2018-07-03 orbit99.co.id #emotet #malware c2

url	http://orbit99.co.id/pcobiruwe/e3zaz13al/
    https://app.any.run/tasks/ed423b24-99d7-4775-8220-dbe43bc4c607
    https://www.hybrid-analysis.com/sample/4db063359ba714128e1bed3f8620709a723a931d0d8194495c420b852d86199d
	md5	22336988a5ebc19cf8ebf30acd7a5d83

HTTP/HTTPS requests
	url	http://189.197.62.222:443/	(yes response per anyrun - 2 posts, yes response per urlscan, yes traffic per HA - 1 post)
             (in memory in lab, http post in lab with 200 ok)
	url	http://92.190.229.94:8080/	(no response per anyrun, yes response per urlscan, no traffic per HA)
             (nothing in lab)
	url	http://182.74.91.114:443/	(no response per anyrun, no response per urlscan, no traffic per HA)
             (nothing in lab)
	url	http://188.246.6.94:8080/	(yes response per anyrun - 6 posts, yes response per urlscan, no traffic per HA)
             (nothing in lab)



---------
lab http responses from .222:443
---------

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 03 Jul 2018 15:01:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 132
Connection: keep-alive

.....\..^...]].a..O.k........d.Ge....MN.#_.W.].?Y.9q.A..a|].9P:o...0>q..G...;...o...y..H.y..8.R.xc..1....U0.g....h.&..i.....0.l...Gj

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 03 Jul 2018 15:02:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 132
Connection: keep-alive

.....\..^...]].a..O.k........d.Ge....MN.#_.W.].?Y.9q.A..a|].9P:o...0>q..G...;...o...y..H.y..8.R.xc..1....U0.g....h.&'..<../...wU....

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 03 Jul 2018 15:04:29 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 132
Connection: keep-alive

.....\..^...]].a..O.k........d.Ge....MN.#_.W.].?Y.9q.A..a|].9P:o...0>q..G...;...o...y..H.y..8.R.xc..1....U0.g....h.&....S....SM.E>.x