Rewterz Threat Alert – Emotet – Active IOCs

Severity

High

Analysis Summary

Emotet has recently found in increased cyber activities after a short period of dormancy. Fresher IoCs are being retrieved everyday. Emotet is a banking trojan turned into a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate emails. Emotet operators usually try to get users to click the malicious files by using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with emotet.

Impact

• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

IP

• 91[.]240[.]118[.]172
• 173[.]214[.]173[.]220
• 212[.]237[.]5[.]209
• 192[.]254[.]71[.]210
• 216[.]158[.]226[.]206
• 162[.]243[.]175[.]63
• 212[.]24[.]98[.]99
• 58[.]227[.]42[.]236
• 45[.]118[.]115[.]99
• 104[.]251[.]214[.]46
• 185[.]157[.]82[.]209
• 46[.]55[.]222[.]11
• 188[.]40[.]137[.]206
• 81[.]0[.]236[.]90
• 103[.]75[.]201[.]2
• 129[.]232[.]188[.]93
• 195[.]154[.]133[.]20
• 159[.]8[.]59[.]82
• 79[.]172[.]212[.]216
• 138[.]185[.]72[.]26
• 200[.]17[.]134[.]35
• 185[.]157[.]82[.]211
• 209[.]59[.]138[.]75
• 178[.]63[.]25[.]185
• 45[.]176[.]232[.]124
• 45[.]118[.]135[.]203
• 164[.]68[.]99[.]3
• 203[.]114[.]109[.]124
• 212[.]237[.]17[.]99
• 50[.]116[.]54[.]215
• 131[.]100[.]24[.]231
• 212[.]237[.]56[.]116
• 45[.]142[.]114[.]231
• 162[.]214[.]50[.]39
• 51[.]38[.]71[.]0
• 104[.]168[.]155[.]129
• 107[.]182[.]225[.]142
• 217[.]182[.]143[.]207
• 158[.]69[.]222[.]101
• 176[.]104[.]106[.]96
• 207[.]38[.]84[.]195
• 41[.]76[.]108[.]46
• 110[.]232[.]117[.]186
• 178[.]79[.]147[.]66
• 173[.]212[.]193[.]249
• 159[.]69[.]43[.]124
• 45[.]79[.]80[.]198
• 207[.]148[.]81[.]119
• 128[.]199[.]192[.]135
• 118[.]98[.]72[.]86
• 217[.]182[.]143[.]207
• 168[.]197[.]250[.]14
• 116[.]124[.]128[.]206
• 78[.]46[.]73[.]125
• 185[.]148[.]168[.]15
• 195[.]154[.]146[.]35
• 85[.]214[.]67[.]203
• 194[.]9[.]172[.]107
• 59[.]148[.]253[.]194
• 210[.]57[.]209[.]142
• 54[.]38[.]242[.]185
• 195[.]77[.]239[.]39
• 159[.]69[.]237[.]188
• 104[.]131[.]62[.]48
• 62[.]171[.]178[.]147
• 142[.]4[.]219[.]173
• 66[.]42[.]57[.]149
• 190[.]90[.]233[.]66
• 54[.]37[.]228[.]122
• 185[.]168[.]130[.]138
• 191[.]252[.]103[.]16
• 37[.]59[.]209[.]141
• 185[.]148[.]168[.]220
• 37[.]44[.]244[.]177
• 203[.]153[.]216[.]46
• 45[.]13[.]132[.]26

MD5

• 2d6b1b71f2236383b289cd1139e41567
• 617b9002713abf419751e1ca54904e52
• 4a555efcda5f7376a770448a780cfa47
• bd93924ec48092a42c450a51534a7748
• f67bd1fe854ee6fd273eb0b3a363c1e5
• a22948d8d32b03d352d6e6524cb55bd9
• 7c2b963494a4d4526d6cfa166e95aef9
• 1add1ea40e994e3b8a0c517f7667e38d
• 8964af472169430e88aba297009ec7ee
• e89bf1102cd38dc1364f54407bb4cb2a
• 9e4e7aa12fa9adb90d07a911deab4fa1
• 8431701f386b8a672d97c5ea33b5925e

SHA-256

• bc1b71850674269aa4f1c2f49ec3a693210d776c47c8804c5b46154ed708b244
• 628a6198262799ad94878551fa330e5df1b1e6722a3fc9247b7a45d87468708f
• 754f921c466fbd723b84ea09df588111efe3eff75c79b75229cf756375fcc677
• 5efd0883ce4662e6d3f1297cbb479ea5d8c59f11daeeec694f6b49c272373fcd
• 19633bd1e59aac5d62197657a9407d7de3944c667c3cb4baf5d394f3778567bd
• 130813b27abb7b0157f034816b5e8c7d4e8d554c7edba6872de3fb0db7505d74
• 23d3c6ae8ee39021fe352aed02f0edc64b94e5380ca87de4976e6d8464f83f1d
• 9e0f257fdf282141b301d7f95f570f652b755b144a5ca1f00e41699b2996bafb
• 9222555a8305e87c2b2dbef01b85f653c634b90756a691371613788a27c8abd3
• 6ba894680f0a4b95268650a4a810e249c81705fd6ea8e9dce9e9ff44cff97980
• a9390ffb173cc166e386cb9660f5605265a3842b37cc8ba05893ccc607617c44
• 1743758665cfd687a722caca8a0c7bef3081ee1b0415f8cfd965f7333a4802fd

SHA-1

• cc1e2bc7ed20338851fffaa6926b75c343c35750
• 0cea8ca9b65c9ca5b97b637bad8e1677504f211f
• 8fe3fec397bb48f7c5a1d8aff26bde763884c22c
• 3efdd71d52c86b8026b5cb589ab52378f0b5d1d8
• 8679aa40ee5b41c69e364d9deafcd09617e11eac
• c72a8d6ee2abf782da47ee4fdc9f5138516f8899
• f819d3778dea3db6060ad9556a5d2d14398ef799
• 680730fdec37f3a419489a1c6a01f14b288fc977
• 9041d85d7228721897dd7e8f37e794985b8050e3
• 24a55b924f5c55a787a5d595d438033d8d99832a
• 0d1ae999926ebea21da945c3d4e3be19ec5e35ec
• 05d21f2c4e1573ece361ecdf13675dd13da796c6

URL

• http[:]//91[.]240[.]118[.]172/gg/ff/fe[.]html
• http[:]//hostfeeling[.]com/wp-admin/4XsjtOT7cFHvBV3HZ/
• http[:]//jurnalpjf[.]lan[.]go[.]id/assets/iM/
• http[:]//it-o[.]biz/bitrix/xoDdDe/
• http[:]//bimesarayenovin[.]ir/wp-admin/G1pYGL/
• http[:]//gardeningfilm[.]com/wp-content/pcMVUYDQ3q/
• http[:]//daisy[.]sukoburu-secure[.]com/8plks/v8lyZTe/
• https[:]//property-eg[.]com/mlzkir/97v/
• http[:]//totalplaytuxtla[.]com/sitio/DgktL3zd/
• http[:]//maxtdeveloper[.]com/okw9yx/Gc28ZX/
• http[:]//www[.]inablr[.]com/elenctic/fMFtRrbsEX1gXu3Z1M/
• http[:]//activetraining[.]sytes[.]net/libraries/8s/
• https[:]//gudangtasorichina[.]com/wp-content/GG01c/
• http[:]//tamiladsense[.]com/wp-includes/BEADvqGgemV8SnTX/
• http[:]//manchesterheatingservices[.]youprocontact[.]com/wp-admin/AiK19uMf/
• http[:]//tunbridgeservices[.]com/jfoeqhxz/zOX0/
• https[:]//mypurealsystem[.]com/App_Start/Rhh8lKO/
• http[:]//imaginariumstore[.]fun/ncsb/cyGoTYqMmcRwvqdre/
• http[:]//engaz[.]shop/wp-content/MOllqUm2nb/
• https[:]//ecobaby[.]pi-dh[.]com/Serendib/gl1hcef9Y3GSTCDC/
• http[:]//3-fasen[.]com/wp-content/3Bl0hBbW/
• https[:]//vn[.]minino[.]com/wp-admin/c3WQa/
• https[:]//lastregaristorante[.]com/wp-admin/ffdC7ElM2Bn2/
• http[:]//onexone[.]elementor[.]cloud/cdrxhrt/uVE0uVHOz5E/
• https[:]//oculusvisioncare[.]com/wp-includes/ZEYDjosbNExFTdu/
• http[:]//devbhoomigaushala[.]org/Getae/Vyo5rrNLAgd0QxXvkv/

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment