Emotet_Feodo_IOC's_05-07-2018

#Emotet #Feodo #Banking #Malware
---------------------------------
05-07-2018			IOC's
---------------------------------
#C2
Main object- "logontrns.exe"
	sha256	d5e20efb9d7f9d334f147a3892f8184e85c633cc69ce7a428f0d4623752b0efa
	sha1	d856244ab9e28a20177c2d3041964ea0eeb27665
	md5	cc12277cce8e730d10b336020801305c
HTTP/HTTPS requests
	url	http://92.27.116.104/
	url	http://24.173.127.246:443/
	url	http://186.71.61.90/
	url	http://24.121.176.48:443/
	url	http://149.62.173.247:8080/
	url	http://46.105.131.69:8080/
	url	http://24.234.175.215:8090/
	url	http://121.50.43.110:8080/
	url	http://24.119.116.230:990/
	url	http://80.153.201.243:443/
	url	http://24.229.49.37:8080/
	url	http://24.74.74.183/
	url	http://46.105.131.87/
	url	http://71.244.60.231:4143/
	url	http://199.119.78.9:443/
	url	http://187.178.17.209/
	url	http://216.21.168.27:8443/
	url	http://68.2.97.91:50000/
	url	http://157.7.164.23:8080/
	url	http://216.21.168.27:53/
	url	http://203.45.184.52/
	url	http://108.170.54.171:8080/
	url	http://222.214.218.192:4143/
	url	http://69.17.170.58/
	url	http://78.47.182.42:8080/
	url	http://76.72.225.30:465/
	url	http://203.201.60.206:443/
	url	http://177.99.167.185:443/
	url	http://12.182.146.226/
	url	http://72.0.255.155/
	url	http://178.21.113.145:4143/
	url	http://70.182.77.184:8090/
	url	http://206.210.104.194/
	url	http://193.251.43.125:7080/
	url	http://118.244.214.210:443/
	url	http://146.185.170.222:8080/
	url	http://27.50.89.209:8080/
	url	http://194.88.246.242:443/
	url	http://99.224.5.162:8080/
---------------------------------------
Main object- "Fakturierung"
	url	http://www.aventyrskrocket.se/Fakturierung/
	sha256	2cdd2da9534a046741e4dd2ac64b3e993222e5d8a7a583ce720ef8571c1e1b38
	sha1	a9592fa1db9676d34d7d2092540c1070d6a1b9e7
	md5	c0c25fcd749aa35978ea527ff3d38dcd
DNS requests
	domain	www.tcbecybersecurity.com
	domain	shop.69slam.sk
	domain	51wh.top
	domain	www.thingyapp.com
	domain	www.lecreo.se
Connections
	ip	47.94.145.10
	ip	109.74.156.2
	ip	213.171.196.39
	ip	89.221.250.37
	ip	96.125.160.15
HTTP/HTTPS requests
	url	http://51wh.top/II1S3LEJ/
	url	http://www.thingyapp.com/6nCqu9R8/
	url	http://www.lecreo.se/ZTAxFEDZxd/
	url	http://www.tcbecybersecurity.com/H56uKcU/
	url	http://shop.69slam.sk/60nDON/
----------------------------------------
Main object- "Rechs"
	url	http://www.bfcorp.ru/Rechs/
	sha256	2cdd2da9534a046741e4dd2ac64b3e993222e5d8a7a583ce720ef8571c1e1b38
	sha1	a9592fa1db9676d34d7d2092540c1070d6a1b9e7
	md5	c0c25fcd749aa35978ea527ff3d38dcd
DNS requests
	domain	shop.69slam.sk
	domain	www.tcbecybersecurity.com
	domain	51wh.top
	domain	www.lecreo.se
	domain	www.thingyapp.com
Connections
	ip	47.94.145.10
	ip	213.171.196.39
	ip	109.74.156.2
	ip	89.221.250.37
	ip	96.125.160.15
HTTP/HTTPS requests
	url	http://51wh.top/II1S3LEJ/
	url	http://www.thingyapp.com/6nCqu9R8/
	url	http://www.lecreo.se/ZTAxFEDZxd/
	url	http://shop.69slam.sk/60nDON/
	url	http://www.tcbecybersecurity.com/H56uKcU/
-------------------------------------------
Main object- "Rechnungs-fur-Zahlung"
	url	http://www.bib.dolcelab.org/Rechnungs-fur-Zahlung/
	sha256	2cdd2da9534a046741e4dd2ac64b3e993222e5d8a7a583ce720ef8571c1e1b38
	sha1	a9592fa1db9676d34d7d2092540c1070d6a1b9e7
	md5	c0c25fcd749aa35978ea527ff3d38dcd
DNS requests
	domain	shop.69slam.sk
	domain	www.tcbecybersecurity.com
	domain	www.lecreo.se
	domain	www.thingyapp.com
	domain	51wh.top
Connections
	ip	47.94.145.10
	ip	89.221.250.37
	ip	213.171.196.39
	ip	109.74.156.2
	ip	96.125.160.15
HTTP/HTTPS requests
	url	http://51wh.top/II1S3LEJ/
	url	http://www.lecreo.se/ZTAxFEDZxd/
	url	http://shop.69slam.sk/60nDON/
	url	http://www.thingyapp.com/6nCqu9R8/
	url	http://www.tcbecybersecurity.com/H56uKcU/
-------------------------------------------
Main object- "Rechnungs"
	url	http://www.veremac.cl/Rechnungs/
	sha256	2cdd2da9534a046741e4dd2ac64b3e993222e5d8a7a583ce720ef8571c1e1b38
	sha1	a9592fa1db9676d34d7d2092540c1070d6a1b9e7
	md5	c0c25fcd749aa35978ea527ff3d38dcd
DNS requests
	domain	shop.69slam.sk
	domain	www.tcbecybersecurity.com
	domain	www.lecreo.se
	domain	www.thingyapp.com
	domain	51wh.top
Connections
	ip	47.94.145.10
	ip	213.171.196.39
	ip	109.74.156.2
	ip	89.221.250.37
	ip	96.125.160.15
HTTP/HTTPS requests
	url	http://51wh.top/II1S3LEJ/
	url	http://www.thingyapp.com/6nCqu9R8/
	url	http://www.lecreo.se/ZTAxFEDZxd/
	url	http://shop.69slam.sk/60nDON/
	url	http://www.tcbecybersecurity.com/H56uKcU/