6c47238809306801ab8e80862b03497358de944/community

# IOCs:
hxxp://9system.org/Mndv63?
hxxp://amc-trans.ro/Mndv63?
hxxp://baresiconstrucoes.com/Mndv63?
hxxp://bluey.online/Mndv63?
hxxp://cugaituoianthai.com/Mndv63?
hxxp://desarrolloprueba.xyz/Mndv63?
hxxp://iglesiaciudaddedios.com/Mndv63?
hxxp://kooshesh-co.com/Mndv63?