2020-09-25 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Extract_URLs(false)


SENDERS OBSERVED
[email protected]
[email protected]
[email protected]

MALDOC DISTRIBUTION URLS
http://165.22.71.24/sys-cache/public/
http://ambulanceservice.nl/export/file/gz9ogci1hj/
http://andrademendonca.com.br/wp-content/2YL86MTKGTJKHU/Oib5nGCJOw/
http://bhntmanulife.net/o3ywyha/3s7pts/
http://bruset.no/picture_library/browse/UniDFobbgRfs3vceLFig/
http://cnaantours.co.il/wp-content/paclm/s0dx79619888547440208o2c6ff4599prxr/
http://cojestgrane.simplicitygames.pl/songs/eTrac/cc9u9y3uwjk/
http://crupie.com.br/teste/A4X8L324WL03/zueVKjOlYzXA6Sd4Vrc/
http://dagostim.com.br/rss/docs/UCv65TLbvo2HErwc/
http://dev.dosily.in/wp-content/parts_service/olCCW8OpAYq3wKxDZXz/
http://dpsolutions.com.my/wp-admin/esp/h591vQOmqGv6oYCsU5/
http://geisterhouse.com/cgi-bin/Pages/EECRC3H4qx/
http://hotelshivansh.com/UserFiles/attachments/gqrg5oms/mq56639070655100lbcddfcv28nkol2w/
http://idioticmedia.in/img/j6rzwe37t97a/h1ovq10871580452egr4iofqygr42lkcmgtkt/
http://irvingstudios.com/photos/OCT/npji2uwsmih/
http://kedaiabah.com/wp-includes/INC/7XXIEK68lF/
http://lagera.com/images/eTrac/aUQK2Fav5TA9UNeGp7Ol/
http://leapmom.com/ukeol/browse/
http://mesdelicesitaliens.fr/wp-admin/eTrac/7uVbSf4mfxl3/
http://mrveggy.com/erros/Document/8ysk21443893413537pzbh5hlpb/
http://mystylu.com.tw/wp-admin/LLC/qAcBvISwLyWaaIzSkY6N/
http://newideaco.ir/wp-content/ligzu9q4/
http://onex.co.za/journal/LLC/MNWxStgCzpFsHTKxYxrx/
http://otto-nautic.ro/wp-content/Pages/KUEUwtz9Vlmn/
http://pellesbar.co.il/wp-content/Pk7Yk0JTtPSz8Njh/
http://petercollie.com/2014.old.site/DOC/F3LLuJcONxTV7Ju5Bm/
http://robm.fastmail.fm/virus/Electronic%20form.doc/
http://rydchile.cl/wp-content/Document/RFxtxKpb6pPDV/
http://sjhoops.com/Scan/y42MRV0Azlu7U/
http://snpconsulting.com.au/Documents/Scan/Ja66qlKdRnEZPNMoKim/
http://theusacommunity.com/wp-content/parts_service/xtg9rch/
http://vniel.co.kr/gnuboard/data/Scan/amowVegfRT9Ja/
http://vrindapublicschool.com/cgi-bin/attachments/mz8l9dxzhsiu/
http://wafeeqa-realestate.com/integrity/invoice/3flecc1qzpfq/
http://www.duosite.com.br/host/attachments/uoG9VBQ5UYxGz/
http://www.jimenezabogados.mx/Firmas/browse/aBFMMSuuOcF/
http://www.mystylu.com.tw/wp-admin/LLC/qAcBvISwLyWaaIzSkY6N/
http://www.shanchuangjiaoyu.cn/wp-includes/INC/b4295516781073uvh74oqkpy3osrfy4xw/
http://www.streamnew.com/49cfzk/FXc9xTSsme14jh3q/
https://construbelcaxias.com.br/wp-admin/esp/
https://dev.dosily.in/wp-content/parts_service/olCCW8OpAYq3wKxDZXz/
https://dev.omniroom.ru/sys-cache/Document/z2cr86eqer/m462238043734qn5o01f9b5dh7iyj2/
https://dev.toca.store/wp-includes/sodium_compat/INC/dXRePll1aoe/
https://global-solutions.co/sites/invoice/5gio89oh0034/wdi329549337635775zi6xz8khpe81ymdzboulx/
https://jrvservices.com.br/JRV_ANTIGO/LLC/c0C5R8Kbbt2AcE0GGb43/
https://laminatedtube.com/site/parts_service/U8QeEk6yjjri3oVBpI/
https://lkfx168.com/wp-content/Overview/9FKkvZwpySR4hnZpY/
https://mrveggy.com/erros/Document/8ysk21443893413537pzbh5hlpb/
https://office.horussolution.com/files/Scan/3RcAVwetSPtsHa/
https://research.kku.ac.th/sys-cache/3774EPWE8VDST/sFWJJzWQW10lG6vVxg/
https://www.breedenandsilver.com/wp-content/qgtNLIQxb0YR8lg/
https://www.duosite.com.br/host/attachments/uoG9VBQ5UYxGz/

ambulanceservice.nl
andrademendonca.com.br
bhntmanulife.net
breedenandsilver.com
bruset.no
cnaantours.co.il
simplicitygames.pl
construbelcaxias.com.br
crupie.com.br
dagostim.com.br
dosily.in
omniroom.ru
toca.store
dpsolutions.com.my
duosite.com.br
geisterhouse.com
global-solutions.co
hotelshivansh.com
idioticmedia.in
irvingstudios.com
jimenezabogados.mx
jrvservices.com.br
kedaiabah.com
lagera.com
laminatedtube.com
leapmom.com
lkfx168.com
mesdelicesitaliens.fr
mrveggy.com
mystylu.com.tw
newideaco.ir
horussolution.com
onex.co.za
otto-nautic.ro
pellesbar.co.il
petercollie.com
research.kku.ac.th
fastmail.fm
rydchile.cl
shanchuangjiaoyu.cn
sjhoops.com
snpconsulting.com.au
streamnew.com
theusacommunity.com
vniel.co.kr
vrindapublicschool.com
wafeeqa-realestate.com

DOCUMENT FILE HASHES
a24beb27d28b13533316fe757c85b55a
88a55983f61c1aed72b2234aaea3b46a
de0918d2d5f0317258f3eba7cb980801

ZIP FILE HASHES
b43a53fbbbdc90a3af803672ed879495

PAYLOAD FILE HASHES
0aea8053cb10df62c9ce1a3d3b4f2cc1
0c904f30c7eb420b85ef84b807fe608b
0ec3dcc90fd1d792fc22f7004f1cb9b8
1d89e0b816661c04137495f9c09f77bc
304cf24a24f191e343da87c618b09a27
36e99bd97717819ac188dc0393bb7ff1
3bcf1d1eecddc5e93374d32fb2c7959b
3c8707edf2bacaf969813db1dc0b8dbd
7d120567c2d847376ca00f0f04cf3041
95e277536f77b8679d06c7c85cd37ef5
a8f4445f5e6238918b85133b70a54397
ab56932ca1c95bb8a503216c0154faae
bff40d6831993432a189ccc8dee24447
efc297cc9a843063b62fe77608649f83

EMOTET PAYLOAD URLs
http://13.229.25.57/7xdfb/jpA/
http://bavhome.com/wp-content/td/
http://binarystationary.com/cgi-bin/5rM/
http://bodenstein.co.za/images/Gdc2/
http://bomfuturoadesivos.com/vdo/pDT4/
http://calledtochange.org/CalledtoChange/V/
http://cuadros.pe/personal_sector/gKi/
http://daoisthealing.com/cgi-bin/c/
http://dentalalliance.se/wp-admin/iBkjpN5De/
http://earthinnovation.org/pcimonitor/mnNHQNm3/
http://eno.si/administrator/luL1uq/
http://fmcav.com/images/ZQF/
http://glassesnepal.com/gxlaf/tQ6/
http://hercinovic.com/cgi-bin/mZt/
http://ibccglobal.com/thankyou2/ARA/
http://infoquick.co.uk/event_ticket/bIJuS/
http://kharazmischl.com/w/k/
http://must-in.com/wp-admin/0/
http://ottimade.com/wp-content/E/
http://paulscomputing.com/CraigsMagicSquare/gQ1/
http://playschoolmatritva.com/cgi-bin/Cqw/
http://qualitychildcarepreschool.com/emqblk/wnwsegpnq/
http://secrice.com/writing/2003/0nI/
http://umapreowned.com/uu1e/KxHmG/
http://vnshinejsc.com/wp-content/IN1P/
http://work.digitalvichar.com/1mv7clu/o/
http://www.bismarjeparamebel.com/u/pCp/
http://wynn838.com/wp-content/Eo/
http://yatkiralama.online/wp-content/BG2hBQR1L/
https://ajstudiollc.com/cgi-bin/MiL/
https://artewebestudio.com/cgi-bin/A8UfqtzOx/
https://cimsjr.com/hospital/Fh4/
https://finewines.com.sg/wset-2-registration/ObrD/
https://fotoobjetivo.com/wp-content/x1/
https://heartssetfree.org/9c950e/FnH/
https://jeffdahlke.com/css/3u/
https://khvs.vrfantasy.gallery/igiodbck/eXq/
https://kodiakheating.com/ldnha/ybI/
https://konican.com/cgi-bin/gz/
https://lojaskock.com.br/BACKUP/AW/
https://nbiz.tk/wp-admin/idmW/
https://online24h.biz/wp-admin/t/
https://scyzm.net/wp-content/j/
https://www.pxid360.com/wp-admin/vMPE8y9i/

ajstudiollc.com
artewebestudio.com
bavhome.com
binarystationary.com
bismarjeparamebel.com
bodenstein.co.za
bomfuturoadesivos.com
calledtochange.org
cimsjr.com
cuadros.pe
daoisthealing.com
dentalalliance.se
digitalvichar.com
earthinnovation.org
eno.si
finewines.com.sg
fmcav.com
fotoobjetivo.com
glassesnepal.com
heartssetfree.org
hercinovic.com
ibccglobal.com
infoquick.co.uk
jeffdahlke.com
kharazmischl.com
kodiakheating.com
konican.com
lojaskock.com.br
must-in.com
nbiz.tk
online24h.biz
ottimade.com
paulscomputing.com
playschoolmatritva.com
pxid360.com
qualitychildcarepreschool.com
scyzm.net
secrice.com
umapreowned.com
vnshinejsc.com
vrfantasy.gallery
wynn838.com
yatkiralama.online

EMOTET C2s
(107)
http://12.163.208.58
http://45.33.35.74:8080
http://87.106.253.248:8080
http://192.241.146.84:8080
http://190.115.18.139:8080
http://65.36.62.20
http://170.81.48.2
http://83.169.21.32:7080
http://185.232.182.218
http://190.2.31.172
http://77.106.157.34:8080
http://82.230.1.24
http://202.4.58.197
http://201.213.177.139
http://78.249.119.122
http://123.51.47.18
http://77.90.136.129:8080
http://60.93.23.51
http://152.169.22.67
http://190.117.79.209
http://60.108.144.104:443
http://213.197.182.158:8080
http://82.76.111.249:443
http://209.236.123.42:8080
http://190.24.243.186
http://177.74.228.34
http://191.182.6.118
http://96.245.123.149
http://61.197.92.216
http://1.226.84.243:8080
http://111.67.12.221:8080
http://216.47.196.104
http://185.94.252.27:443
http://70.116.143.84
http://187.162.248.237
http://217.13.106.14:8080
http://80.11.164.185
http://35.143.99.174
http://190.190.148.27:8080
http://219.92.13.25
http://70.32.115.157:8080
http://96.227.52.8:443
http://51.75.33.127
http://95.9.180.128
http://174.113.69.136
http://119.106.216.84
http://111.67.77.202:8080
http://91.105.94.200
http://178.250.54.208:8080
http://98.13.75.196
http://2.36.95.106
http://186.70.127.199:8090
http://116.202.23.3:8080
http://202.134.4.210:7080
http://50.28.51.143:8080
http://45.33.77.42:8080
http://67.247.242.247
http://137.74.106.111:7080
http://85.214.26.7:8080
http://181.30.61.163:443
http://77.238.212.227
http://185.215.227.107:443
http://186.103.141.250:443
http://50.121.220.50
http://74.136.144.133
http://104.131.41.185:8080
http://61.92.159.208:8080
http://104.131.103.37:8080
http://51.15.7.189
http://185.94.252.12
http://94.176.234.118:443
http://212.71.237.140:8080
http://5.196.35.138:7080
http://45.46.37.97
http://70.32.84.74:8080
http://199.203.62.165
http://38.88.126.202:8080
http://51.159.23.217:443
http://155.186.0.121
http://51.38.124.206
http://181.129.96.162:8080
http://64.201.88.132
http://92.24.50.153
http://189.2.177.210:443
http://45.16.226.117:443
http://76.168.54.203
http://185.178.10.77
http://220.109.145.69
http://192.81.38.31
http://68.183.170.114:8080
http://177.73.0.98:443
http://138.97.60.141:7080
http://192.241.143.52:8080
http://217.199.160.224:7080
http://185.183.16.47
http://177.129.17.170:443
http://5.189.178.202:8080
http://74.58.215.226
http://51.255.165.160:8080
http://12.162.84.2:8080
http://149.202.72.142:7080
http://87.106.46.107:8080
http://188.135.15.49
http://68.183.190.199:8080
http://172.104.169.32:8080
http://68.69.155.181
http://72.47.248.48:7080

(103)
http://49.243.9.118
http://162.241.41.111:7080
http://190.85.46.52:7080
http://162.144.42.60:8080
http://157.245.138.101:7080
http://103.133.66.57:443
http://167.71.227.113:8080
http://80.200.62.81:20
http://78.186.65.230
http://185.142.236.163:443
http://78.114.175.216
http://202.166.170.43
http://37.205.9.252:7080
http://118.243.83.70
http://116.202.10.123:8080
http://223.135.30.189
http://120.51.34.254
http://139.59.61.215:443
http://8.4.9.137:8080
http://202.153.220.157
http://179.5.118.12
http://75.127.14.170:8080
http://45.177.120.37:8080
http://41.185.29.128:8080
http://79.133.6.236:8080
http://192.241.220.183:8080
http://203.153.216.178:7080
http://115.176.16.221
http://113.161.148.81
http://178.33.167.120:8080
http://183.77.227.38
http://46.105.131.68:8080
http://181.95.133.104
http://93.20.157.143
http://172.105.78.244:8080
http://139.59.12.63:8080
http://190.192.39.136
http://41.212.89.128
http://27.73.70.219:8080
http://109.206.139.119
http://192.163.221.191:8080
http://113.160.248.110
http://182.227.240.189:443
http://185.208.226.142:8080
http://126.126.139.26:443
http://185.80.172.199
http://103.229.73.17:8080
http://5.79.70.250:8080
http://95.216.205.155:8080
http://190.194.12.132
http://37.46.129.215:8080
http://51.38.201.19:7080
http://195.201.56.70:8080
http://175.103.38.146
http://73.55.128.120
http://74.208.173.91:8080
http://189.150.209.206
http://91.83.93.103:443
http://86.57.216.23
http://36.91.44.183
http://181.80.129.181
http://50.116.78.109:8080
http://14.241.182.160
http://60.125.114.64:443
http://113.156.82.32
http://190.191.171.72
http://67.121.104.51:20
http://111.89.241.139
http://220.106.127.191:443
http://46.32.229.152:8080
http://115.79.59.157
http://58.27.215.3:8080
http://192.210.217.94:8080
http://118.33.121.37
http://169.1.211.133
http://54.38.143.245:8080
http://198.57.203.63:8080
http://138.201.45.2:8080
http://172.96.190.154:8080
http://143.95.101.72:8080
http://45.239.204.100
http://103.93.220.182
http://185.86.148.68:443
http://119.92.77.17
http://186.20.52.237
http://115.79.195.246
http://223.17.215.76
http://77.74.78.80:443
http://113.203.238.130
http://220.147.247.145
http://153.229.219.1:443
http://187.189.66.200:8080
http://103.80.51.61:8080
http://27.7.14.122
http://200.116.93.61
http://182.253.83.234:7080
http://91.75.75.46
http://128.106.187.110
http://113.193.239.51:443
http://180.148.4.130:8080
http://157.7.164.178:8081
http://88.247.58.26
http://37.187.100.220:7080