#banload IoC 20190627

#BANLOAD IoC 20190627

-----------------


Received: from vm.oabpe.org.br (unknown [198.136.56.252])
Received: from [179.104.151.122] (port=49905 helo=DESKTOP-9OIBDPR)
From: [email protected]
Date: 25 Jun 2019 09:56:05 -0300
Subject: Tax receipt submission ref-**** Data: 25/06/2019


Received: from webserver02.floripa.com.br (unknown [187.49.226.10])
Received: from [179.246.63.229] (port=57661 helo=DESKTOP-6AA08KF)
From: [email protected]
Date: 25 Jun 2019 21:15:46 -0300
Subject: Tax receipt submission Data: 25/06/2019


Received: from br1.ensite.com.br (unknown [187.17.160.13])
Received: from [2804:18:481a:9bd9:bd46:69e:60ad:a5b1] (port=59040 helo=DESKTOP-6AA08KF)
From: [email protected]
Date: 25 Jun 2019 22:15:14 -0300
Subject: Tax receipt submission Data: 25/06/2019


Received: from vps.midialagos.com.br (unknown [162.241.36.77])
Received: from [191.27.85.15] (port=56847 helo=DESKTOP-6AA08KF)
From: [email protected]
Date: 26 Jun 2019 21:11:39 -0300
Subject: Tax receipt submission ref- ********** Data: 26/06/2019


Received: from vps.dec9.com.br (unknown [162.241.134.169])
Received: from 44.ip-51-91-56.eu ([51.91.56.44]:60426 helo=WIN-6BQ8HFCGDCA)
From: [email protected]
Date: 26 Jun 2019 17:17:17 -0700
Subject: Tax receipt submission ref-********** Data: 26/06/2019


Received: from cliente1.ensite.com.br (unknown [187.17.160.7])
Received: from [191.27.85.15] (port=59084 helo=DESKTOP-6AA08KF)
From: [email protected]
Date: 26 Jun 2019 22:35:39 -0300
Subject: Tax receipt submission ref- ********** Data: 26/06/2019


Received: from sda117.playunix.com (unknown [177.53.142.228])
Received: from 44.ip-51-91-56.eu ([51.91.56.44]:53050 helo=WIN-6BQ8HFCGDCA)
From: [email protected]
Date: 26 Jun 2019 19:06:51 -0700
Subject: Tax receipt submission ref-********** Data: 26/06/2019


Received: from mg.britania.com.br (unknown [189.2.203.70])
Received: FROM [email protected] (191-27-85-15.user.vivozap.com.br [191.27.85.15])
From: [email protected]
Date: 27 Jun 2019 00:01:42 -0300
Subject: Tax receipt submission ref- ********** Data: 27/06/2019

-------ADDITIONAL_EMAIL----------

[email protected]
[email protected]
[email protected]
[email protected]

-------OBSERVED_URL----------

Initial destination
http://unbouncepages.com/comprobante-ref0012/?*****
http://199.192.29.182/Folder/Downloader.php?****

PowerShell script
http://51.75.142.21/l2406/uk/kk/20938092830482
http://51.75.142.21/l2406/uk/al/20938092830482
http://51.75.142.21/l2406/uk/nn/20938092830482
http://51.75.142.21/l2406/uk/pz/20938092830482

Malware (all on anyrun)
http://51.91.248.86/uk/M2406/kk/md.zip
sha256	d3f80b7d6f4812634d9c9e04f787059a0143b7c952bc564ec01a5b5fd3537e5a
sha1	1cbc0151175d76889af4453dccb2a80c1d4dc2e8
md5	9ab7eeb6ef2c6a5fcc24572474dd8dc3

http://51.91.248.86/M1106/al/md.zip
sha256	742ecf7b71060e0b422632225712e394950a36d296e67f910bf9c4673aa66801
sha1	9c47bbdf1e9209b2a3a8383d8e8a74ac672cccc3
md5	6764d481442d801167012f7681fb113b

http://51.75.142.21/M2406/nn/md.zip
sha256	4f7ee2f0b15e8c78849483a2a14bca4037c5b67e3f0759bb687b6af7b148fb5f
sha1	1f444c2667dbee0c3689bf10d8036b9d39bc8902
md5	c4ce00751f365ccc984ff647d8bf0248

http://51.91.248.86/M1106/pz/md.zip
sha256	b3b873184cb37b118d807669a992140667dc961828ca909411945c70512e6a17
sha1	c488185479c4ba8e5430e6e8ba42af1b0de668a2
md5	f8f07fc4560ce3e7222fc763a523b9f9