Emotet IoC 27092020

Ioc EMOTET 27-09-2020


URL:

*http://ibccglobal.com/thankyou2/ARA/
*http://work.digitalvichar.com/1mv7clu/o/
*http://13.229.25.57/7xdfb/jpA/
*http://binarystationary.com/cgi-bin/5rM/
*http://fmcav.com/images/ZQF/
*https://kodiakheating.com/ldnha/ybI/
*https://khv.svr.fantasy.gallery/igiodbck/eXq/

IP:

3.13.43.20
103.129.99.42
13.229.25.57
148.66.138.103
35.208.84.24
67.225.255.188
37.9.175.20

CnC:

12.163.208.58


Document Hash:

dc939640b203aebb656969e5657972216e1c314c2a621e1767747f2e73cd5f19  Mensaje.doc


SHA256 files:

be49342dd8e481b0e2845b91fca56473e1a6b3bf7f42be234a304e8369d716b3  5J07hsZHYj2MsiUrJrL.exe(kodiakheating.com) --> Not detected by VT
587e1c3ae4c12f5a51e2c3343e0fbd7d583403baf4546dd7b725f5bf84f81157  9nvCx5Q0NUVYLP.exe(ibccglobal.com)
f4cdbf064e0f502e13d5a029c63491bad00572cbec7cd1cc22559526cb67b769  6hYF.exe(fmcav.com)
db95a5ef7235fb67fc5d046783118703c097ec403aa61ee60cdda6724b395a56  chjKIdZnBZuQ77elGH1C.exe(work.digitalvichar.com)
c47e6a778db29c6d5199c7050f34ea62dd63feee708cefe9f1019f0e493492fd  z2xuC2htix3.exe(binarystationary.com)
e56416f50706384a86a6258997f81c59db9a39327fab8d18d6ebfbac4d84489b  MUOBpPXnmbEm8z6og0lX7.exe(work.digitalvichar.com)
9df02e058ceeebb59815f288d554a101d00fb12f61a657e676ea29ad226868e7  vccorlib140.exe