Rewterz Threat Alert – Emotet – Latest IOCs

July 21, 2020

Severity

High

Analysis Summary

Emotet first appeared in 2014 as banking malware that attempted to infect computers and steal sensitive information. This malware mostly spreads by spam and phishing emails via infected attachments and embedded malicious URLs. It has worm-like capabilities to spread to other connected computers. It also collects the victim’s contact list and sends itself to the email addresses in the contact list. link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet may try to persuade users to click the malicious files by using tempting language about “Your Invoice,” “Payment Details,” or possibly an upcoming shipment from well known parcel companies. Emotet has gone through a few iterations. Early versions arrived as a malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers.

Impact

Information theft
Exposure of sensitive data
Violation of user privacy

Indicators of Compromise

MD5

62f979be778c0d83047350fa2d1de2a1
a6c4f343f977305b8d171ad54d7e2744
7a56186927928a6d54ea6ca055afeccf
c4a18bcf35e4abe95d671207b4cb2770

SHA-256

d4e181d528b848c324773ec9425826055a42b5562bee5d0ca905b4eb4743cd5f
5a6a5a396666af528ffe73bcd8499019bd907e892f377af0a793f0e915b4d2f6
8d97001be89a2c44fdbe6b46883c800edcb581a7ea62e47c2b2aeb9a9f786a8f
264ce100ebb2ae121bd86e61cf5329b3ea7c29e9e0b3d564c01331d348b0308e
bde70ffd03f602479d3849a901374e35f6aa3da6c34d198772b505a56b6661a4
f5fc7edbb1c3d5b6d8f4c21e84cc7a16e9188275d35f70ed78f7ce06bd94db09
f04388ca778ec86e83bf41aa6bfa1b163f42e916d0fbab7e50eaadc8b47caa50
ec6cd9b201839d38b9518654b52b55071a6f1176ca3bce2b972a63fd3f3ab009
e63d524f0d35ceaff089447be661a3840ec05e888ebbb8bcce576e9616b5ccfc
9421efc70819be6c30c8ddff94eaae01ec764b2d5be25e73141f3d19cae153f8
2b6fcf49be17455c5e4dc1fe1b21eeacf07e076ec09b0d4774436fec4fc1150f
893a009c84b3caa2255f8b694cb505cec1f6e2f48207bbed3a89509f7ef1617a
6ce5a6308d2d91cd8c1425c4ab0dca1faedd4420835db22048a5103782ceb603
52572d6bc3e7efa37cde122936901e22cb51281e38553ff491b8a97a775d3955
43350f03183d6cb8e1c26c444d413d4f7becaa551a130c9f4356e989d89610bd
1370cee16304235852b56a9731ebbb1388f30492cf4e44aa1a9cf6e76c40cfb8
1120dc0559e43ddf5af6470bfaf897a7416ea703f19dbef7447669f2d8a9d5a2

SHA1

57e1cffddc534a7a4527def34ecbcaeccf8c136c
204352067166f193834bb1869b97db0da237403a
c898f5cc3b30029d4029fe8e6d09921df75b4d81
8f0005c6e5abc570b33f6093f2216d1e52710eb7

URL

https[:]//www[.]elseelektrikci[.]com/wp-content/hedk3/
https[:]//skenglish[.]com/wp-admin/o0gf/
https[:]//www[.]packersmoversmohali[.]com/wp-includes/pgmt4x/
https[:]//www[.]rviradeals[.]com/wp-includes/LeDR/
https[:]//www[.]tri-comma[.]com/wp-admin/MmD/

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.