Emotet Malware Document links/IOCs for 09/13/18 as of 09/13/18 23:59
Notes and Credits now at the bottom Follow me on twitter @jroosen for more updates.
Epoch 1 Document/Downloader links seen for 09/13/18
Seen only in .doc attachments.
Epoch 2 Document/Downloader links seen for 09/13/18
http://110.164.86.203/wp-content/uploads/3SFQJLDG/identity/Commercial/
http://198.61.187.137/project/86AYMJ/com/Commercial/
http://1energy.sk/20QSVKI/SWIFT/US/
http://2x2print.com/404700RTYT/SEP/US/
http://abakus-biuro.net/8539JHLOM/PAYROLL/Business/
http://aile.pub/online.refund.Dvla.tax31000838/7GYOFZTT/PAYROLL/Personal/
http://alabd-group.com/77EKMMGZ/BIZ/Business/
http://alwaysaway.co.uk/doc/En/Paid-Invoices/
http://amanita.com.my/903XOZ/PAYMENT/Business/
http://apicecon.com.br/09012NQNFL/ACH/Smallbusiness/
http://ardan.net/766646CVIO/PAYMENT/Smallbusiness/
http://arianrayaneh.com/multimedia/4842RSTT/PAYROLL/Personal/
http://bangkoktailor.biz/87CJSYV/PAYROLL/Commercial/
http://bavmed.ru/DOC/US_us/Invoices-Overdue/
http://bfs-dc.com/91964Z/PAYMENT/Business/
http://bhgjxx.com/temp_6bd6c6c42b5ae81a4aa32aa263d99731/7351KFBDB/BIZ/Personal/
http://binfish.ru/Sep2018/US_us/Past-Due-Invoice/
http://blockcoin.co.in/files/EN_en/Paid-Invoice/
http://bramlvx.com/544VXZXGHZ/PAYROLL/US/
http://byacademy.fr/8706937YGVMNXM/PAYMENT/Smallbusiness/
http://callansweringservicesoftware.com/Download/US/Service-Report-40234/
http://casellamoving.com/69VQINXXJO/PAYROLL/Smallbusiness/
http://challengerballtournament.com/418416IFUJ/biz/Personal/
http://cleverspain.com/9QJAAPWCD/PAYROLL/US/
http://collaborativeeconomyconference.com/55887OPVDW/oamo/Smallbusiness/
http://cqfsbj.cn/8440684LVDKMWSR/PAYMENT/Commercial/
http://cuentocontigo.net/5647VKHPSPV/SWIFT/Commercial/
http://damiro.de/8EXFB/SWIFT/Smallbusiness/
http://dansha-solutions.com/7574AFQXZHK/PAYMENT/Smallbusiness/
http://daveandbrian.com/535287ONSAJHOA/identity/Smallbusiness/
http://demicolon.com/dvrguru_revoerror/image/53LA/SWIFT/Business/
http://demo.5v13.com/7498QLQMJLSN/SWIFT/US/
http://demo1.lineabove.com/789075RLRZBZFZ/oamo/Personal/
http://downinthecountry.com/048XUQTPIV/identity/Personal/
http://duanvinhomeshanoi.net/000NAIDPEJ/BIZ/Smallbusiness/
http://duratransgroup.com/1721558FYLUIW/BIZ/US/
http://egomall.net/537173GAPZ/ACH/Personal/
http://elidefire.my/9367677BZCEQILW/PAYROLL/Business/
http://europroject.ro/3482AE/PAYROLL/Business/
http://exxot.com/47BSUIJP/SEP/Smallbusiness/
http://faratfilm.pl/86NH/PAYMENT/Business/
http://farmasi.uin-malang.ac.id/wp-content/935ACFZSO/identity/Commercial/
http://farozyapidenetim.com/907041JXJMTHC/identity/Commercial/
http://fluorescent.cc/default/En/Outstanding-Invoices/
http://folio101.com/29859NATGFOHJ/PAYROLL/Commercial/
http://furnfeathers.co.uk/5IUIMNRBK/PAYMENT/US/
http://g7wenden.de/Document/En/Document-needed/
http://grupoembatec.com/4166240YQ/WIRE/US/
http://hotelnoraipro.com/7932969XCYUKCM/PAYMENT/US/
http://httpyiwujiadianweixiu.xyz/Corporation/En/Service-Invoice/
http://imcfilmproduction.com/319952SLB/WIRE/Commercial/
http://ingebo.cl/Document/EN_en/Inv-566468-PO-8B393306/
http://ingridkaslik.com/48NJTKNT/SEP/Commercial/
http://inmayjose.es/614K/SEP/US/
http://jealousproductions.co.uk/6JHJYPMY/PAYROLL/Business/
http://jtjdoprava.sk/146FEIYQZ/PAYMENT/Business/
http://jxbaohusan.com/408019WUPITIGG/PAYROLL/Personal/
http://karkasdom.dp.ua/7705752ZMA/BIZ/Personal/
http://kdsk.ru/823VOKKH/identity/Commercial/
http://kpopstarz.kienthucsong.info/Corporation/EN_en/Outstanding-Invoices/
http://krasrazvitie.ru/3870029HXHQBIM/PAYMENT/Personal/
http://kuganha.com/3365EPXTN/PAYROLL/Business/
http://lauraolmedilla.com/doc/En/Sales-Invoice/
http://leedye.com/6NP/PAYMENT/Personal/
http://leulocati.com/297WQR/BIZ/Commercial/
http://loristjohns.dabdemo.com/default/US_us/8-Past-Due-Invoices/
http://lulagraysalon.com/220695DTM/PAYMENT/Smallbusiness/
http://madarpoligrafia.pl/DOC/En_us/FILE/US_us/Scan/
http://mail.vivafascino.com/470MXIBGD/SWIFT/Business/
http://mainpartners.eu/6287508P/oamo/US/
http://making-money-today.club/8827362NKRM/com/US/
http://maxi-kuhni.ru/579653B/SWIFT/Commercial/
http://med-up.pl/INFO/EN_en/Invoice-for-e/w-09/12/2018/
http://mobileappo.com/LLC/En_us/Invoice/
http://momentsindigital.com/8EGAAMVT/PAYMENT/Business/
http://myafyanow.com/4YWMKOO/PAYROLL/Smallbusiness/
http://mywholebody.net/Document/En_us/ACH-form/
http://navyugenergy.com/wp-content/uploads/9OAXTTZV/SWIFT/Personal/
http://newsite.iscapp.com/8973101JF/PAYMENT/Smallbusiness/
http://nisho.us/23375MIQP/WIRE/Commercial/
http://plasdo.com/MNXfUEtpo/702DXQ/PAYROLL/Commercial/
http://premiereplasticsurgerylasvegas.com/0WBBL/WIRE/Commercial/
http://prideagricintegratedfarms.com.ng/Sep2018/EN_en/Service-Invoice/
http://prova.upyourfile.net/xerox/En_us/Need-to-send-the-attachment/
http://ruralinnovationfund.varadev.com/5VSQTTY/ACH/Business/
http://sellitti.com/8063779O/PAYROLL/US/
http://sernet.com.ar/doc/En_us/Invoice-for-x/b-09/12/2018/
http://signaturestairs.co.uk/984987KRRLUM/SEP/Personal/
http://slajf.com/files/galeria/4614PZOJAL/SWIFT/Personal/
http://soloanimal.com/55549LFBVBNXQ/PAYROLL/Business/
http://soo.sg/epigami.com/blog/wp-content/uploads/2013/0931016LMVHF/com/US/
http://stoobb.nl/default/EN_en/Inv-28167-PO-5S286034/
http://summerlandrockers.org.au/0277YRFNQ/PAYMENT/Commercial/
http://suportec.pt/files/US/Need-to-send-the-attachment/
http://theme.colourspray.net/6220KZTRUR/PAYMENT/Personal/
http://thepinkonionusa.com/249J/PAYMENT/Smallbusiness/
http://tienphongmientrung.com/5408919R/PAYROLL/Business/
http://valenciahillscondo.com/9694129WNFY/SWIFT/Business/
http://valletbearings.com/831652JSXS/com/Commercial/
http://versusgas.com/00BRSU/identity/Smallbusiness/
http://versusgas.com/Sep2018/US_us/Open-Past-Due-Orders/
http://vinastone.com/994WFILE/58AKWKTYMF/WIRE/Smallbusiness/
http://vinmeconline.com/4TE/PAYMENT/Business/
http://vong.info/wvvw/5FM/SWIFT/Business/
http://webhall.com.br/526319JZGQK/SWIFT/Commercial/
http://website.vtoc.vn/demo/hailoc/wp-snapshots/087849VTPT/com/Business/
http://www.africimmo.com/886MIF/SWIFT/Personal/
http://www.demicolon.com/dvrguru_revoerror/image/53LA/SWIFT/Business/
http://www.duanvinhomeshanoi.net/000NAIDPEJ/BIZ/Smallbusiness/
http://www.insurance4beauticians.com/Download/En_us/Summit-Companies-Invoice-9782424/
http://www.mainpartners.eu/6287508P/oamo/US/
http://www.offshoretraining.pl/0550248TOU/SEP/Commercial/
http://www.teateaexpress.co.uk/9080980KHKLW/PAYROLL/Business/
http://xn--b1axgdf5j.xn--j1amh/671GOTAHY/PAYMENT/Commercial/
http://xuatbangiadinh.vn/588261LQO/PAYMENT/Personal/
Epoch 1 Payloads by Document SHA256 - All Times UTC
Creation Time 2018-09-13 16:15:00
SHA256:
8b3e7b0cd5c83967782bb2aa41996b97e8badd89b43171a48e7b28f94f443c7c
76b69f93b5532b1d050b38537035eee5c1aae94690d716aa96a1b926c36e6816
9a719afc937416f57b260e195384cb89fd72388fb25afe7e392063e5d06d4696
http://familiekoning.net/Sw51duCIY
http://website.vtoc.vn/demo/hailoc/wp-snapshots/JeHXbk6WzM
http://librusfan.ru/271vNHA
http://tomas.datanom.fi/testlab/VJ1t3ol
http://altarfx.com/8Es5z7sVJL
Creation Time 2018-09-13 10:03:00
SHA256:
a254a407abb8e029d07a538acf703751acbe62ebd16b5001fc781bab0d07307c
e269c50894d6177cfdad365f0ef6b4f9753a27d7aa912a42b992e21b0cd029ac
10acf1385e8fbb1bfb62041a7effd5a755f816d55f35fd48a28203b0adbc76c1
0b13d542741a96fcba31522717d8909559db32df07032a6e8b4f151a80ac69dd
ddf54839be09c9dabb116921834b583b81c427a7578af5d423b38b499c51454c
d35026ff318ef7be4b398c9b42734cdfba5e99252dfdc29b4a4e52f4e9e642b1
21609da4c930bbe91ac12d4d9710407594ec0b36d2eac3d441fde2657fc70f08
7747b7f224ff3188820d3695073df34915d7f41cabe71a118abf491758ca414f
bbf6f733ffdbb38d83a68f2af2d158b7e641200223ef65a3d8248ea631906e76
51ec5de264d2103209bd33cbd5ddea9341ab298f5f89d801eed00459e21a2c9d
e0e221ef3acebbc414fbc3d15d41d87695a42a2aa7db051af76ad793a0f31b05
e90cb759ba47ff925aa1aef820bed3cb4c11c225ef436f313c1b0029879af433
http://vladetel.org/iDFxArAC
http://vgd.vg/7MN5ZO8D
http://madisonda.com/7klY6V30Z
http://detss.com/3SHTOtr
http://btesh.net/pQvrfzK
Creation Time 2018-09-12 21:06:00
SHA256:
a06bc650b069bbc9c3e5cc234acc67e7ab22e38746120eaaf7be7d0bcfebc42f
2a8c2ebeed73c172d347af258a0ade7ebc73d29897797d25f9c6259cdfeff059
6b1af34b51c15c8736ae891ca2e037bc118e531f72cf3917e2b4e37ed14e461d
3f4d0ab5723f2200e245b149d8e8ee9665d3d0a7868ce938061f197429999153
b967b161ca4f18a30268ef7f6dff604d93edc59367ee7bab5e81360748a9732f
http://taltus.co.uk/EP4L639
http://quintacasagrande.com/EJSAsCD
http://glswp31.sprintsoft.ro/Y3IzCHzqIb
http://vkontekste.net/f1OSAuOu5S
http://dovgun.com/x7tDH1jMd9
SHA256s for Epoch 1 Payload EXEs seen on 09/13/18
a74967811f710d6c2d2d6d2e061e14d9bbf6e61646ecd580715ad40088e3dea7
5ed869578abcc9f9e4983adc3482394f231b2144a36a34be75694f4280fa4581
fcb4ddb8e1a15cdb0029274c93838971d854ef88507e00a47c9a75af47b33b81
82e4585f249339dd5a4a38b526e705d8b5a23a51bc2ea4fd2f9bcd979bef8f7e
2a24d5d2fb44adb3eeb4d2d5d031ebef0c43f316922e186eaf12a852ea8dcd60
78cab845b041d60868a8da045da24e4325001869e10b0cd1390c541a3a05e50a
Epoch 2 Payloads by Document SHA256 - All Times UTC
Creation Time 2018-09-13 22:24:00
SHA256:
bb96154cb4c626418818c1159dd38038fc88261375c76c321cb90e0382618356
d8d62e64a5af68e3aa0844b8556577e12634a6570948a4cbd98ceaad7731d1ad
6521ea29a65d135ae2979e8ffcbaf70089ffb260de6f6558db1ebf8294106d80
c3f2233ec52a49433a093f5e83ea01228c7088ead6cef9b914543b2268085bc6
83a36e458172a563eed121b9423f7f255b5cacd96a323086484a193a92131a94
f298f4c8151700d3be8c7b0176abbe3f53a1651fa682e647c27cf6b5092dc5fe
9349ca5c47141bc0277a0dd9f25c5767e7d6378057c985488ccd3b4b552a25da
a5207d69b06370cac30aa2f58046957fd42810ca4efd0b67dcd8f05f9179e7c4
07cfea6b95c5394dabb083033dad126eaee6c553e015c00960f8f329d64807a5
27795a1f8929bda0569f58f10730b59ea02c13f276b55a2b8cf8b0af68ba9f9c
9e1aa204229316126c9c36888efe8116c383ee37e7ca858fcfc52eeb33e6ec01
9abdce46e8797388d7fb880707085b2d43fba6f67e68bda260379f6f8e66d619
56be3018493c1b5f47eddfbd3ae3309607dfe38aef9a20f75835acac73dd082b
da31738c4b7beaa1cfa7a0a8c47344fafc434416811e1ea12a725bcb10679090
04fc0253af169117c8ff80e1cab523aaf9b974d9dda2ffd17cc50c515fed1226
3db7160117739cd1ea76bcb1b53457c840f029a46a8fedfe33757953d01e71cd
91b105504038a4b273df18623e4de9eae1d98f1ae9a219d46d8f942689776d19
4bbb79a95ba782a7367045789b6859f2913d8ae965209fd1829fd2206da1a73a
68b01d54c485e4de4b6aa0d992b19f0eff0ec43ca876faff5626a67085135d57
476d751d78531b1edc5d777e514c2b1a8d50914ec76f7f16ad68bfec66784f15
http://gawus.com/klRialoB
http://connecteur.apps-dev.fr/H1
http://alliance-rnd.com/hYXxoC
http://artwellness.net/j
http://wiratechmesin.com/X
Creation Time 2018-09-13 20:12:00
SHA256:
79eb8ce2f6e869a1583b04fe69318a6d7d125022d96b5ee2e02adb27c9b09bbd
e2b32187eeb3cd795da983342d10d6fef613e3363531444ae0ac5cab34553d5b
37f1ef7cba41c87894336943d3df8f77c799c8e0a913724372fee51b3b2f1359
4872f6d67a370ffaf1a8757a7d7eaa576b017d6a41ffdaee1e540359d80fb113
0916518b86d9538eba1f68130f630b27c21d7a6c8f4f2d419d1f26b470fc757f
8b808398cdf8bcb4dd059f8ae734fe5239594105ad4faacd6af89cf2bff68f32
http://kaijiang001.com/xxwBiLY
http://ericsweredoski.com/C
http://www.tri-solve.com/4ZO
http://onlinelegalsoftware.com/RPtWwdec
http://www.ultigamer.com/wp-admin/includes/d
Creation Time 2018-09-13 14:57:00
SHA256:
1b1ca3aea7d761a91bb5dd9ac97b353320d065e08717fcabe0805eb0d9938c1b
824cb5f6f65d9e89f3fa79881bb8d41dd01089c25650eab57529c31eab46e798
8216b9bc7350597d772829a02f9ceaff4518c500f53588e88968c3ce21e0e9af
62d1d44a050ece5500a42b4a07dff0a7d11993f0469df963941313100020e962
0a35426736c00f1093d093059da49ac42b23113ea8019bcacf6769d5227dc795
5eb986d05ad832897acbc13e870ee4f2971f1901374615a41ee2f5f5fe91d68f
1c84d3a7b02bd30a0884d5a0ff5840f77490945045ae7b8055d408e8ec6de8ab
94cfd057c941845ed5bacf9290f6bd2f79311ed8fe0c9207ff13526df0efc7d0
1e87808f2a505c93cf95345d43b97124d655eb080d1263b785e08d3fe0bf206c
e65548a144aeee2445a1ace2d57cb61582e904de973258056b6c4d55132a6343
80f27d7dfd3852253c47a67f11ee4cea9bb12a5370955ab32161bff0b189bb14
9955c6478408b2946ef1a557151fa68e28515bf07c1db05d0628963eea640141
d4ed9ec5c2d5b17b5b2b28955c7dc1125a3376ea8e11d09a58f25d2ecdf6cfbb
a7c54acf17f914288c551a6899259791047fec21d9705a7585be988227189837
1936f0ec1ecf544285fc94a531e77e608a3abe0eaab1d19632f247c7ba5acf7e
59651746ec22f0186a7ddaf454b1b858bf07b5197b411d7c485a9d6800db8e2b
0b3a20990ab9038b3964eb55717f1a15c25354a97945e2bbbee47995d5a233c1
d108c4d7f9196112cb655063e9c3587380428deb543953be6250799355ed99ef
4f3b20b026bdadbc5b9744834db42bf6858f4a238068f44f335967461755578a
http://dbsunstyle.ru/U2MAj
http://valorpositivo.com/10Zu2p4
http://institutodeidiomas.ulp.edu.ar/wp-content/uploads/5k0l
http://atklogistic.ru/jB75CAA
http://itray.co.kr/wp-content/B6b2J
Creation Time 2018-09-13 10:11:00
SHA256:
6207c24972e68133a2f34cac9e49035ae0dbece716af77006626d2232c2260f3
ae14cb3d22626f71614f9c25c082d9165b1d8726943364c72b1ca1ec2641fc6f
5abafc4436cabaf8688ceb4cfc2a2c3f2b1ae06a34ffb9ecfe8ea5e06bc6d065
745f36d617fcc238ba47e7046463b4486a48512ef12c1a27b9d6314d7b7bce35
9fc740bc37aa0b29f27885daa6ee480a58aee5526710a5f99239b8921a159bc7
8ec0d258429998102d6974937b6acbb31005a714c65b96349883e76f7fefe822
ea6090949f3c83cfd7091a3c0f96fd2ee79b10ea297f7cb8c67e218afe5ecdc3
d28441e57833bfbbe1460f784f48ab2f8d6bc8d7478795f6ff64b5c1dd7ccafb
9df9d4884b2500037994a989411328a95a3cf5147b31477c5f01d71933fc3d6d
c7874af7335c770faff29f4a78bd24092079ace115e3dc2fd7f498f361c3295c
d4104c8b0ded4e59f51d21fc38de99fb4aef4da6f6e216b4b631f0da3253363c
5b13e439c9bc2479ec8aaaeabc516377178fdeafff910e94ec586e6b665aa031
0432b3023902e6923a125718c35108cdd55b58ddf985e3cc7efb5a4b79e1c208
f704486b7acbe5a1bb8ebf08b81f2eca9ac98abb6a27c7e35bcfcfbc57e5d901
764122c8c7d3c80f2c4c5c812333b6d804683a90cd5c6ffe28d36e6bbd2ac90e
84705ead26ec41c8839f764d5534c666bb58078c55ab7c066cfc95db51023176
79e206f16b62c3727b50f8c02c461d794e8be5c0af2eb4be3d9eeca92ae7ded7
54d028fa1a679a62c8353bc90b03821e20892e399c11755a8d3243efa92027fb
ee21e25fc479e08e637097ccd6469ee63f0970e139a3f3da675d1042fefbfd33
4c254727bf72c8de54c7a1554e6d6afeaea1ce89f7279e15005b5ff034881c8d
ce7524428873a974c4fa9784f493cddcf68e440b8305f2efb8dbc6d8994e60b7
http://newspectiveaddress.com/rOTph
http://lariotgrill.com/2z8FmXgi
http://akgemc.com/fsHYxx
http://webartikelbaru.web.id/3ykDP
http://artikeltentangwanita.com/L8097n
Creation Time 2018-09-12 19:47:00
SHA256:
8870a62f875161882a0c93807ccc85209554a068953ae16190484414b427b173
97c417918368f2b12dd4f531d6038f0f9b30c6a902fd17d43f6873f679cf1b11
2397e53241fe62832871bf56898653b33f4e416772ef5e36e674f082b3172328
0f27215d431683ca9e12bc565504b524a386c4815d19c60070205280676ef292
30594291490a1928a7bf89f633c88b3e8bb41c4ae795156309a0f076652d072c
bdfb9ea5785db7461ad1c99e51e3e40b7e64329af163fcbe9ed2801feac887e7
9f2b391d98faa49081c4d876e166d99dd7130764ddc8e9a6bf2c23a15ad2837b
d60b8789a0fbcd9209a9bba2a830e597282207641f479d9abe6f6607b4eeb256
dafe595d8dc3cf275a9d6bea2e5151d40480a2d4b0e6c020b8065fe1a7972c80
eeee3eda1a4e448a8909834a595467eaf54e5b161192168172057b0e2426b3d0
0e27e6f4d8da29d389fa3beecd8126d0b11698262a1c828d1dce799a274c3d29
83cc9bcaed258c00f23162e6cb665b456627869187fd543a49787808a1247127
91ce571ce305b5ec80a29d34599b3eb6c197ecd668e4daa3907115a56dcbd986
7f3e9c4a40ec41639e6c8d9db032229d6c58002874ed5d4cdc5fd03e622d25ed
1316c887d94e24f942b882ecbe7314ef4746e2800122b27bb0086e8aacbb8b00
5c5cd138b91a3d2baa90a02319e99a8a8804e4a08b2ffe6c57350cdc9a434734
1fdf0df4133e95138d2df0a009a4ae8224192758ed904b2628ae83a21411f70d
7dfa2a928330bcb0f33f6d4c5d97a88237f33bdf80efd982ef13b3fe1d964b5e
feae1530ee01928ffa77b463da09e66f74220772ee2678e8047869a3145868b5
55c2cb81ad2856f39d7ebb41b399900e073fb98afeddbc5efb4f2842d429bcbc
db5230bcc93d32f53678e4d45233561b27d5ad42aaa74f8edf3352220bd8523f
879d69ece9f3af526b2c17a21f0894ad06e7760a4d015b06f59a27579918edd8
2f832c6ae5974b67d30fd1125a5298047179d68d2fd9bf3e988f8bdcda63762d
48a5d05b5f703d2e64f35ddf18f1dc8ecfcbe71305cb0ac6324860bc01bb0d41
aa44a4b26f945e7204d6ee644a5cde053dc131b4f05f007de58ebf2fa180a90f
da2a56412ba9240e01d478074dfee4cd0ef92d0d8d1d2b42b01411212c2e6e83
c64c8cb54c57849ca6c0d5a741e0726e4337b3df8dbd389e912c9a7899e3b311
3c6ca8020f39b252aa19db566ce0c87559ab1ec0784415815d4aabe9262ce501
e9465d59e1b17072a433ac9f3e0db2eaf49afda401f0cd41e340eb084d99ac9f
aa2161d4e4cda6b43839cc8d34aa992e38458c4a5702abd784dd9ae3a8832efd
40be53a0bb0ca1a290e96aebb2c6cd2317cea1fae4028e59229fc877fb4a6895
d88af38c197e419d5c43ea5338ba41d7f77d6c9e5f4b7d5cb013670d28f06d6c
f3458f43aa17ab5f31e01e807e13595696e918d53358ea85daa93c274a35a1a7
39e528ba3723a89b1abfd4ea526e999e1819878f825741f2aac35707ba3cda4e
fdd4bdf80d2ed4dcc5eda75437173016e2f67a405cb2bf15b728052de2ac08ea
b3e3f957528379284a50d3c3efe1acb675266f10f52b3e4c98e29ed1124435d3
e6a578c89917327adb9fcd46a34823c0f2b34ec26d7e0bcdd08f2fdd0b3e534a
d255e74d39fb90e116b46e8ae8a9285ebf292696285a84be8fb17bf3891a2da4
a35039516c11525f68fad74dd01d54e3169855a1508abf923455ef469166e722
9b88ff4c7a6c39af6293e1b5a8002b9f56f2621d2dfdf33d55b5e1d7794511de
a12728a25409259b1e7c50f3e7a3bbb6b9b428a67ad778970e8137f02218e2cf
2ac61b1ec360650ca38fb547d208e345f7abfc93d3ad8413bcaa21aadddce806
9dcfac123de75bcfc9f7c7583b6592522dbc3f8cf4a09cd0f29708255ec19e47
9455157454afce9ad1650f3c80c80ecc9654616e37235302df6c7610bd3e57c2
751b6ae3eef95b7b8ea335f62aaeb43851b59dc13c4eacfb962545666d156164
a3fb9df5e722abe9b8ae3e3ca64379da758492cd5b9ce43ddbe29b41178b6d66
http://mooremakeup.com/k
http://crossroadstamp.com/0
http://ntsuporte.com.br/kl5
http://oooka.biz/RaQOFhRM
http://parusalon.ru/idb
SHA256s for Epoch 2 Payload EXEs seen on 09/12/18
214d0fede2c22de3a9e8803ceaf6ff520a5e6ee24d29dd54d0be664c32be42fc
f797a8568c12e957271041dbb846f00945b4b734c2d8fec2d584da1a5746dea3
69bdc32fab30602af0d819e4961e7d1e909dce4fe653278dc2e9c80c66f993f4
5870b8085afcf093a83add8e93cb632783f0b25eb443c51475b57ca2ff90e1a4
5b91f4f734c4bc4873766a9d537cc9ce9682596e54ef51597fedfa82b0dd8d37
Trickbot 825fd92d285d77a6184f447337bac2386ffa94e321de018fb86b0fcd615daee4
330a58a04a5aef9c8f511a4eb55adf4bedcd3143a35b94c201cc88fd1b9a990d
74e426f6b6a5657d937e78bac99afeec3bc3e8870248dbd3de33340cb39e59a4
Epoch 1 C2s by port
+ indicates new/returned since last posting
20:
- 108.53.148.199
- 70.184.148.77
+22:
- 72.50.72.164
+53:
- 201.244.125.210
80:
- 181.123.205.219
- 189.151.46.3
- 200.105.149.226 37.120.175.15
- 96.242.246.128
- 96.245.253.186
443: 198.199.185.25 49.212.135.76
4143: 217.13.106.203
7080: 139.162.237.94
- 87.114.250.38
8080: 104.236.25.85 133.242.208.183 139.59.242.76 178.63.118.195
- 190.189.12.16 203.198.129.4 210.2.86.94
- 220.253.68.95
- 71.45.208.246
8090:
- 98.229.127.243
8443:
- 69.70.248.98
50000:
- 96.23.80.242
Epoch 2 C2s by port
+ indicates new/returned since last posting
20:
- 74.196.132.156
80:
- 177.230.98.10
- 187.177.53.149
- 189.131.48.195
- 199.48.135.55
- 201.146.20.110
- 201.163.74.202
- 64.194.68.19
443: 106.187.52.135 118.244.214.210 138.201.197.13 153.122.38.158 185.97.32.6 199.119.78.9 199.119.78.23 211.115.111.19
- 68.15.57.174 95.141.175.240
465:
- 162.154.32.144
995:
- 64.250.162.198
4143: 222.214.218.192
8080:
- 115.47.147.24 146.185.170.222 157.7.164.23
- 190.6.195.244 69.198.17.7
- 76.70.25.209 78.47.182.42 84.200.106.120
8081: 62.75.143.128
Credits and Notes Section
Updated 7/13/18 WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture: https://pastebin.com/u/jroosen
NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list. I am providing them for your benefit in case you want to parse them to be sure.
UPDATED (08/31/18): Epoch 1 is back! For several days in a row it has been on the scene!
What is Epoch 1 and Epoch 2? Epoch 1 and 2 are two distinct chains of payloads that I have been tracking for a couple weeks now. Epoch 2 is currently the larger group of hosts and I think it is the main push of Emotet. Epoch 2 WAS a smaller more rapidly changing version of Emotet that tended to change the hash of the document every 45-60 minutes sometimes has new payloads that fast also. Epoch 1 seems to change payloads every 3-6 hours now and hashes change sometimes as fast as 1 hour. Epoch 1 may now be the development chain but I am not 100% sure what they are up to. Checking either epoch host at a point in time will deliver a document that has payloads that are different than the other epoch. That means epoch 1 may have payloads of a,b,c,d,e and epoch 2 will then have z,y,x,w,v. Sites sometimes move from one epoch to the other but I have never seen the same exact directory go from one epoch to the other. It always a new directory for the change in epoch as far as I have seen.
Community Lists
Credits
(OC and combination work) Doc DL URLs - @unixronin, @ps66uk, @avman1995, @dms1899, @Bitterman59, @pollo290987, @James_inthe_box, @malware_traffic C2 info - @pollo290987, @unixronin Payloads - @AmirRedh, @unixronin, @ps66uk, @pollo290987, @James_inthe_box, @dms1899 @MalSpamHunter, @Bitterman59, @malware_traffic
Special thanks to @2sec4u, @unixronin, @pollo290987/@ps66uk for creating scripts/servers/infrastructure and helping out with all of this!
Very special thanks to @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch and @Virustotal!
Daily Log
Turns out I tripped the spam filter on Github and my account was flagged for manual review and that was the real issue. It was reenabled this morning quickly after explaining the issue to support. Good experience with support so far and night and day compared to Failbin.
Today I saw few more Doc attachments from epoch2 and most of them were in english this time. There was not the volume we had previous days and it seemed liked activity was backing off today. Also there was a change in the VBA macro obfuscation that @unixronin documented in his post: https://pastebin.com/jsKUQ9QA
It is worth noting that this week we have seen both epoch 1 and 2 dropping Trickbot. If you run the payloads near 5-8am EDT for a significant amount of minutes, you will likely get Trickbot it seems.
Not much else to speak of so far and we will see what tomorrow brings.
Sandbox 09/13/18
(all with fakenet and MITM unless spam/secondary infection) Epoch 1 deploying Trickbot at 06:39 https://app.any.run/tasks/fd35ae0e-21cf-4b5e-8697-b92e3023be88 Epoch 2 deploying Trickbot at 05:30 https://app.any.run/tasks/de3a7c15-bf5e-4eb0-bd9c-f6528c2387f8
Epoch 1 C2 run as of 09/14 at 00:30 https://app.any.run/tasks/4c91df1f-37e9-4383-b0b4-b1fbec507d18 Epoch 2 C2 run as of 09/13 at 23:15 https://app.any.run/tasks/afe1515a-7f87-4386-b779-644c4185b33a