Rewterz Threat Alert – Emotet Malware – IOCs

Severity

Medium

Analysis Summary

Emotet is a Trojan that is primarily spread through spam emails (malspam). The infection may arrive either via maliciousscript, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet may try to persuade users to click the malicious files by using tempting language about “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as a malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers.

Impact

• Financial loss 
• Exposure of sensitive data

Indicators of Compromise

URL

• http[:]//amcoitsystems[.]com/wp/ZxXBfZxSe/
• http[:]//iraniansk[.]com/open_array/y95o2z97gsw3_nk9buc_profile/8iowzk2_z150t43sy3y/
• http[:]//bswinformatica[.]com[.]br/EmailMKT/private_array/close_CxUlww_PuqO4dNtDETT4q/d9in9vwcj25lrkk_127134t79/
• http[:]//admvero[.]com[.]br/minhaagua/personal_box/close_lcdwnop_iedanuwfbxoc/LqmhQ1I_novvbhnpju/
• http[:]//rccarcare[.]com[.]au/cgi-bin/multifunctiona
• http[:]//gh[.]xahpyy120[.]com/phpmyadmin/doc/fPJxu81Tt/
• http[:]//ocelliptigo[.]com/undrag/FRg446071/
• https[:]//novaerahost[.]com[.]br/wp-includes/esp/cjh1v1g/1z9142818156815sx04kesjmn9zre/
• https[:]//cafeponton[.]nl/bin/parts_service/a72xoqz31937247035rgmoh6edecbdwqiwa8f/

Remediation

• Block all threat indicators at your respective controls. 
• Search for IOCs in your environment.