Emotet (E4) Botnet IOCs - Part 9

Emotet - один из самых опасных троянов, когда-либо созданных. За время своего существования он был усовершенствован и превратился в очень разрушительную вредоносную программу.

Его жертвами становятся в основном корпоративные пользователи, но даже частные пользователи заражаются в ходе массовых спам-рассылок.

Emotet Botnet

Indicators of Compromise

Domains

advanzabpo.com
asaferefuge.org
cashmailsystem.com
collabsolutions.co.za
comecebem.com
congtycamvinh.com
contabilidadeplenus.com.br
coolcraft.at
corneliussen.dk
cosole.dk
diarioaldia.com.ar
dotcompany.com.br
dploy.nl
ewingconsulting.com
forensisbilisim.com
fullwiz.com.br
fundaciontheoz.cl
garantihaliyikama.com
greenvalleyschool.co
kairaliagencies.com
kspintidana.com
m-ainsurance.com
mobiles-photostudio.com
nlasandbox.com
starluckycentre.com
thegoodneighbourapp.com
thietkewebsitechuanseo.com
zablimconsultancy.co.ke

URLs

http://1.234.2.232:8080
http://101.50.0.91:8080
http://103.132.242.26:8080
http://103.43.75.120:443
http://103.70.28.102:8080
http://103.75.201.2:443
http://104.168.155.143:8080
http://107.170.39.149:8080
http://110.232.117.186:8080
http://115.68.227.76:8080
http://119.193.124.41:7080
http://129.232.188.93:443
http://131.100.24.231:80
http://134.122.66.193:8080
http://135.148.6.80:443
http://139.162.113.169:8080
http://139.59.126.41:443
http://144.91.78.55:443
http://146.59.226.45:443
http://149.56.131.28:8080
http://150.95.66.124:8080
http://151.106.112.196:8080
http://153.126.146.25:7080
http://158.69.222.101:443
http://159.65.140.115:443
http://159.65.88.10:8080
http://159.89.202.34:443
http://160.16.142.56:8080
http://163.44.196.120:8080
http://164.68.99.3:8080
http://167.172.253.162:8080
http://172.104.251.154:8080
http://172.105.226.75:8080
http://173.212.193.249:8080
http://183.111.227.137:8080
http://185.4.135.165:8080
http://186.194.240.217:443
http://188.44.20.25:443
http://196.218.30.83:443
http://197.242.150.244:8080
http://201.94.166.162:443
http://206.189.28.199:8080
http://207.148.79.14:8080
http://209.126.98.206:8080
http://209.97.163.214:443
http://212.24.98.99:8080
http://213.239.212.5:443
http://213.241.20.155:443
http://37.187.115.122:8080
http://45.118.115.99:8080
http://45.176.232.124:443
http://45.186.16.18:443
http://45.235.8.30:8080
http://45.55.191.130:443
http://45.76.181.158:443
http://46.55.222.11:443
http://5.9.116.246:8080
http://51.161.73.194:443
http://51.254.140.238:7080
http://51.91.76.89:8080
http://64.227.100.222:8080
http://72.15.201.15:8080
http://79.137.35.198:8080
http://82.165.152.127:8080
http://82.223.21.224:8080
http://91.207.28.33:8080
http://94.23.45.86:4143
http://advanzabpo.com/fonts/K1cXL8XJarbXYL0Spr/
http://cashmailsystem.com/upload/yRC05/
http://collabsolutions.co.za/libraries/qn8LLQ66K/
http://comecebem.com/wp-admin/WvCd0OfZD/
http://congtycamvinh.com/plugins/rwPRWazNkGzg/
http://contabilidadeplenus.com.br/ebooks/dIA4Vv2AnYEnQL/
http://corneliussen.dk/wp-includes/hZ1hsgTdbppDlYP/
http://cosole.dk/wp-includes/U/
http://dotcompany.com.br/autoupdate/WVzrARSu74NtSh61uF/
http://kairaliagencies.com/data_winning/RDN/
http://nlasandbox.com/facebookpage/5XVwDnX/
http://starluckycentre.com/data_winning/NgmBH48GCzovEIAgJY/
http://www.diarioaldia.com.ar/admin/Bzq5zzq8CAYy/
http://www.dploy.nl/css/XLxbVjAta7vVC/
http://www.forensisbilisim.com/wp-includes/tznAlaHXSY/
http://www.fullwiz.com.br/erros/v2om35w/
http://www.fundaciontheoz.cl/pensamientooccidental/OGQK0eVU0RRxE0/
http://www.garantihaliyikama.com/wp-admin/CcxWGjZEjriZ9zMdsP/
http://www.kspintidana.com/wp-admin/jjiOcQAL/
https://asaferefuge.org/wp-admin/2LO/
https://coolcraft.at/wordpress/aAr/
https://evashopping.thietkewebsitechuanseo.com/assets/rNAyQu/
https://ewingconsulting.com/wp-includes/B4ZzwwImcXf6w8/
https://m-ainsurance.com/wp-admin/ORiPBStKNOnIV/
https://www.greenvalleyschool.com/rand_images/NT5NjK6o/
https://www.mobiles-photostudio.com/MPS/uYUKsZhII1qQ1/
https://www.thegoodneighbourapp.com/cgi-bin/h4/
https://www.zablimconsultancy.co.ke/musagala/pmOVrwAwG/

Emails

MD5

0a3386f68b9ac21fa66e5c62a715cbc5
1782111f0c43ac88b4442f394e21d7ae
17cc93aca3ae7e838bce9a36739648ae
2f8ec4c50a4fa468e9ef397b7337b6c0
32d2c57ff40148a8446f15ca9e22eb0b
33c6a35494f9755837c95cba02fcc2fd
40ec408f420c52df42b53fbcc1a026e0
49ceb206e8eae139238f487559d3c98e
560da7203f1cd4a692015b0d6727c37c
5677a922633e7e5c503054c03dd391fc
5cb52029263fbb402ac28be10e68ba81
6056d08acbe207c17daa6c5415d5d3a1
6f820a2843852441c69338805c3c097f
7922107976d6966a2f6853259b0334c5
8e828c46f1abc3eb5eddffb43b66194a
9548d246dbe8bfc6184093fb6418c764
99ba6dd55bb579c4549cd0630de4e6d2
ab9114606558c343caf825649eadba70
abbd3826f4fc03acad05dfecab5389e9
ac2a02c4048cf779d150884276c9f291
af1ec767c13879e0afbcee831e8be697
b1e7fe613ff2a1949cd8b53514cc8daf
b21e74b76cbb273dc244bc93ffaea0aa
b53d2ed0c3b906e7bceb5bffe31194e3
bca774464f52e484a93f3841124758a1
cd48bb02af7e9b9e5cb72ab4fc4fa66d
ce57a4074698a40cc55999738e71cb36
ce71f45a53582f4807a1a589250b9464
d1b93c7fe584ceec05676c3399d31f14
d78697f8e00956b605c1a8c95ec28475
dacb649a56235d4bc93fb20cafc6d335
de2ab8ef9a61718af830c6edbf08e2e7
dec7152995600d6e769ca6b384b873cd
e5b2cc5265e15bb689308ad94f1ff2e1
e85207aae24cca90d259a1669c8c5896
ec3680a2bb6ec8a97e95cd369009032f
f2e6755cb8342a3875e6cd6f2e60eca2
fb3c64aa47901f32956a7ec8f83edb76