{"id":120,"date":"2018-09-04T18:22:31","date_gmt":"2018-09-04T16:22:31","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=120"},"modified":"2026-06-08T23:18:14","modified_gmt":"2026-06-08T23:18:14","slug":"indicators-of-compromise-september-2018","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/indicators-of-compromise-september-2018\/","title":{"rendered":"Indicators of Compromise \u2014 4 September 2018"},"content":{"rendered":"

Indicators of compromise related to banking malware infections (Emotet and TrickBot<\/strong>) deployed during malware campaigns targeting Italian infrastructure.<\/p>\n

The compromises are associated with activity conducted during August\u2013September 2018.<\/p>\n

Campaigns of this type consistently target systems and IT infrastructure. In certain periods, up to 4 distinct malware campaigns employing the same malware have been observed within a 30-day window.<\/p>\n

Emotet\/TrickBot Malware (SHA256 HASH):<\/strong><\/p>\n\n\n\n
\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n<\/div>\n<\/td>\n
\n
\n
(<\/span>1st<\/span> <\/span>Stage<\/span>)<\/span><\/strong><\/div>\n
6EF5C474B7706E547257B65711D44C5D8183420ACF6D1D673A445FC30D3E2ACD<\/span><\/div>\n
483375f638c20330ccdc6425483a59d84dfc7e4da81f2a26363b7ee16a5a3cd9<\/span> <\/span><\/div>\n
1c1e2db21c30fe50d3dcb4b4f756bc154d319cf1365afb3962631941b9513859<\/span><\/div>\n
14b8461975d56583ef0a575e6b3edee10da4583d4d9d2959ea5abd99996fe68a<\/span><\/div>\n
<\/div>\n
http<\/span>:<\/span>\/\/fluorescent[.]cc\/IkSd44UwZs<\/span><\/div>\n
http<\/span>:<\/span>\/\/www.inancspor[.]com\/1ymVXSaT7J<\/span><\/div>\n
http<\/span>:<\/span>\/\/mainlis[.]pt\/0f9WStspZ<\/span><\/div>\n
http<\/span>:<\/span>\/\/thexda[.]com\/ZptEBCytV<\/span><\/div>\n
http<\/span>:<\/span>\/\/samarthdparikh[.]com\/mConYIy<\/span><\/div>\n
http<\/span>:<\/span>\/\/imrenocakbasi<span>[.]com\/pNDq<\/span><\/div>\n
http<\/span>:<\/span>\/\/opaljeans<span>[.]com\/T<\/span><\/div>\n
http<\/span>:<\/span>\/\/atoliyeh<span>[.]com\/fhlb<\/span><\/div>\n
http<\/span>:<\/span>\/\/linkbio<span>[.]net\/mYKl<\/span><\/div>\n
http<\/span>:<\/span>\/\/proinnovation2013[.]com\/0k6vpL79<\/span><\/div>\n
http<\/span>:<\/span>\/\/rtnbd24[.]com\/JLbh1WGtMu<\/span><\/div>\n
http<\/span>:<\/span>\/\/goldsellingsuccess[.]com\/pXo3156n2G<\/span><\/div>\n
http<\/span>:<\/span>\/\/cuentocontigo[.]net\/eS663S6XX2<\/span><\/div>\n
http<\/span>:<\/span>\/\/manatour[.]cl\/6Vo9r2CAU<\/span><\/div>\n
http<\/span>:<\/span>\/\/omlinux[.]com\/SGNChoG&gt;<\/span><\/div>\n
<\/div>\n
(<\/span>2nd<\/span> <\/span>Stage<\/span>)<\/span><\/strong><\/div>\n
02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290<\/span><\/div>\n
“C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\searchatsd.exe”<\/span><\/div>\n
“HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run”<\/span> <\/span>(<\/span>Key<\/span>:<\/span>searchatsd<\/span>)<\/span><\/strong><\/div>\n
<\/div>\n
(Command<\/span> <\/span>&<\/span> <\/span>Control<\/span>)<\/span><\/strong><\/div>\n
81<\/span>[<\/span>.<\/span>]<\/span>21<\/span>[<\/span>.<\/span>]<\/span>85<\/span>[<\/span>.<\/span>]<\/span>89<\/span>:<\/span>7080<\/span><\/div>\n
213<\/span>[<\/span>.<\/span>]<\/span>12<\/span>[<\/span>.<\/span>]<\/span>.<\/span>182<\/span>[<\/span>.<\/span>]<\/span>53<\/span>:<\/span>7080<\/span><\/div>\n
136<\/span>[<\/span>.<\/span>]<\/span>56<\/span>[<\/span>.<\/span>]<\/span>30<\/span>[<\/span>.<\/span>]<\/span>168<\/span><\/div>\n
128<\/span>[<\/span>.<\/span>]<\/span>2<\/span>[<\/span>.<\/span>]<\/span>97<\/span>[<\/span>.<\/span>]<\/span>187<\/span>:<\/span>8443<\/span><\/div>\n
76<\/span>[<\/span>.<\/span>]<\/span>120<\/span>[<\/span>.<\/span>]<\/span>104<\/span>[<\/span>.<\/span>]<\/span>107<\/span>:<\/span>443<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The second-stage payload demonstrates persistence mechanisms via registry modification (HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and establishes command-and-control communication through multiple IP addresses on non-standard ports. Tracking of these indicators through Cyber Threat Intelligence<\/a> feeds enables rapid detection and containment of infected endpoints. The multi-stage deployment pattern\u2014initial dropper followed by persistent backdoor installation\u2014reflects the operational security practices common to banking trojan distribution networks during this period. Organizations maintaining updated IOC repositories and network-based detection rules can significantly reduce dwell time and lateral movement risk associated with Emotet and TrickBot infections.<\/p>\n","protected":false},"excerpt":{"rendered":"

Indicators of Compromise from August-September 2018 banking-malware campaigns (Emotet, TrickBot) targeting Italian infrastructures.<\/p>\n","protected":false},"author":1,"featured_media":126,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[125,185,3358,3360,3359,337,361,1609],"class_list":["post-120","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-emotet","tag-ioc","tag-ioc-bulletin","tag-italian-banking-targeting","tag-september-2018","tag-statistics","tag-trickbot","tag-trickbot-it"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=120"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/120\/revisions"}],"predecessor-version":[{"id":9928,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/120\/revisions\/9928"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=120"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}