Emotet-Feodo_C2_IOCs_EPOCH1_15-04-2019

#Emotet #Feodo #Banking #Trojan #Epoch1
--------------------------------------------
15-04-2019					IOC's
--------------------------------------------
Main object- "a9928f8d9664c94af92a33072fe747bb261d4637ca6ec1a8ca9e758a0efc7a7d.bin.gz"
	sha256	12deae3bc3cdbb1a12ad02bb8722936233d627c51058edc2d7af746fe9ea1afc
	sha1	334a8ed0fb44d15dd3ad010feb3e7c3d3453f33a
	md5	22baf2700754930ddcc9c91fb55e37cf
DNS requests
	domain	garammatka.com
	domain	rinconadarolandovera.com
	domain	hadrianjonathan.com
	domain	gamvrellis.com
	domain	warwickvalleyliving.com
Connections
	ip	103.228.112.39
	ip	72.29.90.59
	ip	107.180.43.3
	ip	104.198.58.45
	ip	198.105.216.238
HTTP/HTTPS requests
	url	http://garammatka.com/cgi-bin/o569U/
	url	http://rinconadarolandovera.com/calendar/5n5WY/
	url	http://gamvrellis.com/MEDIA/heuMx/
	url	http://hadrianjonathan.com/floorplans/vOec/
	url	http://warwickvalleyliving.com/images/wmGN/
----------------------------------------------
Main object- "o569U"
	url	http://garammatka.com/cgi-bin/o569U/
	sha256	e58a81f5bf5b603fd3bcb122830d3d731336fe06662940c2192157bd2064d25f
	sha1	267d72153bf611c03545a0b6d7036fb01c3c0df5
	md5	1d1b58e935b8a597283472714c1ab5f5
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\soundser\soundser.exe	e58a81f5bf5b603fd3bcb122830d3d731336fe06662940c2192157bd2064d25f
Connections
	ip	88.215.2.29
	ip	187.188.166.192
	ip	43.229.62.186
	ip	65.49.60.163
	ip	165.227.213.173
	ip	210.2.86.72
	ip	45.33.35.103
	ip	187.137.162.145
	ip	192.155.90.90
	ip	88.97.26.73
	ip	200.114.142.40
	ip	107.159.94.183
	ip	190.117.206.153
	ip	67.241.81.253
	ip	187.189.210.143
	ip	185.86.148.222
	ip	138.68.139.199
	ip	219.94.254.93
	ip	77.44.16.54
	ip	71.11.157.249
	ip	5.9.128.163
	ip	144.76.117.247
	ip	109.73.52.242
	ip	69.163.33.82
	ip	200.90.201.77
	ip	192.163.199.254
	ip	109.104.79.48
	ip	200.28.131.215
	ip	89.211.193.18
	ip	62.75.143.100
	ip	82.226.163.9
	ip	181.29.101.13
	ip	196.6.112.70
	ip	189.225.119.52
	ip	189.205.185.71
	ip	176.58.93.123
	ip	200.107.105.16
	ip	72.47.248.48
	ip	66.209.69.165
	ip	92.48.118.27
	ip	91.205.215.57
	ip	139.59.19.157
	ip	213.172.88.13
	ip	51.255.50.164
	ip	23.254.203.51
	ip	99.243.127.236
	ip	197.248.67.226
	ip	154.120.228.126
	ip	136.49.87.106
	ip	186.139.160.193
	ip	181.29.186.65

C2 SERVERS
88.215.2.29:80
65.49.60.163:443
187.137.162.145:443
187.188.166.192:80
45.33.35.103:8080
43.229.62.186:8080
165.227.213.173:8080
192.155.90.90:7080
190.117.206.153:443
185.86.148.222:8080
187.189.210.143:80
67.241.81.253:8443
200.114.142.40:8080
138.68.139.199:443
107.159.94.183:8080
219.94.254.93:8080
88.97.26.73:50000
210.2.86.72:8080
200.90.201.77:80
71.11.157.249:80
192.163.199.254:8080
144.76.117.247:8080
77.44.16.54:465
69.163.33.82:8080
5.9.128.163:8080
189.225.119.52:990
109.73.52.242:8080
181.29.186.65:80
189.205.185.71:465
200.28.131.215:443
181.29.101.13:80
62.75.143.100:7080
176.58.93.123:8080
196.6.112.70:443
72.47.248.48:8080
200.107.105.16:465
23.254.203.51:8080
89.211.193.18:80
109.104.79.48:8080
82.226.163.9:80
66.209.69.165:443
197.248.67.226:8080
213.172.88.13:80
51.255.50.164:8080
186.139.160.193:8080
99.243.127.236:80
136.49.87.106:80
139.59.19.157:80
154.120.228.126:8080
92.48.118.27:8080
91.205.215.57:7080
------------------------------------
Main object- "5n5WY"
	url	http://rinconadarolandovera.com/calendar/5n5WY/
	sha256	e58a81f5bf5b603fd3bcb122830d3d731336fe06662940c2192157bd2064d25f
	sha1	267d72153bf611c03545a0b6d7036fb01c3c0df5
	md5	1d1b58e935b8a597283472714c1ab5f5
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\soundser\soundser.exe	e58a81f5bf5b603fd3bcb122830d3d731336fe06662940c2192157bd2064d25f
Connections
	ip	187.188.166.192
	ip	88.215.2.29
	ip	187.137.162.145
	ip	65.49.60.163
	ip	43.229.62.186
	ip	45.33.35.103
	ip	165.227.213.173
	ip	88.97.26.73
	ip	192.155.90.90
	ip	190.117.206.153
	ip	210.2.86.72
	ip	185.86.148.222
	ip	77.44.16.54
	ip	219.94.254.93
	ip	67.241.81.253
	ip	187.189.210.143
	ip	200.114.142.40
	ip	107.159.94.183
	ip	200.90.201.77
	ip	71.11.157.249
	ip	5.9.128.163
	ip	109.73.52.242
	ip	69.163.33.82
	ip	192.163.199.254
	ip	144.76.117.247
	ip	138.68.139.199
	ip	89.211.193.18
	ip	189.205.185.71
	ip	62.75.143.100
	ip	181.29.186.65
	ip	176.58.93.123
	ip	200.28.131.215
	ip	181.29.101.13
	ip	189.225.119.52
	ip	109.104.79.48
	ip	72.47.248.48
	ip	92.48.118.27
	ip	154.120.228.126
	ip	213.172.88.13
	ip	200.107.105.16
	ip	51.255.50.164
	ip	196.6.112.70
	ip	82.226.163.9
	ip	197.248.67.226
	ip	23.254.203.51
	ip	136.49.87.106
	ip	139.59.19.157
	ip	99.243.127.236
	ip	186.139.160.193
	ip	91.205.215.57
	ip	66.209.69.165

C2 SERVERS
187.188.166.192:80
88.215.2.29:80
187.137.162.145:443
65.49.60.163:443
45.33.35.103:8080
165.227.213.173:8080
210.2.86.72:8080
88.97.26.73:50000
190.117.206.153:443
185.86.148.222:8080
43.229.62.186:8080
192.155.90.90:7080
200.114.142.40:8080
187.189.210.143:80
138.68.139.199:443
67.241.81.253:8443
107.159.94.183:8080
219.94.254.93:8080
200.90.201.77:80
69.163.33.82:8080
77.44.16.54:465
192.163.199.254:8080
144.76.117.247:8080
71.11.157.249:80
189.225.119.52:990
5.9.128.163:8080
109.73.52.242:8080
82.226.163.9:80
89.211.193.18:80
181.29.101.13:80
176.58.93.123:8080
189.205.185.71:465
62.75.143.100:7080
109.104.79.48:8080
181.29.186.65:80
200.28.131.215:443
92.48.118.27:8080
72.47.248.48:8080
200.107.105.16:465
154.120.228.126:8080
196.6.112.70:443
66.209.69.165:443
91.205.215.57:7080
99.243.127.236:80
197.248.67.226:8080
139.59.19.157:80
51.255.50.164:8080
213.172.88.13:80
23.254.203.51:8080
136.49.87.106:80
186.139.160.193:8080
---------------------------------
Main object- "heuMx"
	url	http://gamvrellis.com/MEDIA/heuMx/
	sha256	e4efd5db09c1719670e57a54aa8de9ebb6789d5f7a3b60c28c30fe40de429565
	sha1	e797e2fc0155e6ed3b860fd30f0eb1367455a6a0
	md5	69a5838744d6aa7b8f1d08b6e36d6844
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\soundser\soundser.exe	e4efd5db09c1719670e57a54aa8de9ebb6789d5f7a3b60c28c30fe40de429565
Connections
	ip	187.188.166.192
	ip	88.215.2.29
	ip	187.137.162.145
	ip	65.49.60.163
	ip	45.33.35.103
	ip	165.227.213.173
	ip	43.229.62.186
	ip	210.2.86.72
	ip	192.155.90.90
	ip	185.86.148.222
	ip	88.97.26.73
	ip	190.117.206.153
	ip	187.189.210.143
	ip	67.241.81.253
	ip	200.114.142.40
	ip	138.68.139.199
	ip	107.159.94.183
	ip	144.76.117.247
	ip	219.94.254.93
	ip	77.44.16.54
	ip	200.90.201.77
	ip	71.11.157.249
	ip	192.163.199.254
	ip	189.225.119.52
	ip	69.163.33.82
	ip	5.9.128.163
	ip	181.29.186.65
	ip	109.104.79.48
	ip	200.28.131.215
	ip	89.211.193.18
	ip	109.73.52.242
	ip	62.75.143.100
	ip	72.47.248.48
	ip	200.107.105.16
	ip	23.254.203.51
	ip	176.58.93.123
	ip	154.120.228.126
	ip	181.29.101.13
	ip	92.48.118.27
	ip	82.226.163.9
	ip	196.6.112.70
	ip	189.205.185.71
	ip	66.209.69.165
	ip	51.255.50.164
	ip	91.205.215.57
	ip	99.243.127.236
	ip	197.248.67.226
	ip	186.139.160.193
	ip	213.172.88.13
	ip	136.49.87.106
	ip	139.59.19.157

C2 SERVERS
45.33.35.103:8080
187.188.166.192:80
88.215.2.29:80
187.137.162.145:443
65.49.60.163:443
43.229.62.186:8080
192.155.90.90:7080
165.227.213.173:8080
210.2.86.72:8080
187.189.210.143:80
67.241.81.253:8443
200.114.142.40:8080
185.86.148.222:8080
190.117.206.153:443
88.97.26.73:50000
77.44.16.54:465
138.68.139.199:443
219.94.254.93:8080
107.159.94.183:8080
200.90.201.77:80
71.11.157.249:80
69.163.33.82:8080
192.163.199.254:8080
144.76.117.247:8080
109.73.52.242:8080
5.9.128.163:8080
189.225.119.52:990
62.75.143.100:7080
89.211.193.18:80
200.28.131.215:443
181.29.186.65:80
109.104.79.48:8080
189.205.185.71:465
82.226.163.9:80
181.29.101.13:80
72.47.248.48:8080
92.48.118.27:8080
196.6.112.70:443
176.58.93.123:8080
200.107.105.16:465
213.172.88.13:80
23.254.203.51:8080
139.59.19.157:80
197.248.67.226:8080
51.255.50.164:8080
154.120.228.126:8080
66.209.69.165:443
91.205.215.57:7080
186.139.160.193:8080
99.243.127.236:80
136.49.87.106:80
--------------------------------
Main object- "vOec"
	url	http://hadrianjonathan.com/floorplans/vOec/
	sha256	e4efd5db09c1719670e57a54aa8de9ebb6789d5f7a3b60c28c30fe40de429565
	sha1	e797e2fc0155e6ed3b860fd30f0eb1367455a6a0
	md5	69a5838744d6aa7b8f1d08b6e36d6844
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\soundser\soundser.exe	e4efd5db09c1719670e57a54aa8de9ebb6789d5f7a3b60c28c30fe40de429565
Connections
	ip	187.188.166.192
	ip	88.215.2.29
	ip	65.49.60.163
	ip	187.137.162.145
	ip	45.33.35.103
	ip	43.229.62.186
	ip	210.2.86.72
	ip	165.227.213.173
	ip	192.155.90.90
	ip	88.97.26.73
	ip	185.86.148.222
	ip	107.159.94.183
	ip	187.189.210.143
	ip	200.114.142.40
	ip	219.94.254.93
	ip	190.117.206.153
	ip	138.68.139.199
	ip	67.241.81.253
	ip	5.9.128.163
	ip	69.163.33.82
	ip	77.44.16.54
	ip	200.90.201.77
	ip	109.73.52.242
	ip	192.163.199.254
	ip	71.11.157.249
	ip	144.76.117.247
	ip	176.58.93.123
	ip	181.29.101.13
	ip	89.211.193.18
	ip	62.75.143.100
	ip	189.225.119.52
	ip	200.28.131.215
	ip	109.104.79.48
	ip	189.205.185.71
	ip	181.29.186.65
	ip	23.254.203.51
	ip	213.172.88.13
	ip	51.255.50.164
	ip	82.226.163.9
	ip	200.107.105.16
	ip	92.48.118.27
	ip	154.120.228.126
	ip	72.47.248.48
	ip	196.6.112.70
	ip	197.248.67.226
	ip	136.49.87.106
	ip	139.59.19.157
	ip	99.243.127.236
	ip	91.205.215.57
	ip	186.139.160.193
	ip	66.209.69.165

C2 SERVERS
88.215.2.29:80
187.188.166.192:80
187.137.162.145:443
65.49.60.163:443
45.33.35.103:8080
43.229.62.186:8080
165.227.213.173:8080
210.2.86.72:8080
192.155.90.90:7080
190.117.206.153:443
88.97.26.73:50000
185.86.148.222:8080
187.189.210.143:80
67.241.81.253:8443
200.114.142.40:8080
107.159.94.183:8080
138.68.139.199:443
219.94.254.93:8080
200.90.201.77:80
71.11.157.249:80
77.44.16.54:465
189.225.119.52:990
109.73.52.242:8080
5.9.128.163:8080
62.75.143.100:7080
192.163.199.254:8080
144.76.117.247:8080
69.163.33.82:8080
89.211.193.18:80
109.104.79.48:8080
200.28.131.215:443
181.29.186.65:80
176.58.93.123:8080
181.29.101.13:80
189.205.185.71:465
196.6.112.70:443
72.47.248.48:8080
23.254.203.51:8080
82.226.163.9:80
200.107.105.16:465
92.48.118.27:8080
154.120.228.126:8080
197.248.67.226:8080
139.59.19.157:80
91.205.215.57:7080
51.255.50.164:8080
66.209.69.165:443
99.243.127.236:80
213.172.88.13:80
136.49.87.106:80
186.139.160.193:8080
-------------------------------------
Main object- "wmGN"
	url	http://warwickvalleyliving.com/images/wmGN/
	sha256	80a087ec36a0a71dc941e8d10c2bffde8aa4892268f3d75af9ebcb2d1b1b7d85
	sha1	40a61771b70d55b72723fa08bd461162ca5c1a5a
	md5	4bfababf12701adf400d1f89c411a7af
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\soundser\soundser.exe	80a087ec36a0a71dc941e8d10c2bffde8aa4892268f3d75af9ebcb2d1b1b7d85
Connections
	ip	88.215.2.29
	ip	187.188.166.192
	ip	65.49.60.163
	ip	187.137.162.145
	ip	45.33.35.103
	ip	43.229.62.186
	ip	192.155.90.90
	ip	210.2.86.72
	ip	165.227.213.173
	ip	88.97.26.73
	ip	67.241.81.253
	ip	187.189.210.143
	ip	185.86.148.222
	ip	107.159.94.183
	ip	77.44.16.54
	ip	200.114.142.40
	ip	219.94.254.93
	ip	138.68.139.199
	ip	190.117.206.153
	ip	71.11.157.249
	ip	192.163.199.254
	ip	5.9.128.163
	ip	144.76.117.247
	ip	69.163.33.82
	ip	200.90.201.77
	ip	109.73.52.242
	ip	89.211.193.18
	ip	189.205.185.71
	ip	200.28.131.215
	ip	181.29.101.13
	ip	181.29.186.65
	ip	109.104.79.48
	ip	62.75.143.100
	ip	82.226.163.9
	ip	154.120.228.126
	ip	196.6.112.70
	ip	200.107.105.16
	ip	92.48.118.27
	ip	23.254.203.51
	ip	72.47.248.48
	ip	176.58.93.123
	ip	189.225.119.52
	ip	197.248.67.226
	ip	186.139.160.193
	ip	213.172.88.13
	ip	66.209.69.165
	ip	91.205.215.57
	ip	99.243.127.236
	ip	139.59.19.157
	ip	136.49.87.106
	ip	51.255.50.164

C2 SERVERS
187.137.162.145:443
187.188.166.192:80
88.215.2.29:80
65.49.60.163:443
45.33.35.103:8080
43.229.62.186:8080
165.227.213.173:8080
210.2.86.72:8080
192.155.90.90:7080
88.97.26.73:50000
187.189.210.143:80
185.86.148.222:8080
190.117.206.153:443
200.114.142.40:8080
107.159.94.183:8080
67.241.81.253:8443
200.90.201.77:80
138.68.139.199:443
219.94.254.93:8080
77.44.16.54:465
189.225.119.52:990
109.73.52.242:8080
69.163.33.82:8080
5.9.128.163:8080
192.163.199.254:8080
71.11.157.249:80
144.76.117.247:8080
181.29.186.65:80
89.211.193.18:80
189.205.185.71:465
109.104.79.48:8080
62.75.143.100:7080
200.28.131.215:443
181.29.101.13:80
176.58.93.123:8080
92.48.118.27:8080
196.6.112.70:443
82.226.163.9:80
200.107.105.16:465
213.172.88.13:80
51.255.50.164:8080
197.248.67.226:8080
154.120.228.126:8080
23.254.203.51:8080
72.47.248.48:8080
139.59.19.157:80
186.139.160.193:8080
91.205.215.57:7080
136.49.87.106:80
66.209.69.165:443
99.243.127.236:80