2020-08-12 TA505 IOCs

THREAT ATTRIBUTION:  TA505

SUBJECTS OBSERVED
Updated Finance Dept. Assignments

SENDERS OBSERVED
accounting@fuji[.]co[.]th
acct-ar@ekadharma[.]co[.]id
admin@lcc-allgaeu[.]de
administracion@mosa[.]com[.]mx
angeli@inrete[.]com
carla[.]merli@pergamino[.]gob[.]ar
chen-hj@tsinghua[.]edu[.]cn
chris_lo@cyberpowersystems[.]com[.]tw
contact@gancorp[.]fr
contact@yamani-ks[.]co[.]jp
curriculum@linkey[.]it
egon@altek-laser[.]dk
fetisova[.]natalia@santa[.]by
guy@azd[.]com[.]au
highway@bizlogistics[.]biz
hui_liu@priver[.]com
info@erenhasgroup[.]com
info@kobe-nextage[.]com
info@sanderc[.]net
info@soroban[.]or[.]jp
info@sunbig[.]net
info@sushiart[.]cz
kadry@ekk-wagon[.]pl
lab@fauna-fish[.]by
list@aaart[.]edu
m[.]logel@hans-associes[.]fr
m[.]maccari@comune[.]corciano[.]pg[.]it
maria[.]escobar@pergamino[.]gob[.]ar
maurice[.]corver@deimac[.]nl
morimoto@amibrand[.]co[.]jp
mundodacerveja@mundodacerveja[.]com
o[.]gueye@synthesis-sn[.]com
office@sfk-hoellrigl[.]at
osmanbaysal@baysallar[.]com
postmaster@ixchelent[.]com
rainer[.]behrends@erf[.]de
respllpp@comune[.]corciano[.]pg[.]it
sanchezgarces@dr[.]teknon[.]es
scouts@sonningscouts[.]co[.]uk
thanij@blpower[.]co[.]th
viajesislamar@group-team[.]com
weicheng@dgrise[.]com
ys2320[.]kim@samco1[.]co[.]kr
ziolkowskak@terbud[.]pl

MALDOC FILE HASH
258d275e5483df0432664569018d105d
76518e28fc8c37ed346585c632732d01

PAYLOAD FILE HASH
665453a0b3488eb243921adaeb79da3d

MALDOC LANDING PAGE URLS
hxxp://150[.]60[.]3[.]44/04aowo[.]html
hxxp://198[.]91[.]87[.]97/sxuoz8s[.]html
hxxp://aaa-architecten[.]nl/3xa9[.]html
hxxp://buresova-obrazy[.]wz[.]cz/8omcp[.]html
hxxp://caavfx248[.]secure[.]ne[.]jp/ek3ecp[.]html
hxxp://cgmt[.]co[.]id/vipd[.]html
hxxp://coolnovelties[.]co[.]uk/a9k87[.]html
hxxp://dashingleather[.]com/5yfo[.]html
hxxp://decor8[.]ie/9qpr7y[.]html
hxxp://deechtebol[.]com/hadtz6[.]html
hxxp://dmatica[.]it/4xcs[.]html
hxxp://eatondesigns[.]com/9jkd[.]html
hxxp://izmsj[.]co[.]jp/~y-kubota/wc8r5[.]html
hxxp://jesamcorp[.]com/yxduf[.]html
hxxp://jlcarral[.]com/ylype[.]html
hxxp://jmvisuals[.]com/dzc45[.]html
hxxp://mwt[.]net/~blainee/gkxnfr[.]html
hxxp://ntskeptics[.]org/ew7do[.]html
hxxp://nyittc[.]com/apbux[.]html
hxxp://petzel[.]be/kae443[.]html
hxxp://sabre[.]com[.]tw/nm95[.]html
hxxp://scgis[.]co[.]uk/6235ig[.]html
hxxp://seapower-italia[.]it/x9vg[.]html
hxxp://sistemishop[.]it/fwplbl[.]html
hxxp://sorrentotransport[.]com/yvn6cv5[.]html
hxxp://spadework[.]org/yuyfkfj[.]html
hxxp://spiralfolderrollers[.]com/om5kx[.]html
hxxp://staceydodge[.]com/zyqkfem[.]html
hxxp://streamfisherman[.]net/23gqs[.]html
hxxp://theswimshop[.]co[.]za/i0t72[.]html
hxxp://tomsonguitars[.]co[.]uk/nk0j7r[.]html
hxxp://unser-en[.]de/ql9s3t[.]html
hxxp://wallflore[.]de/nyj7h[.]html
hxxp://www[.]1120[.]com[.]tw/44md2[.]html
hxxp://www[.]bluecrabhosting[.]co[.]uk/a1ralfa[.]html
hxxp://www[.]everestgroupcorp[.]com/b0zbrpf[.]html
hxxp://www[.]ozonatory24[.]pl/~ozonator/t63b9z[.]html
hxxp://www[.]skegness[.]net/xwm9llc[.]html
hxxp://www4176uc[.]sakura[.]ne[.]jp/~n-harada/hraq[.]html

MALDOC DISTRIBUTION URLS
hxxps://dl1[.]tremd-space[.]com

TA505 C2s
band-switch[.]com