EMOTET March 6, 2018 indicators

EMOTET Phishing indicators

March 6

From: Andrew Laquis <[email protected]>
Re: FWD: PFA
https://1drv.ms/u/s!AsYMbW4uVTHnbNKlu7f3OZ85BdI
Scan Copy BL PL COA IN .zip
SHA256: c6ed85f9cbaf1e6611f2dda56dd85edcc882829ff52b5f7b66f1472b162d8315
Scan Copy BL PL COA IN.exe
SHA256: be2728a0821ca1f2f399b2f9aab228cc2c04e7fbd03e1de2222bd2d1d804a7d3

From: Biedron
http://www.senkosimon.com/New-order/

From: [email protected]
Subject: Service Invoice
http://www.sunvim-gd.com/images/ACH-form/

From: [email protected]
Subject: New order
http://khabarovskstroy27.ru/Past-Due-Invoice/

http://deltransmsk.ru/Paid-Invoice-Credit-Card-Receipt/
http://edscomp.ru/HBmmyF/
http://garsrl.it/3Vid/
http://geforwarders.com/Need-to-send-the-attachment/
http://dien.mx/New-order/
http://www.sunvim-gd.com/images/ACH-form/
http://ourfest.ru/Overdue-payment/
http://pistonson.com/Summit-Companies-Invoice-112693/
http://profile-cafe.gr/Past-Due-Invoice/
http://samgr.ru/4xPj1m/
http://triooo.it/docs/Need-to-send-the-attachment/
http://www.agrologsa.com/XGT4x/
http://www.citaly.it/qHQvlD/
http://www.lesnaya-strana.ru/Invoices-attached/
http://xn----ctbibbwjuljhee0a1k.xn--p1ai/Sales-Invoice/
http://xn--80acbc1cbp2a7a.xn--p1ai/UPS-Ship-Notification/Mar-06-18-02-35-41/