Campagna malware Emotet (Trojan Bancario), che ha targettizzato utenti italiani di rientro dalle ferie estive.
Maggiori dettagli:
Info sul Malware Emotet
” While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.
Malpedia – https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet
It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time. “
Threat Group: https://malpedia.caad.fkie.fraunhofer.de/actor/mummy_spider
Dettagli campagne Malware
Allegato malevolo:
URL malevoli (download payload):
| URL | http://designproper[.]com/bl/2OQEN/ |
| URL | http://aksoyotomotiv[.]com[.]tr/cgi-bin/EQJPWVLEC09NIN/pkruqiae1t/ier63895577365830oflnl1wnzdsb0k/ |
| URL | http://frisa[.]com[.]br/lixo/gpuqebwh-7rw5n-72/ |
| URL | https://www[.]beewrks[.]com/wp-content/INC/ |
| URL | http://haberreport[.]xyz/cgi-bin/docs/ovkq0j99499646fl9a194jir/ |
| URL | http://lightsystems[.]be/img/437585318/98gon2c6/ |
| URL | http://danirvinphotography[.]com/wedding/FILE/x8zy6og6/ |
| URL | http://www[.]mcsgroup[.]co/assets/ncj02fs-iwts6-070/ |
| URL | https://paws4walking[.]co[.]uk/wp-admin/paclm/jz6ucfaswah/ |
| URL | https://molymet[.]brandbook[.]cl/wp-content/FILE/f00xis8m6jct/ |
| URL | http://infectedarea[.]com/iwtfy/personal-nomjt21nj35-dcghj0ypm14wv/close-jggcoco0-v8e922t5wrzz0/70517534975-fawZjanbd9e/ |
| URL | http://ikweetvanniks[.]nl/wp-admin/sites/r7hl15e2507600615369843306bchas7u86s8dm/ |
| URL | http://www[.]kecsfila[.]hu/wp-admin/52ud3r55h/ |
| URL | http://ehostlab[.]com/cgi-bin/pa_2o2kd6gkm_disk/interior_forum/1fmb74u6h_ux1v14u/ |
| URL | http://charihome[.]com/STATUS/akqmt0_kbwupkbwoia_module/ghd2h8n_thj_space/RICVq6_mo8ieuz1N0w/ |
| URL | https://lozalo[.]com/wp-includes/zsqig-15-697059/ |
| URL | http://prostomebli[.]kiev[.]ua/wp-admin/esp/5ohxdj/ |
| URL | https://heartssetfree[.]org/9c950e/Scan/oh2753083skvphuiffhodq9oz2/ |
| URL | http://gamemechanics[.]com/amazonchecker[.]com/parts_service/jckyhvr8f9k/ |
| URL | https://mansanz[.]es/banuelos[.]mansanz[.]es/browse/yoim0ro/xvf0ie7299046558vtmni0ojaprqofy6nwwvz/ |
| URL | http://pmcc4thwatch[.]eu/wp-content/themes/inspiro/DOC/4qdtd83jid8i/ |
| URL | https://anike-cafe[.]com/wp-content/MSXAYXNH28/ |
| URL | http://larangeira[.]com/www/statement/w922804192375452419s2leeltff0qx44wi/ |
| URL | http://partyflix[.]net/cgi-bin/invoice/iy3nir10bm0/ |
| URL | http://zq88[.]tk/NBY2IUObJQ/multifunctional-zone/test-warehouse/0799860763515-KvMohzLwfi/ |
| URL | http://coneymedia[.]com/wp-content/browse/TTatrre/ |
| URL | http://jetjackinc[.]com/wp-admin/paclm/93lyz1xaxrc5/g17033349632990yn3foczzqq/ |
| URL | https://clerys[.]pixelloclients[.]co[.]uk/wp-content/attachments/pevr82myme/zm13d84901278711kskialbe1qva29ro/ |
| URL | https://vmais[.]net/bebemaria/download/DOC/s5cltyz/ |
Command & Control (C2):
| 216.10.40.16:80 | 210.1.219.238:80 | 181.30.61.163:443 |
| 91.121.54.71:8080 | 162.144.42.60:8080 | 177.74.228.34:80 |
| 209.236.123.42:8080 | 134.209.193.138:443 | 199.203.62.165:80 |
| 77.55.211.77:8080 | 68.183.233.80:8080 | 177.72.13.80:80 |
| 85.105.140.135:443 | 172.105.78.244:8080 | 58.171.153.81:80 |
| 138.97.60.141:7080 | 181.113.229.139:443 | 73.213.208.163:80 |
| 217.13.106.14:8080 | 139.59.12.63:8080 | 24.148.98.177:80 |
| 190.2.31.172:80 | 185.142.236.163:443 | 190.195.129.227:8090 |
| 94.176.234.118:443 | 113.203.250.121:443 | 192.241.146.84:8080 |
| 191.182.6.118:80 | 74.208.173.91:8080 | 12.162.84.2:8080 |
| 111.67.12.221:8080 | 173.94.215.84:80 | 72.47.248.48:7080 |
| 91.219.169.180:80 | 31.146.61.34:80 | 172.96.190.154:8080 |
| 70.32.115.157:8080 | 115.78.11.155:80 | 113.161.148.81:80 |
| 45.33.77.42:8080 | 95.216.205.155:8080 | 190.164.75.175:80 |
| 177.73.0.98:443 | 82.239.200.118:80 | 75.127.14.170:8080 |
| 219.92.8.17:8080 | 81.17.93.134:80 | 177.144.130.105:443 |
| 212.174.55.22:443 | 179.5.118.12:80 | 71.57.180.213:80 |
| 189.2.177.210:443 | 162.249.220.190:80 | 86.98.143.163:80 |
| 46.28.111.142:7080 | 77.74.78.80:443 | 220.254.198.228:443 |
| 37.52.87.0:80 | 24.26.151.3:80 | 190.136.179.102:80 |
| 45.173.88.33:80 | 188.0.135.237:80 | 195.201.56.70:8080 |
| 103.106.236.83:8080 | 192.241.220.183:8080 | 51.38.201.19:7080 |
| 87.106.46.107:8080 | 190.53.144.120:80 | 179.62.238.49:80 |
| 104.131.103.37:8080 | 60.125.114.64:443 | 157.7.164.178:8081 |
| 190.6.193.152:8080 | 50.116.78.109:8080 | 175.139.144.229:8080 |
| 65.36.62.20:80 | 2.144.244.204:443 | 37.46.129.215:8080 |
| 152.169.22.67:80 | 192.210.217.94:8080 | 222.159.240.58:80 |
| 83.169.21.32:7080 | 201.213.177.139:80 | 190.190.15.20:80 |
| 98.13.75.196:80 | 81.214.253.80:443 | 46.32.229.152:8080 |
| 51.159.23.217:443 | 178.33.167.120:8080 | 66.61.94.36:80 |
| 71.197.211.156:80 | 186.227.146.102:80 | 143.95.101.72:8080 |
| 170.81.48.2:80 | 201.235.10.215:80 | 190.212.140.6:80 |
| 190.24.243.186:80 | 37.205.9.252:7080 | 168.0.97.6:80 |
| 178.250.54.208:8080 | 198.57.203.63:8080 | 177.32.8.85:80 |
| 104.131.41.185:8080 | 175.29.183.2:80 | 185.208.226.142:8080 |
| 181.129.96.162:8080 | 181.137.229.1:80 | 105.209.235.113:8080 |
| 213.60.96.117:80 | 185.86.148.68:443 | 197.221.158.162:80 |
| 95.9.180.128:80 | 46.105.131.68:8080 | 41.185.29.128:8080 |
| 64.201.88.132:80 | 118.101.24.148:80 | 103.80.51.61:8080 |
| 174.100.27.229:80 | 115.79.195.246:80 | 177.94.227.143:80 |
| 82.196.15.205:8080 | 188.251.213.180:443 | 50.28.51.143:8080 |
| 191.99.160.58:80 | 88.249.181.198:443 | 51.255.165.160:8080 |
| 114.109.179.60:80 | 91.83.93.103:443 | 85.109.159.61:443 |
| 72.135.200.124:80 | 5.79.70.250:8080 | 190.190.148.27:8080 |
| 45.16.226.117:443 | 54.38.143.245:8080 | 172.104.169.32:8080 |
| 61.92.159.208:8080 | 45.182.161.17:80 | 213.197.182.158:8080 |
| 2.47.112.152:80 | 91.75.75.46:80 | 187.162.248.237:80 |
| 186.103.141.250:443 | 37.187.100.220:7080 | 72.167.223.217:8080 |
| 190.147.137.153:443 | 190.96.15.50:80 | 217.199.160.224:7080 |
| 178.79.163.131:8080 | 189.39.32.161:80 | 188.2.217.94:80 |
| 70.32.84.74:8080 | 181.122.154.240:80 | 24.135.1.177:80 |
| 67.247.242.247:80 | 190.55.186.229:80 | 137.74.106.111:7080 |
| 190.128.173.10:80 | 203.153.216.178:7080 | 206.15.68.237:443 |
| 186.70.127.199:8090 | 157.245.138.101:7080 | 45.161.242.102:80 |
| 190.163.31.26:80 | 190.225.150.234:80 | 219.92.13.25:80 |
| 192.241.143.52:8080 | 192.163.221.191:8080 | 185.94.252.12:80 |
| 190.115.18.139:8080 | 107.161.30.122:8080 | 110.142.219.51:80 |
| 178.148.55.236:8080 | 197.232.36.108:80 | 77.238.212.227:80 |
| 185.94.252.27:443 | 68.183.170.114:8080 | 212.71.237.140:8080 |
| 77.90.136.129:8080 | 184.66.18.83:80 | 204.225.249.100:7080 |
| 188.135.15.49:80 | 5.196.35.138:7080 | 82.76.111.249:443 |
| 189.131.57.131:80 | 68.183.190.199:8080 |
