Emotet C2 IoCs Update for 06/21/19

Jun 21, 2019

Emotet Malware Document links/IOCs for 06/21/19 as of 06/21/19 15:00 EDT

Notes and Credits now at the bottom Follow us on twitter @cryptolaemus1 for more updates.

Emotet Tier 1 C2 is still down on both botnets. I wanted to update these lists because I was missing 4 combos on E1 and 8 combos on E2. The correct totals are 126 for E1 and 100 for E2. Somehow I truncated the totals and missed these 12 IP/Port combos. @0xtadavie found this oversight and provided me with the following missing combinations. Fortunately if you were just blocking on IPs, some of these were just additional ports on the same host.

Epoch 1 Missing C2s

236.185.25:8080
13.211.174:21
246.146.101:80
77.13.70:80

Epoch 2 Missing C2s

97.95.218:143
14.2.75:21
19.202.88:21
31.189.232:143
147.184.249:143
25.255.98:143
53.135.159:21
169.20.147:143

Here is the total of both of them as it originally should have been:

C2 Combos are MUCH higher than normal at 126 for E1 and 100 for E2. This leads me to believe that this outage was planned and we are seeing some sort of maintenance on the C2 infrastructure play out. The C2s combos are:

Epoch 1 C2s

201.150.209:80
236.151.95:7080
236.185.25:8080
224.171.102:80
104.79.48:8080
73.52.242:8080
67.12.221:8080
72.9.242:443
124.109.85:8443
218.133.244:80
99.61.162:7080
199.78.227:8080
196.209.126:443
219.214.164:443
68.106.4:7080
62.173.247:8080
203.204.126:8080
65.241.220:8080
217.250.243:7080
247.122.37:8080
250.213.131:80
31.200.136:8080
79.163.131:8080
40.105.76:80
134.105.191:80
15.180.140:80
15.243.22:80
16.127.226:443
171.118.19:80
198.67.178:20
231.72.200:80
28.144.64:80
28.248.205:80
39.134.122:80
48.174.242:80
82.97.25:80
129.93.140:80
86.148.222:8080
94.252.27:443
138.56.183:443
22.209.16:8080
23.146.42:80
23.18.211:443
83.133.253:8080
86.177.193:80
149.41.205:8080
178.9.19:20
188.166.192:80
242.204.142:80
180.84.115:8080
196.140.187:80
1.37.125:443
102.226.91:80
113.233.4:7080
117.206.153:443
13.211.174:21
147.12.71:443
186.221.50:80
189.112.116:80
189.204.100:80
19.42.131:80
193.131.141:443
230.60.129:80
246.146.101:80
246.166.217:80
36.88.98:8080
55.39.215:80
97.10.198:80
97.116.232:443
6.112.70:443
211.244.6:50000
107.105.16:465
123.101.90:80
28.131.215:443
32.61.210:8080
57.102.71:8443
58.171.51:80
58.83.179:80
80.198.34:80
212.24.6:443
219.183.243:443
251.229.37:80
252.229.169:8443
25.159.3:8080
186.154.130:80
120.104.180:50000
98.148.136:4143
113.27.158:443
92.171.167:53
74.237.49:443
254.203.51:8080
59.1.74:8080
229.62.186:8080
32.158.232:7080
55.82.2:8080
55.83.204:8080
73.124.235:8080
101.123.139:8080
21.105.59:8080
249.204.99:8080
29.183.211:8080
32.228.206:8080
153.252.228:8080
77.13.70:80
79.119.1:8080
92.159.208:8080
210.142.58:8080
75.143.100:7080
209.69.165:443
163.33.82:8080
32.84.74:8080
244.60.231:8080
122.183.203:8080
245.101.134:8080
143.182.254:8080
0.106.83:80
85.87.122:8080
140.12.131:8080
143.213.156:7080
183.213.36:80
132.96.242:80
42.166.147:80
134.144.41:8080
69.208.50:7080
205.215.57:7080
83.93.124:7080

Epoch 2 C2s

97.95.218:143
131.11.150:8080
131.208.175:8080
236.246.93:8080
236.99.225:8080
71.233.127:443
99.106.226:80
243.177.26:8080
201.140.110:8080
4.198.249:7080
93.88.16:443
139.247.220:80
135.210.39:8080
65.25.128:8080
144.119.216:8080
243.125.212:8080
114.210.191:8080
239.182.217:8080
212.203.26:8080
136.14.100:8080
100.138.82:22
242.214.30:80
246.193.139:20
62.37.188:443
79.161.166:443
14.2.75:21
14.2.75:80
32.19.219:22
189.213.231:465
144.64.31:53
19.202.88:21
31.189.232:143
4.167.166:80
4.234.27:443
147.184.249:143
163.180.243:22
163.222.244:465
189.195.208:8443
166.253.46:8080
209.217.49:80
112.228.47:443
145.67.134:8090
186.203.55:80
25.255.98:143
25.255.98:443
25.255.98:80
53.135.159:21
72.136.214:465
242.117.231:8080
58.114.91:4143
24.248.206:80
43.231.10:7080
85.46.122:80
199.89.223:8443
220.152.101:80
231.44.78:80
238.152.20:465
83.16.150:80
189.98.125:8080
63.71.72:8080
71.234.16:8080
98.148.156:8080
13.106.160:7080
214.218.136:4143
214.218.192:8080
139.205.186:8080
12.67.62:7080
172.240.91:8080
211.85.139:80
169.20.147:143
169.20.147:465
220.119.246:80
123.3.54:443
33.49.124:443
101.142.115:8080
105.131.87:80
41.213.2:22
31.0.160:8080
99.132.7:465
103.164.174:80
48.253.12:20
75.187.192:8080
13.225.150:8080
84.11.168:8080
45.19.145:8080
244.60.230:8080
127.14.170:8080
24.219.147:8080
109.227.123:80
104.59.244:20
98.61.221:443
106.136.232:8080
106.139.101:8080
230.19.21:8080
205.215.10:7080
205.215.66:8080
83.93.103:7080
154.101.154:50000
76.200.114:8080
128.43.213:8080

Thanks to @0xtadavie for catching this oversight!

Now is the time to block these IP/Port combos while you can. Also, if you see any requests going out to these IP/Port combos, cleanup isle whatever that computer is in because it is infected!