Rewterz Threat Alert – Emotet/TrickBot Malware Recent Samples – IoCs

February 10, 2020

Severity

High

Analysis Summary

Emotet is a Trojan that is primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet may try to persuade users to click the malicious files by using tempting language and click baits like “Your Invoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. A fresher campaign is discovered distributing both the Emotet and the Trickbot malware. Indicators of compromise are given below.

Impact

Credential theft
Exposure of sensitive information
Unauthorized Remote Access

Indicators of Compromise

MD5

1044750deccfe551caff847a98eb4b17
9ee1b22b752f25be9182a5d04cf90b3c
c17722b468222c45bab8e6cdc83b0748
6b8ba6c385b150bf788faea38b3bf6d8

SHA-256

4ebe60b05162d6264ec0034d02e3ab01e062510a0f4344abbdc17524242d9a73
2a1fd547e8236424e46fa2482d3db48dc7de8e6efe84397ccc9582055e268e69
061dae2be3b5b2bf9c7fc9a16a92d6031e5dbda377b97e9f7371598ac67593f1
72a7981d188c5f8cfc12ea991cb8a4e968993cb63a9fedda6616766e0d2ee6d0

Source IP

51[.]159[.]23[.]217
66[.]85[.]173[.]43
193[.]26[.]217[.]243
71[.]126[.]247[.]90
164[.]68[.]120[.]56
64[.]71[.]35[.]51
187[.]190[.]47[.]173
188[.]227[.]84[.]209
45[.]79[.]223[.]161
91[.]236[.]4[.]234
172[.]221[.]229[.]86
123[.]31[.]31[.]47
203[.]176[.]135[.]102
98[.]239[.]119[.]52
120[.]151[.]194[.]117
195[.]123[.]219[.]69
195[.]123[.]240[.]37
80[.]86[.]91[.]91

URL

http[:]//msek[.]lviv[.]ua/wp-includes/report/
http[:]//msek[.]lviv[.]ua/
http[:]//ingarden[.]lviv[.]ua/

Remediation

Block the threat indicators at their respective controls.
Do not download email attachments from untrusted emails.