Rewterz Threat Alert – Emotet – Active IOCs

February 17, 2022

Severity

High

Analysis Summary

Emotet has recently found in increased cyber activities after a short period of dormancy. Fresher IoCs are being retrieved everyday. Emotet is a banking trojan turned into a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate emails. Emotet operators usually try to get users to click the malicious files by using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with emotet.

Impact

Credential Theft
Information Theft
Financial Loss

Indicators of Compromise

MD5

dfcb2501be0a877c79c6abfb9cf17397
526215dda9d0e85bcb6bce827f3f85d2
31d223c813a592422461f0d6707ba571
b8293f2296ac09663e27759a39431fd6

SHA-256

6d55f25222831cce73fd9a64a8e5a63b002522dc2637bd2704f77168c7c02d88
9bda03babb0f2c6aa9861eca95b33af06a650e2851cce4edcc1fc3abd8e7c2a1
5bd4987db7e6946bf2ca3f73e17d6f75e2d8217df63b2f7763ea9a6ebcaf9fed
2de72908e0a1ef97e4e06d8b1ba3dc0d76f580cdf36f96b5c919bea770b2805f

SHA-1

1b23b966249a1da92300f3b857b40da8d8cd549a
3d1fb09a9a05ab6cf83c4e7cdf5fe40e67064063
040a4985172c82474459b384fe9269922ac0b98e
96d9b8d6658149ca78b2dc13e3f63bcd2dd87667

URL

http[:]//91[.]240[.]118[.]168/se/s[.]html
http[:]//91[.]240[.]118[.]168/se/s[.]png
http[:]//unifiedpharma[.]com/wp-content/5arxM/
http[:]//hotelamerpalace[.]com/Fox-C404/LEPqPJpt4Gbr8BHAn/
https[:]//connecticutsfinestmovers[.]com/Fox-C/mVwOqxT17gVWaE8E/
http[:]//icfacn[.]com/runtime/n7qA2YStudp/
https[:]//krezol-group[.]com/images/PmLGLKYeCBs5d/
http[:]//ledcaopingdeng[.]com/wp-includes/Qq39yj7fpvk/
http[:]//autodiscover[.]karlamejia[.]com/wp-admin/hcdnVlRIiwvTVrJjJEE/
https[:]//crmweb[.]info/bitrix/rc9XjtwF/
http[:]//accessunited-bank[.]com/admin/hzIgVwq8btak/
http[:]//pigij[.]com/wp-admin/MVW5/
http[:]//artanddesign[.]one/wp-content/uploads/A2cZL7/
http[:]//strawberry[.]kids-singer[.]net/assets_c/WAdvNT84Dmu/
https[:]//eleccom[.]shop/services/AEjSDj/
https[:]//izocab[.]com/nashi-klienty/B5SC/

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment