2020-08-24 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
anarubin@wa-abogados.com.ar
endri@idpay.co.id
huongnguyen@sieuthimaychu.vn
traffic@ellerscoffee.com.br
uaka@lexna.com.na

MALDOC DISTRIBUTION URLS
http://cnaantours.co.il/wp-content/FpdXnO5-fmzmWimTn936GF3-array/external-325259287-OBDhIV6K99ZYkF/qab-2396w4vz6z73v/
http://jurczyk.biz/piotrek/closed_resource/corporate_warehouse/257176_oJa3llEN9ouPcjQb/
http://e-machine.com.br/mailer/36887_W9M8UoU7H_resource/external_warehouse/Wphu3_12Mkmo32tbhN/
http://cadikazani.net/images/multifunctional-module/additional-portal/M8gcGsVepcmX-evmMz8isfkvj/
http://popfizzion.com/wp-content/parts_service/
http://greaudstudio.com/docs/balance/ngt574122146730759s2oxgjxrjmjzxe1/
http://faster.vn/azecq/oct/
http://gladiabernardi.com.br/ok8mu/esp/ahhk039pgnx/dqe2u40956410130933349khnpgkp5gn00n2/
https://ilaj.app/temp/browse/5dz768873962281i3k8ygzqu/
https://buggy-store.com/wp-admin/network/docs/tz04yo16g/
http://rollofkati.com/temp/INC/lenbxnn059968010058223ah6ti7jimemv10i/
http://reifenquick.de/Scripts/statement/ul397wfyb/
http://paellassupremas.com/css/46Z7BI2J/kziu6ua3/uawovui05675079ui49yo40g3bbnyveonlt/
http://cittadivita.it/citta.cittadivita.it/report/u1ltes/c00d5079402633623808y8iz1gevnrh/
http://blog.nucleoevent.com/wp-admin/form/07867514834268/fsUgfz/
https://blog.nucleoevent.com/wp-admin/form/07867514834268/fsUgfz/
http://www.insulution.org/wp-admin/maint/protected-zone/Scan/UBl/
http://blog.nucleoevent.com/wp-admin/paclm/ltypbqgwm0qe-00075292/
https://quke9.com/wp-admin/lm/tIXueV/
https://firegent.com/profile/form/503967018/MlsfCg/
https://tiendastec.com.pe/wordpress/Documentation/7254415418173246/p2bf4hoz-06100/
https://www.agenciaeureka.com.br/assinaturas/public/cbBUsi/
https://buggy-store.com/gvzia/Document/26428/suuz9uaeomi-0725808/
https://egfco.cn/agxqa/KP7P/2HFK9EB/3622461159/lrKZnj/
http://anandkhati.com/sys-cache/Scan/0178419763205/to8yqjfi-000048012/
http://siizhealth.com/wp-admin/css/esp/7071933245081413/OlWiW/
https://gopherhole.com/7qrarjz/balance/5537267970601382/8sbaw26-0043997/
https://www.actacomunicacao.com.br/provisorio/sites/rrbh2hrzhzcc-0530/
https://www.lvl.com.br/wp-includes/payment/20657897730822784/8dlv-00575/
https://www.pxid360.com/wp-admin/GYU8FEISMJW1X6I/46974/gbb20zj-000761071/
https://moraniz.co.il/wp-content/72734409736/Ku/
http://tastes2plate.com/wp-content/uploads/report/u4o55hkjzd-00014/
http://hangtheuducthanh.com/site/statement/kxmn8x0-00898075/
https://www.ajwebsites.com.br/webcalendar-master/Reporting/8151644363451165/NLUEIyhVB/
http://archmedia.com.br/Blog/FILE/1bi3i6-0338250/
http://apuch.org/lp/l7it5j-72/
http://bhar.com.br/caurina/public/0925913154809393/umfv60dcv1-00084559/
https://satmythuatdongduong.vn/wp-admin/report/55l1nol2n0t-0022/
http://www.ab-swisspro.com/wp-content/invoice/bzc56sp06ar-00060258/
http://www.ab-swisspro.com/wp-content/Pages/02aukehxq1p-000238/
http://bswinformatica.com.br/EmailMKT/Scan/480730727/gY/
https://spiidgas.com.br/open_zone/973220198548790/fof/
https://aceprintingmaui.com/images/Overview/IRnnWuX/
http://teldesign.com/stats/MBZJ7RT/2BG6/1390454371770898/emqz90qv-20/
http://onex.co.za/journal/3355836067003/pfio9p86s-49232/
http://ncsu.org.ng/wp-content/form/024874/qxa4rb0f97-0020102/
http://mj-web.dk/bdfsfevx/ckougq2/pmn/
http://guarany.net/zefiro/report/93690385325940/ZByRGqlEj/
http://evaknuesel.ch/content/Documentation/pEB/
http://darvazehtehran.ir/wp-content/docs/4993/PvFLXm/
http://cookingbuffet.com.br/wp-includes/lm/ehnlfXSDL/
http://cittadivita.it/citta.cittadivita.it/crg6sz51-00834990/
http://azraktours.com/wp-admin/INC/iprx8mhgo7ye-000979508/

ab-swisspro.com
aceprintingmaui.com
actacomunicacao.com.br
agenciaeureka.com.br
ajwebsites.com.br
anandkhati.com
apuch.org
archmedia.com.br
azraktours.com
bhar.com.br
bswinformatica.com.br
buggy-store.com
cadikazani.net
cittadivita.it
cnaantours.co.il
cookingbuffet.com.br
darvazehtehran.ir
e-machine.com.br
egfco.cn
evaknuesel.ch
faster.vn
firegent.com
gladiabernardi.com.br
gopherhole.com
greaudstudio.com
guarany.net
hangtheuducthanh.com
ilaj.app
insulution.org
jurczyk.biz
lvl.com.br
mj-web.dk
moraniz.co.il
ncsu.org.ng
nucleoevent.com
onex.co.za
paellassupremas.com
popfizzion.com
pxid360.com
quke9.com
reifenquick.de
rollofkati.com
satmythuatdongduong.vn
siizhealth.com
spiidgas.com.br
tastes2plate.com
teldesign.com
tiendastec.com.pe

DOCUMENT FILE HASHES
0fbed44a8e56adda4e75730e3b604404
47083ccc52bfd90c16aef333c6c1e390
5c6fe3d3abbe277b1838bbacce0a28ca
7b4dfaa542c5fbe44914685688eb7f8d
8edc3c8487342e650a803d995eda3aee
b6dd8de4f846e83c152d1ea48c2a300e
d256ce25828be46bce63a36fa460deb8
ed4208fb279021678a791818606d3981
f96f740ace5847851d9f69a70630221e
fc1be93f638a114bc056ad0aa2bd68db

PAYLOAD FILE HASHES
1a2e541439b3c408c348b7bad6aab440
4ea81702363a80f11fded4a5b538e384
58eb89906cd06c03bce928274f9d99db
7bcb49c6649efac69bd1926cb4fc82e1
8d0433f99ba23c0242f6229040c767aa
a858c38f9215194bd736730ba1ccbb49
ac04d4db4e30aabcb9f937bc3b6cf94a
cfd6047c44c7a7195c225ad4a4b11527

EMOTET PAYLOAD URLs
http://ahansatan.com/wp-admin/IPTpsJjvkKHDM/
http://airmaxx.rs/MbKoqsSL/
http://cryptokuota.com/assets/ayQUtnd403/
http://fgajardo.com/pruebas/iTfVzJiNG/
http://goldoni.co.uk/bmnfg411/qQmxCDIzDcR/
http://gzamora.es/9s52_ou17husakvth9fs_resource/sFe3aa/
http://hirken.com.au/images/kul5uy3a48/
http://hofhuistechniek.nl/localhost/ZDN9mtkv7hsl25097064/
http://idealli.com.br/journal/lhaci5i5315/
http://itcnt.com.np/2xk_kxs_r3u3g4/u2ka4qa5362685/
http://megasolucoesti.com/R9KDq0O8w/mg7e129370/
http://popweb.com.br/remedios/QUSArASDIIdPz/
http://powerfrog.net/Anna/ifqE/
http://remotefacilities.com/rendering2/3/
http://saimission.org/sai/fU/
http://sasystemsuk.com/recruit/H/
http://sedistribuidora.com.br/Lumine1.6/D/
http://silentfusion.net/forums/ZGR/
http://tonmeister-berlin.de/Dokumente/Zqmb3/
http://triconsnow.com/flash/T9/
http://www.essand.com/test/SOx5LA/
http://www.studio63productions.com/fonts/2v/
https://kissanime24.com/anime/tnqblnm875789/
https://toprakmedia.com/cgi-bin/F/
https://vmais.net/bebemaria/download/ne/
https://www.hhbiao.com/ro/hEGGg/
https://www.pharma-israel.org.il/wp-content/oJSUC/
https://www.teleargentina.com/ver/Y/

ahansatan.com
airmaxx.rs
cryptokuota.com
essand.com
fgajardo.com
goldoni.co.uk
gzamora.es
hhbiao.com
hirken.com.au
hofhuistechniek.nl
idealli.com.br
itcnt.com.np
kissanime24.com
megasolucoesti.com
pharma-israel.org.il
popweb.com.br
powerfrog.net
remotefacilities.com
saimission.org
sasystemsuk.com
sedistribuidora.com.br
silentfusion.net
studio63productions.com
teleargentina.com
tonmeister-berlin.de
toprakmedia.com
triconsnow.com
vmais.net

EMOTET C2s
http://162.249.220.190
http://85.25.207.108:8080
http://178.128.14.92:8080
http://181.113.229.139:443
http://118.70.15.19:8080
http://143.95.101.72:8080
http://139.99.157.213:8080
http://201.235.10.215
http://181.137.229.1
http://5.79.70.250:8080
http://107.161.30.122:8080
http://157.7.164.178:8081
http://87.106.231.60:8080
http://202.5.47.71
http://172.105.78.244:8080
http://177.94.227.143
http://173.94.215.84
http://181.126.54.234
http://217.199.160.224:8080
http://198.57.203.63:8080
http://177.144.130.105:443
http://66.61.94.36
http://195.201.56.70:8080
http://81.214.253.80:443
http://168.0.97.6
http://37.46.129.215:8080
http://60.125.114.64:443
http://181.114.114.203
http://185.142.236.163:443
http://175.29.183.2
http://91.83.93.103:443
http://178.33.167.120:8080
http://188.251.213.180:443
http://77.74.78.80:443
http://190.164.75.175
http://86.57.216.23
http://46.32.229.152:8080
http://216.75.37.196:8080
http://220.254.198.228:443
http://41.185.29.128:8080
http://179.5.118.12
http://105.209.235.113:8080
http://190.190.15.20
http://192.210.217.94:8080
http://179.62.238.49
http://190.53.144.120
http://115.78.11.155
http://139.59.12.63:8080
http://185.86.148.68:443
http://186.109.152.201
http://46.105.131.68:8080
http://113.203.250.121:443
http://86.98.143.163
http://192.163.221.191:8080
http://115.79.195.246
http://75.127.14.170:8080
http://188.0.135.237
http://113.161.148.81
http://74.208.173.91:8080
http://31.146.61.34
http://197.221.158.162
http://177.32.8.85
http://201.213.177.139
http://71.57.180.213
http://95.216.205.155:8080
http://112.78.142.170
http://78.189.60.109:443
http://81.17.93.134
http://190.212.140.6
http://172.96.190.154:8080
http://185.208.226.142:8080
http://51.38.201.19:7080
http://203.153.216.178:7080
http://192.241.220.183:8080
http://197.249.6.179:443
http://50.116.78.109:8080

http://181.30.61.163:443
http://209.126.6.222:8080
http://5.153.250.14:8080
http://188.135.15.49
http://104.131.41.185:8080
http://178.250.54.208:8080
http://50.28.51.143:8080
http://170.81.48.2
http://87.106.46.107:8080
http://191.99.160.58
http://187.162.248.237
http://89.32.150.160:8080
http://46.28.111.142:7080
http://190.190.148.27:8080
http://190.115.18.139:8080
http://178.79.163.131:8080
http://73.213.208.163
http://219.92.8.17:8080
http://95.9.180.128
http://212.71.237.140:8080
http://82.196.15.205:8080
http://111.67.12.221:8080
http://24.135.198.218
http://202.4.57.96
http://61.92.159.208:8080
http://80.249.176.206
http://77.90.136.129:8080
http://81.129.198.57
http://58.171.153.81
http://217.13.106.14:8080
http://24.148.98.177
http://51.255.165.160:8080
http://190.6.193.152:8080
http://149.62.173.247:8080
http://94.206.45.18
http://137.74.106.111:7080
http://190.195.129.227:8090
http://85.109.159.61:443
http://207.144.103.227
http://91.219.169.180
http://217.199.160.224:7080
http://104.131.103.37:8080
http://83.169.21.32:7080
http://82.163.245.38
http://204.225.249.100:7080
http://152.169.22.67
http://45.161.242.102
http://65.36.62.20
http://185.94.252.27:443
http://116.125.120.88:443
http://190.24.243.186
http://190.147.137.153:443
http://190.128.173.10
http://192.241.146.84:8080
http://186.250.52.226:8080
http://68.183.170.114:8080
http://45.173.88.33
http://12.162.84.2:8080
http://185.33.0.233
http://68.183.190.199:8080
http://73.116.193.136
http://213.60.96.117
http://189.2.177.210:443
http://186.103.141.250:443
http://177.73.0.98:443
http://72.47.248.48:7080
http://2.47.112.152
http://181.129.96.162:8080
http://5.196.35.138:7080
http://185.94.252.12
http://190.163.31.26
http://94.176.234.118:443
http://70.32.84.74:8080
http://213.176.36.147:8080
http://114.109.179.60
http://177.74.228.34
http://186.70.127.199:8090
http://174.100.27.229
http://45.33.77.42:8080
http://212.93.117.170
http://219.92.13.25
http://188.2.217.94
http://77.55.211.77:8080
http://172.104.169.32:8080
http://85.105.140.135:443
http://209.236.123.42:8080
http://70.32.115.157:8080
http://24.135.1.177
http://82.76.111.249:443
http://192.241.143.52:8080
http://51.159.23.217:443
http://191.182.6.118
http://67.247.242.247
http://177.72.13.80

http://137.119.36.33
http://116.202.234.183:8080
http://69.30.203.214:8080
http://204.197.146.48
http://87.106.136.232:8080
http://153.163.83.106
http://91.211.88.52:7080
http://93.147.212.206
http://222.214.218.37:4143
http://189.212.199.126:443
http://203.153.216.189:7080
http://83.169.36.251:8080
http://188.83.220.2:443
http://104.236.246.93:8080
http://173.62.217.22:443
http://5.196.74.210:8080
http://68.188.112.97
http://139.130.242.43
http://61.19.246.238:443
http://24.179.13.119
http://157.245.99.39:8080
http://116.203.32.252:8080
http://203.117.253.142
http://75.139.38.211
http://41.60.200.34
http://2.58.16.85:7080
http://199.101.86.142:8080
http://169.239.182.217:8080
http://209.141.54.221:8080
http://121.124.124.40:7080
http://67.205.85.243:8080
http://79.98.24.39:8080
http://85.105.205.77:8080
http://200.41.121.90
http://185.94.252.104:443
http://24.233.112.152
http://37.187.72.193:8080
http://89.186.91.200:443
http://47.144.21.12:443
http://103.86.49.11:8080
http://95.179.229.244:8080
http://190.55.181.54:443
http://113.160.130.116:8443
http://62.75.141.82
http://47.146.117.214
http://187.161.206.24
http://104.131.44.150:8080
http://109.74.5.95:8080
http://200.114.213.233:8080
http://139.59.60.244:8080
http://81.2.235.111:8080
http://174.137.65.18
http://24.43.99.75
http://201.173.217.124:443
http://137.59.187.107:8080
http://46.105.131.79:8080
http://70.121.172.89
http://78.24.219.147:8080
http://74.120.55.163
http://85.152.162.105
http://93.51.50.171:8080
http://98.109.204.230
http://104.131.11.150:443
http://95.213.236.64:8080
http://153.232.188.106
http://176.111.60.55:8080
http://74.208.45.104:8080
http://174.102.48.180
http://190.160.53.126
http://152.168.248.128:443
http://180.92.239.110:8080
http://37.139.21.175:8080
http://157.147.76.151
http://167.86.90.214:8080
http://24.137.76.62
http://112.185.64.233
http://5.39.91.110:7080
http://87.106.139.101:8080
http://97.82.79.83
http://85.66.181.138
http://181.230.116.163
http://37.70.8.161
http://110.145.77.103
http://168.235.67.138:7080
http://68.44.137.144:443