Rewterz Threat Alert – Emotet – Active IOCs

December 8, 2021

Severity

High

Analysis Summary

Emotet has recently found in increased cyber activities after a short period of dormancy. Fresher IoCs are being retrieved everyday. Emotet is a banking trojan turned to a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet operators usually try to get users to click the malicious files by using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as a malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with emotet.

Impact

Credential Theft
Information Theft
Financial Loss

Indicators of Compromise

IP

128[.]199[.]192[.]135
37[.]44[.]244[.]177
66[.]42[.]57[.]149
207[.]148[.]81[.]119
210[.]57[.]209[.]142

MD5

43535c1f603654f9503f5095a8d3d639
d5957581b71ffbbe41341ae70a948b46

SHA-256

3f0818f432853b65fd5b789946c36af8b773ad61dab06891f95c643c526c3450
bb5e7a72c0ef4e745eaa2461adf3585536074942ea9a065a14342b766f341b47

SHA-1

e46aa47ef461bae4572cbcb55379b4b289afae39
16bdd87c08cb72d6f3def5ba44fbb72e5c417290

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.