2020-07-23 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

NOTES
Today's template theme is "file was created on IOS device".
I saw .doc, .docm and .rtf files today.
Once again, I encountered several urls (both maldoc and payload) that were just displaying meme gif files.
All of the gifs that I saw today were the same - "Hackerman".

SUBJECTS OBSERVED
Invoice 094441

SENDERS OBSERVED
lisa@agshealth[.]co[.]za

MALDOC DISTRIBUTION URLS
http://1001sb[.]checkyourprojects[.]com/lib/paclm/lgrwig7cykr0/9aw5vp41593563498ub66j70gyiy6ux6pvz/
http://abatiy[.]com/yaa/qPYZ2JGnOt-TC1GkrlLVJl-section/special-warehouse/2shz-319s9v04/
http://alaksir[.]com/Scripts/balance/
http://allan-it[.]com/wp-admin/sites/
http://allsound[.]fr/wp-content/uploads/statement/vhxjig/
http://anhdung[.]cf/zh8uj/closed-mVbWo-Lf2b4ytDyUtki/additional-portal/12659545774-iKu33eqyMzGk/
http://aswad[.]shop/wp-admin/swift/thsao2y/
http://avantgardechristianschool[.]com/wp-admin/Mrd/
http://bagraphics[.]net/discreetlaundryservices[.]com/personal_array/test_cloud/461281829124_RsSGemjuK/
http://bawaslu[.]wonosobokab[.]go[.]id/wp-content/Scan/7h623096050tn6ok7lacgmbre/
http://bethagroup[.]com[.]au/wp-admin/4126445-72SMD3Z1kG6-array/verified-kbxvgkvk-ub5m61njwm/2fwrw03dhg1-vtx0y7sztv50zw/
http://biyaofushi[.]com/xkf1bbx/open_module/security_a8n_jdy/1764518343_6WZkUj0kZ/
http://blswlaw[.]com/aspnet_client/open_7755472302_xx6s7U/pz67_5s45pwd_cloud/353658633_S1aB0ol6PjXU/
http://bosisio[.]net/www/protected_array/additional_D6JRYsB_BMt5t0VGP9Dk/43952736661012_dQZ7rqEf/
http://bubuapps[.]world/wp-content/languages/dr-9ho-148/
http://chiaraberettamazzotta[.]it/wp-includes/g9ayf-lg6d-9526/
http://collectorsmatrix[.]com/COPYRIGHT/payment/ejhd45ct/
http://de-hoog[.]de/cgi-bin/FILE/c463298602390755c1mvtjynyi5s8/
http://de-hoog[.]de/cgi-bin/FILE/c463298602390755c1mvtjynyi5s8//
http://dekuiper[.]net/Joost/parts_service/9mtcfltji2b/89k7496160409uk8wl9rhgibbmzo5/
http://deutschcabrio[.]de/D://available-resource/interior-space/tzi4004hqga035bb-61w176s1z5t4/
http://dfb-fredericia[.]dk/menu/wXNMvHjn/
http://driendl[.]de/Adresse/gks-l1t69-47104/
http://ecommerceequityllc[.]com/wp-content/7pik4349780935048175j2iv1681spsba/
http://edumep[.]net/llibres/iyedWFO/
http://etherdox[.]com/seniors/wkjvv70865id5bmtlwp7oqe13zg943o2/
http://evandijk[.]eu/4fd2c798720871f16/4mf-uwkxa-773/
http://ezzit[.]com/img/Ha/
http://fili[.]es/david/e1ssl7lm3-esva8s6xxi4imv-module/9586148-Kk3jZqKCVHaKny3-portal/nb0-843yx8y00653t/
http://floow[.]co/fonts/CRoUn/
http://geoffoliver[.]org/simple-blog[.]off/vendor/payment/9yiv2xys/
http://gersonbranco[.]com[.]br/bin/c6dfz19c-vr42-766437/
http://gmjenkins[.]com/sean/lm/
http://griedl[.]de/bernhard/protected-module/verifiable-warehouse/22498995-nKHEpSAPJSRb/
http://grotha[.]de/cgi-bin/3457882_FofdDqbL0ndy_sector/external_forum/51583993_GPJbPIDdAFZF/
http://gut-ellmau[.]de/cgi-bin/multifunctional-resource/yG9IG7-mmdkHtzPt-Gdl683w5a6-LD3cPpq3gm/yNWtth-z0LaefxHxlurxj/
http://guthnet[.]de/assets/J4P4XfxrX_jyFNVtcEnS_box/special_area/8hpduj_4z2yx61zt/
http://guyenot[.]de/bilder/Overview/an8857726377165926pmlsrp2nk152ze/
http://haendlerzufriedenheit[.]de/cgi-bin/lm/5umvxyh/
http://hamiltonslive[.]com/cgi-bin/statement/
http://huangqw[.]club/jl86l/public/
http://human-impact[.]de/cgi-bin/3883756-wRVMufzClgypMQD-resource/DogQRTa-jrKAmsac20-forum/010684124723-tOLBTI4iPxwTdf8/
http://hvdc-int[.]eu/ARCHIVES/FILE/kxln11706113168rvobu4zw11otwn1sb/
http://jygasoft[.]com/wp-admin/private_resource/verifiable_area/946338247_dembyve0x/
http://myprospectjobs[.]com/wp-content/OCT/htq9xxyz2/
http://seftil[.]com/inc/public/iz4q7p/ab94927025922r4l57x1xy6wnxhodsc0j/
http://suibe[.]net/wp-content/uckdBH/
http://the-tshirtgame[.]com/wp-includes/0bfuiz0-tdalr-571/
http://thepromostore[.]events/content/xlru/
http://vccerramientos[.]com[.]ar/suy9/qd7o1-fl-5139/
http://womart[.]in/wp-content/5okkdkkl0nqd1ps_dbwnkta_module/guarded_5lro22myi_f2fohakbv9q/9941389960_cGTkySSbXA/
http://www[.]aibd[.]sn/wp-content/uploads/2020/OCT/
http://www[.]campdevanol[.]com/sites/pages/browse/w4wzf0793055tzbclt0wnda/
http://www[.]campdevanol[.]com/sites/pages/DOC/d3my2f/
http://www[.]gsfhl[.]com/wp-admin/attachments/jqhu3k/
http://www[.]idacalifornia[.]org/wp-content/imk_storage/s7-u4-326595/
http://www[.]lavidagroups[.]com/backup-files/personal_resource/0063688_4ifDH1sv_area/0im1xui0_1twsut4xt71z/
http://www[.]news247[.]agency/aavgld/private_zone/special_yxeuA_dV4Nq3HEdIwjEJ/576320061924_JqiqG7/
http://wx[.]qq125[.]com/2017/open-resource/individual-portal/xrOqUdUB-72z1apIwpoM04N/
https://abatiy[.]com/yaa/qPYZ2JGnOt-TC1GkrlLVJl-section/special-warehouse/2shz-319s9v04/
https://copy[.]think-thank[.]de/wp-admin/protected_resource/PZ6H5S8_b6WFSHgMQzMrgE_portal/j0n9u7qbtq_yxzs49t/
https://criaresports[.]com[.]br/simulador/common_module/test_portal/0snli7japc5i_8w282/
https://deltat[.]us/wp-admin/lm/
https://essential1shop[.]co[.]za/wp-content/69760557_IOjtPECu_box/verified_cloud/939279_MLzODjPBDFS/
https://expitec[.]de/backup/xyQvLctzL/
https://gamesmanga[.]com/wp-includes/INC/
https://giakhanghitech[.]vn/private_module/personal-module/external-forum/hoaof1-t73596wu2v5vz/
https://groombridge[.]ch/new_downYs/5u14-nzzfdmxtnuj54-840070-o9VP8O/additional-space/275001163-lB5K3de9Z5/
https://kenshuusei[.]id/wp-admin/56387/
https://keralamedical[.]help/wp-content/uploads/1DY7bzgle-rSa51OdMA-array/special-6suj-yho/607001926281-UQBPfkKB/
https://lawrenceclasses[.]com/vj/GRADy5m_V1VQoIEvH_zone/test_forum/5575360_0qJHP76yUBGM/
https://lcccl[.]ca/ik/142y-gt-24732/
https://mallutechie[.]com/wp-content/3ukm-k3-45161/
https://panoramatecnologia[.]com/fisy1/qckmpip_82y9lhfyp6mn_box/close_profile/3mhzlcogex_9y854y9x4xvs84/
https://suxin[.]run/wp-includes/browse/r04fy7792741tgi5mnhgnparlk3p7hn/
https://www[.]drbino[.]com/wp-content/invoice/
https://www[.]wpbkw[.]com/wordpress/browse/

DOCUMENT FILE HASHES
37f5f2fa7d0c473ed689525b13c28027
64a90bf27585087bbabea91adccc35c7
76f78c0cc3e40bd0ed492890fd9a538b
771ddfae96b2c3dc8c60f1ef450ca531
90e270248e3048c31df231d8b70f9442
9d804d330c51a298065de206267c3b04
9dd0ec18ea25e93a91e6503ef34127e6
af143ae1f594d97313566c58a65b931a
b079d288aba47a133c443523ba2112ba
c208e9c99c565052a65df2b8ec55935f
d1cecf186321bf877fffc9fb2f2460b2

PAYLOAD FILE HASHES
209804b00fed613e1bc2fd8aa21ba9a6
5ab3ecaa5067d8152e52d6010ea7028b
84dc7f6c4c13e36ff343221b61f7fd46
93e5ab3ff93d410493d152549ce95b4a
d6c4910ca03eaae4ad7dd9d6d7d7db5b

EMOTET PAYLOAD URLs
http://beylerbeyibasketbol[.]org/wp-content/plugins/ywzFYh7xm32/
http://budderoo[.]com/cgi-bin/29cJJH3N/
http://chadcast[.]com/public_html/Vgg98QC0jC/
http://chang[.]be/carole/kkVWtXa/
http://chcquimica[.]com[.]br/loja/qtbmmjrt14kd4ot_t9cfy83_g42n8ts6/
http://deardarcy[.]com/css/iu5hEJBJ5/
http://dencker[.]info/blogs/EVTd35fbbn7136/
http://digiwebmarketing[.]com/wp-admin/72t0jjhmv7takwvisfnz_eejvf_h6v2ix/
http://exactlly[.]com/aspnet_client/b9ajpp4ph3919736/
http://familie-kamenz[.]de/WordPress_01/yoAgOp3nqs1f6s46320/
http://fantomgl[.]com/cgi-bin/UVjmD8unt9339/
http://fatosdafe[.]com/links/9R81/
http://finaleligure[.]de/Sales/nusylocbn35924659/
http://flamencoboston[.]com/workshops/AqEG/
http://flyfox[.]de/cgi-bin/2O64974xq0518072/
http://fourserious[.]com/BRAVADO_1401_1402/sadN3/
http://gijsvanroij[.]nl/170101/cua5mnzjfcg8bi8esjju_ryiud_qjv2zcgixs/
http://givingthanksdaily[.]com/cgi-bin/jHU/
http://graduategames[.]com/Downloads/QP/
http://grainsperger[.]de/bilder/LMZdirUag/
http://greeena[.]com/wp-content/plugins/s1vDmkhawy2n1717/
http://grooveshack[.]net/wp-includes/J9k/
http://grupocruzco[.]com/azk/r1tikt/
http://haarwelten[.]com/_test/zJikECHQ/
http://holfve[.]se/images/1ckw5mj49w_2k11px_d/
http://localpelis[.]org/vizvx/JAmJ4u0RN/
http://steamunlocked[.]site/wp-includes/zd/
http://www[.]cfm[.]nl/_backup/yfhrmh6u0heidnwruwha2t4mjz6p_yxhyu390i6_q93hkh3ddm/
http://www[.]davidzabarte[.]com/Backup/hToa8uw9648/
http://www[.]nevefe[.]com/wp-content/MLLth596/
http://www[.]yueyunmumen[.]com/forum/9sjmt4142/
http://xycgsck[.]com/wp-admin/4ltp_6h_d6hcijri8/
https://bangkokcityjewel[.]com/cgi-bin/9Qm621/
https://boulderinn[.]com/cgi-bin/710sj1hy96ynyfens7bm53a9h_7gpg2a_g1487pb/
https://coverdomesticappliances[.]com/wp-content/zpcj/
https://fastreadhotnews[.]com/assets/87nzy_l5_nsek/
https://haoqunkong[.]com/bn/s9w4tgcjl_f6669ugu_w4bj/
https://monikaimpex[.]com/wp-content/ujjdh/
https://www[.]bunnyrank[.]com/xsx/aEe/
https://www[.]exactlly[.]com/aspnet_client/b9ajpp4ph3919736/
https://www[.]python1314[.]com/w-bbs/template/JmDCURzp/
https://www[.]techtravel[.]events/informationl/8lsjhrl6nnkwgyzsudzam_h3wng_a6v5/

EMOTET C2s
http://94[.]49[.]254[.]194
http://212[.]51[.]142[.]238:8080
http://91[.]231[.]166[.]124:8080
http://162[.]241[.]92[.]219:8080
http://79[.]98[.]24[.]39:8080
http://109[.]117[.]53[.]230:443
http://78[.]189[.]165[.]52:8080
http://113[.]160[.]130[.]116:8443
http://121[.]124[.]124[.]40:7080
http://101[.]187[.]97[.]173
http://168[.]235[.]67[.]138:7080
http://104[.]131[.]44[.]150:8080
http://5[.]39[.]91[.]110:7080
http://139[.]59[.]60[.]244:8080
http://81[.]2[.]235[.]111:8080
http://116[.]203[.]32[.]252:8080
http://61[.]19[.]246[.]238:443
http://176[.]111[.]60[.]55:8080
http://190[.]55[.]181[.]54:443
http://108[.]48[.]41[.]69
http://203[.]153[.]216[.]189:7080
http://103[.]86[.]49[.]11:8080
http://104[.]236[.]246[.]93:8080
http://75[.]139[.]38[.]211
http://169[.]239[.]182[.]217:8080
http://62[.]75[.]141[.]82
http://93[.]156[.]165[.]186
http://73[.]11[.]153[.]178:8080
http://157[.]245[.]99[.]39:8080
http://41[.]60[.]200[.]34
http://50[.]116[.]86[.]205:8080
http://31[.]31[.]77[.]83:443
http://209[.]182[.]216[.]177:443
http://62[.]138[.]26[.]28:8080
http://95[.]213[.]236[.]64:8080
http://95[.]179[.]229[.]244:8080
http://209[.]141[.]54[.]221:8080
http://91[.]211[.]88[.]52:7080
http://173[.]91[.]22[.]41
http://222[.]214[.]218[.]37:4143
http://37[.]187[.]72[.]193:8080
http://137[.]59[.]187[.]107:8080
http://139[.]130[.]242[.]43
http://46[.]105[.]131[.]87
http://87[.]106[.]139[.]101:8080
http://200[.]55[.]243[.]138:8080
http://5[.]196[.]74[.]210:8080
http://79[.]7[.]158[.]208
http://185[.]94[.]252[.]104:443
http://104[.]131[.]11[.]150:443
http://37[.]139[.]21[.]175:8080
http://190[.]108[.]228[.]62:443
http://24[.]1[.]189[.]87:8080
http://91[.]205[.]215[.]66:443
http://186[.]208[.]123[.]210:443
http://108[.]26[.]231[.]214
http://201[.]173[.]217[.]124:443
http://110[.]145[.]77[.]103
http://190[.]160[.]53[.]126
http://162[.]154[.]38[.]103
http://78[.]24[.]219[.]147:8080
http://210[.]165[.]156[.]91
http://109[.]74[.]5[.]95:8080
http://95[.]9[.]185[.]228:443
http://93[.]51[.]50[.]171:8080
http://200[.]41[.]121[.]90
http://46[.]105[.]131[.]79:8080
http://124[.]45[.]106[.]173:443
http://74[.]208[.]45[.]104:8080
http://153[.]126[.]210[.]205:7080
http://87[.]106[.]136[.]232:8080
http://190[.]144[.]18[.]198

http://71[.]208[.]216[.]10
http://212[.]51[.]142[.]238:8080
http://5[.]39[.]91[.]110:7080
http://109[.]74[.]5[.]95:8080
http://121[.]124[.]124[.]40:7080
http://139[.]130[.]242[.]43
http://162[.]241[.]92[.]219:8080
http://93[.]156[.]165[.]186
http://203[.]153[.]216[.]189:7080
http://169[.]239[.]182[.]217:8080
http://78[.]189[.]165[.]52:8080
http://37[.]187[.]72[.]193:8080
http://110[.]145[.]77[.]103
http://190[.]144[.]18[.]198
http://209[.]182[.]216[.]177:443
http://74[.]208[.]45[.]104:8080
http://209[.]141[.]54[.]221:8080
http://190[.]160[.]53[.]126
http://87[.]106[.]139[.]101:8080
http://176[.]111[.]60[.]55:8080
http://162[.]154[.]38[.]103
http://70[.]167[.]215[.]250:8080
http://95[.]179[.]229[.]244:8080
http://153[.]126[.]210[.]205:7080
http://91[.]231[.]166[.]124:8080
http://79[.]98[.]24[.]39:8080
http://173[.]91[.]22[.]41
http://210[.]165[.]156[.]91
http://91[.]205[.]215[.]66:443
http://108[.]48[.]41[.]69
http://189[.]212[.]199[.]126:443
http://61[.]19[.]246[.]238:443
http://168[.]235[.]67[.]138:7080
http://104[.]131[.]44[.]150:8080
http://24[.]1[.]189[.]87:8080
http://109[.]117[.]53[.]230:443
http://104[.]236[.]246[.]93:8080
http://79[.]7[.]158[.]208
http://91[.]211[.]88[.]52:7080
http://222[.]214[.]218[.]37:4143
http://180[.]92[.]239[.]110:8080
http://81[.]2[.]235[.]111:8080
http://41[.]60[.]200[.]34
http://200[.]41[.]121[.]90
http://75[.]139[.]38[.]211
http://157[.]245[.]99[.]39:8080
http://137[.]59[.]187[.]107:8080
http://185[.]94[.]252[.]104:443
http://108[.]26[.]231[.]214
http://5[.]196[.]74[.]210:8080
http://104[.]131[.]11[.]150:443
http://103[.]86[.]49[.]11:8080
http://95[.]9[.]185[.]228:443
http://37[.]139[.]21[.]175:8080
http://62[.]138[.]26[.]28:8080
http://87[.]106[.]136[.]232:8080
http://200[.]55[.]243[.]138:8080
http://95[.]213[.]236[.]64:8080
http://78[.]24[.]219[.]147:8080
http://139[.]59[.]60[.]244:8080
http://46[.]105[.]131[.]87
http://50[.]116[.]86[.]205:8080
http://113[.]160[.]130[.]116:8443
http://31[.]31[.]77[.]83:443
http://190[.]55[.]181[.]54:443
http://116[.]203[.]32[.]252:8080
http://93[.]51[.]50[.]171:8080
http://94[.]49[.]254[.]194
http://62[.]75[.]141[.]82
http://201[.]173[.]217[.]124:443
http://186[.]208[.]123[.]210:443
http://46[.]105[.]131[.]79:8080
http://124[.]45[.]106[.]173:443

http://71[.]50[.]31[.]38
http://185[.]94[.]252[.]13:443
http://217[.]199[.]160[.]224:7080
http://181[.]167[.]96[.]215
http://111[.]67[.]12[.]221:8080
http://68[.]183[.]170[.]114:8080
http://212[.]71[.]237[.]140:8080
http://83[.]169[.]21[.]32:7080
http://190[.]6[.]193[.]152:8080
http://217[.]13[.]106[.]14:8080
http://181[.]31[.]211[.]181
http://177[.]66[.]190[.]130
http://192[.]241[.]146[.]84:8080
http://80[.]249[.]176[.]206
http://204[.]225[.]249[.]100:7080
http://137[.]74[.]106[.]111:7080
http://5[.]196[.]35[.]138:7080
http://104[.]131[.]103[.]37:8080
http://189[.]218[.]165[.]63
http://170[.]81[.]48[.]2
http://61[.]92[.]159[.]208:8080
http://219[.]92[.]13[.]25
http://2[.]47[.]112[.]152
http://181[.]129[.]96[.]162:8080
http://178[.]79[.]163[.]131:8080
http://187[.]162[.]248[.]237
http://46[.]28[.]111[.]142:7080
http://212[.]231[.]60[.]98
http://187[.]51[.]47[.]26
http://187[.]106[.]41[.]99
http://185[.]94[.]252[.]12
http://94[.]176[.]234[.]118:443
http://77[.]90[.]136[.]129:8080
http://12[.]162[.]84[.]2:8080
http://68[.]183[.]190[.]199:8080
http://203[.]25[.]159[.]3:8080
http://190[.]163[.]31[.]26
http://46[.]214[.]11[.]172
http://190[.]163[.]1[.]31:8080
http://172[.]104[.]169[.]32:8080
http://72[.]47[.]248[.]48:7080
http://190[.]96[.]118[.]251:443
http://186[.]70[.]127[.]199:8090
http://202[.]62[.]39[.]111
http://157[.]7[.]199[.]53:8080
http://181[.]30[.]69[.]50
http://89[.]32[.]150[.]160:8080
http://51[.]255[.]165[.]160:8080
http://177[.]75[.]143[.]112:443
http://104[.]236[.]161[.]64:8080
http://177[.]144[.]135[.]2
http://70[.]32[.]84[.]74:8080
http://114[.]109[.]179[.]60
http://190[.]181[.]235[.]46
http://87[.]106[.]46[.]107:8080
http://45[.]161[.]242[.]102
http://104[.]131[.]41[.]185:8080
http://50[.]28[.]51[.]143:8080
http://190[.]194[.]242[.]254:443
http://144[.]139[.]91[.]187:443
http://192[.]241[.]143[.]52:8080
http://82[.]196[.]15[.]205:8080
http://77[.]55[.]211[.]77:8080
http://190[.]17[.]195[.]202
http://143[.]0[.]87[.]101
http://181[.]120[.]79[.]227
http://185[.]94[.]252[.]27:443
http://177[.]72[.]13[.]80
http://186[.]250[.]52[.]226:8080
http://70[.]32[.]115[.]157:8080
http://190[.]147[.]137[.]153:443
http://149[.]62[.]173[.]247:8080
http://177[.]139[.]131[.]143:443