Emotet Campaigns: November 9th, 2018

Emotet IOCs

Emotet Campaign 1: https://www.virustotal.com/graph/g9c1d51be17da4d3d856dadb8ce07046e45da445e9dfa4304bc49880d90df381e

12b379ac95454c365edf299e087e861fbe8df739dcdb3d82b30dae3c4a201583
18d8a6f6bd307d67250eaccc4cc7b82f660a1923f6163c58666b969a5be18cd3
39942a00f9a77d75652b1c3911efdad8d8ff9f7c4f2b645418c54c5bb5074e32
6bd4b3f2072f67bb90832835c91a977dead10682a2a5f76b17993c73782179c0
6e7475b559f466986e6b33ff0c54896e3d85b3e6f7c04b75ca719433672eb1a4
7f52604743302a60f667bbcaddc4dc372a602862f41bf7a741f3676ebb3cbc6b
9c1468cf0ec8794f7a75fb8537e1a42e24436bcf63298792eb62ff55ee517f38
9f874949de45411ab799b437564babfb14560b13383b8feb6dfad4944cf0a79d
a2c5e9d10bb33c41a6fe675a5bda1be2f36b28e89f0af1cbaba6dce14f1d9dee
a369090e792f8e13b096f4d461c1b6407d8de0fa5d088f45fb24db38a8f72767
b71815756b88a2e0c9c7b004e107b895ead2eff1d73e3a4b5d7d4b1eb12c7225
d207d1043348768094e636fdb28bf8b4e1e49cff3196360d5317aa168fa396f9
f07be30c7f7158311ebad7481f2a5cc2e3f2a97a80b68882f727a0ece5356668

http://184.154.53.181/porto_demo_new/var/session/En_us/Clients_transactions/11_18
http://akuda.cl/En_us/Clients_Messages/2018-11
http://aspcindia.com/EN_US/Transactions-details/112018
http://automotive.bg/wp-content/EN_US/Clients_Messages/2018-11
http://automotive.bg/wp-content/EN_US/Clients_Messages/2018-11/
http://bemakeup.ru/EN_US/Clients/2018-11
http://bnb95.co.nz/US/ACH/11_18
http://casashavana.com/En_us/Attachments/112018
http://cohencreates.com/En_us/Details/112018
http://custommedia-wp.nl/En_us/Transactions/112018
http://deliyiz.net/wp-admin/images/US/Transactions/11_18
http://fleetwoodrvpark.com/US/Attachments/11_18
http://gi-site.com/En_us/Clients_transactions/2018-11
http://glcdevelopersapp-env.kanjpmbfka.us-east-2.elasticbeanstalk.com/US/Documents/112018
http://golroom.ir/EN_US/Clients_information/112018
http://gomus.com.br/sonsdobrasil/US/Clients_Messages/11_18
http://inhoanchinh.com/EN_US/Clients_Messages/2018-11
http://irparnian.ir/administrator/En_us/Attachments/2018-11
http://keymailuk.com/US/Clients_Messages/2018-11
http://madadgarparivaar.com/En_us/Transactions-details/11_18
http://microsoft-in-tune.co.uk/En_us/Information/11_18
http://miltosmakridis.com/US/Payments/11_18
http://parquetman.ge/wp-admin/En_us/Clients_Messages/11_18
http://skygoji.evicxixi.com/En_us/Clients/11_18
http://waraboo.com/US/Documents/2018-11
http://www.angelhealingspa.com/US/Clients_transactions/2018-11
http://www.casinogiftsdirect.com/En_us/Attachments/2018-11
http://www.conceptsacademy.co.in/wp-content/uploads/2018/US/Clients_transactions/2018-11
http://www.maim.at/En_us/Clients/112018
http://www.thestorageshoppe-hongkong.com/En_us/Documents/2018-11
http://www.tudosobreseguros.org.br/wp-content/_uploads/EN_US/Attachments/11_18
https://waraboo.com/US/Documents/2018-11
keymailuk.com
skygoji.evicxixi.com

Emotet Campaign 2: https://www.virustotal.com/graph/gd5cfdcb1344c4a79a45a5a41b6538915ce5c767a0a484469b17fe2e8393fc32f

196f94f66b3c6250c4f24ae623d4811bba68447474ca659df4c5e51155613c79
1c784cc70cdae9ffe5836773b61e1d674e21c2427d288bf68654d2816b701d39
1d199cb4bfd090a6a39b8720a55c70d332ef70c0f705d41323283d579d6f8ebd
2d45ae872e98ecc6252dccb8523b5d596adf079e6c99d4fd4ae434f559e80d7b
2f675c31e758a9611d680399380c9c3e052aee1b3c4a045627ea4ae072850dc6
350ec37cc10ca6e5a97015ffff87506403c27f2149c9fcddb3e35982aa5f6372
54b3c60f7fc303d4422d6c76eaf4502fa9d69d0f12d34e18620ffb03e50c2699
58b8ae91f730220ede1021f834a47133ab50aad2dce470b82d9bf9e3b67d1b14
5c5d2e17e36020eb14b1c952c31f71186fbd8372ed32765e20d2f7c0df36faf1
5e9cb93cb3e284b20d72aa87c29e64b48a285e0e58762899e36f992bab6d15cf
676610f32bdae1726f6f244ca4e0bc2bbcb421e3404ac2e4fc0ece009a590f07
6775d1adeb6e369cce722e0adf240f2fa55cfa04c04bf338eb705e9fb9bbda91
6968d086ca53f578d35523558bdaf220905fb30f58cf64e5171fe472149ddbc7
69e6cc1cc28dffd3eafe4815b3bda851aabec3209fbc64602d46abc39336eff1
72a7075b8decd17a1b4780ea442f5df6804f4a28ba3eecd1087b496387f57ed3
7bb9b2d3805dc91dc61ecd79ebaf09eed53ae5b5e909c2db1d30c078ab6d235c
82c1ec61a9a238f49238d8977023ee1bf9b811fd9e3b107ec71595ba060f9d33
8c48eb91c6f32db18c3462b7f39ed376dbd93694933ab68b83407701316dec49
93f5190961d11b48824ad0564f5a21ce4cbe1e1237d2a71348ffcc51ccd57f77
9c6289f4437632097d9f07991437e8a31569dcc612077084b261f954a4314a4e
a8d0a54d290ed4edddcc377b76ef243b13852889d9cf9f07d2f827d22649d3a1
aedb3c16d7b8ab40802b0bad03df904b6d05279996e75f364487bf96ad48a64c
c0cdad652c8a20af3c2cfe9448967fae0a5d693a5a95eda42762c0009fa171a6
c3fd234cb3ebfc5ee8dcddc4782064146094a0aa5e406a58c6f7daaba9e46f5a
ee7d3da4db52476053d779ac2767579b6c1daafb3c79a617a5a5f108fd7243fd
fb546088ad6eb07ea65e647b9da823e217d6b6b03e1138124a403ac386179ac9

http://18.188.218.228/upload/319PnZk7GutdSz5xxT/de_DE/Firmenkunden
http://18.219.13.62/G4yDVqR4TTLI/biz/200-Jahre
http://afan.xin/2610121O/HvqD0Tg0pfDIx6EjC/SEP/200-Jahre
http://besttravels.live/4223683Y/oamo/Smallbusiness
http://bezrukfamily.ru/upload/VriQHkgdl/07TAEN/PAY/Business
http://bihanirealty.com/wp-content/uploads/0171349CNEP/SWIFT/US
http://bolumutluturizm.com/INFO/US_us/566-47-624093-213-566-47-624093-619
http://camdentownunlimited.demo.uxloft.com/DOC/En_us/Overdue-payment
http://canguakho.net/Download/En_us/Invoice-for-l/k-11/07/2018
http://esinseyrek.com/Corporation/US_us/Outstanding-Invoices
http://fantastika.in.ua/BR14GfgUp/SEPA/Service-Center
http://fenicerosa.com/xerox/En/Inv-35516-PO-9O377749
http://forestbooks.cn/68839QM/ACH/Commercial
http://grille-tech.com/irTZxa/DE/Privatkunden
http://hotelpleasantstay.com/4061GXJ/oamo/Commercial
http://nikbox.ru/Reke5kkZjha/de_DE/Privatkunden
http://seadi2.hospedagemdesites.ws/Document/En_us/186-11-789737-486-186-11-789737-929
http://seadi2.hospedagemdesites.ws/Document/En_us/186-11-789737-486-186-11-789737-929)
http://seegeesolutions.com/Document/EN_en/Invoice-for-you
http://stefanobaldini.net/components/DOC/EN_en/Past-Due-Invoices
http://toronto.rogersupfront.com/kyJzuMtkAWLT9/biz/PrivateBanking
http://visiontomotion.com/LMS/question/engine/upgrade/HEu6VwUOv/biz/Firmenkunden
http://www.bzdvip.com/yRewI1wbu/DE/Service-Center
http://www.ddyatirim.com/9168FDQFA/ACH/Smallbusiness
http://www.emark4sudan.com/DOC/EN_en/Paid-Invoice
http://www.haraldweinbrecht.com/newsletter/EN_en/Invoices-Overdue
http://www.hotelpleasantstay.com/4061GXJ/oamo/Commercial
http://www.nga.no/hqFjqeyKW/SWIFT/200-Jahre/
http://www.spiritexecutive.com/0X/oamo/Smallbusiness
http://www.transimperial.ru/671VJSAK/oamo/Business