Trojan Emotet – Rientro di Settembre

Pubblicato da frtg il

Campagna malware Emotet (Trojan Bancario), che ha targettizzato utenti italiani di rientro dalle ferie estive.

Maggiori dettagli:

Info sul Malware Emotet

” While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.
It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time. “

Malpedia – https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Threat Group: https://malpedia.caad.fkie.fraunhofer.de/actor/mummy_spider

Dettagli campagne Malware

Allegato malevolo:

URL malevoli (download payload):

URLhttp://designproper[.]com/bl/2OQEN/
URLhttp://aksoyotomotiv[.]com[.]tr/cgi-bin/EQJPWVLEC09NIN/pkruqiae1t/ier63895577365830oflnl1wnzdsb0k/
URLhttp://frisa[.]com[.]br/lixo/gpuqebwh-7rw5n-72/
URLhttps://www[.]beewrks[.]com/wp-content/INC/
URLhttp://haberreport[.]xyz/cgi-bin/docs/ovkq0j99499646fl9a194jir/
URLhttp://lightsystems[.]be/img/437585318/98gon2c6/
URLhttp://danirvinphotography[.]com/wedding/FILE/x8zy6og6/
URLhttp://www[.]mcsgroup[.]co/assets/ncj02fs-iwts6-070/
URLhttps://paws4walking[.]co[.]uk/wp-admin/paclm/jz6ucfaswah/
URLhttps://molymet[.]brandbook[.]cl/wp-content/FILE/f00xis8m6jct/
URLhttp://infectedarea[.]com/iwtfy/personal-nomjt21nj35-dcghj0ypm14wv/close-jggcoco0-v8e922t5wrzz0/70517534975-fawZjanbd9e/
URLhttp://ikweetvanniks[.]nl/wp-admin/sites/r7hl15e2507600615369843306bchas7u86s8dm/
URLhttp://www[.]kecsfila[.]hu/wp-admin/52ud3r55h/
URLhttp://ehostlab[.]com/cgi-bin/pa_2o2kd6gkm_disk/interior_forum/1fmb74u6h_ux1v14u/
URLhttp://charihome[.]com/STATUS/akqmt0_kbwupkbwoia_module/ghd2h8n_thj_space/RICVq6_mo8ieuz1N0w/
URLhttps://lozalo[.]com/wp-includes/zsqig-15-697059/
URLhttp://prostomebli[.]kiev[.]ua/wp-admin/esp/5ohxdj/
URLhttps://heartssetfree[.]org/9c950e/Scan/oh2753083skvphuiffhodq9oz2/
URLhttp://gamemechanics[.]com/amazonchecker[.]com/parts_service/jckyhvr8f9k/
URLhttps://mansanz[.]es/banuelos[.]mansanz[.]es/browse/yoim0ro/xvf0ie7299046558vtmni0ojaprqofy6nwwvz/
URLhttp://pmcc4thwatch[.]eu/wp-content/themes/inspiro/DOC/4qdtd83jid8i/
URLhttps://anike-cafe[.]com/wp-content/MSXAYXNH28/
URLhttp://larangeira[.]com/www/statement/w922804192375452419s2leeltff0qx44wi/
URLhttp://partyflix[.]net/cgi-bin/invoice/iy3nir10bm0/
URLhttp://zq88[.]tk/NBY2IUObJQ/multifunctional-zone/test-warehouse/0799860763515-KvMohzLwfi/
URLhttp://coneymedia[.]com/wp-content/browse/TTatrre/
URLhttp://jetjackinc[.]com/wp-admin/paclm/93lyz1xaxrc5/g17033349632990yn3foczzqq/
URLhttps://clerys[.]pixelloclients[.]co[.]uk/wp-content/attachments/pevr82myme/zm13d84901278711kskialbe1qva29ro/
URLhttps://vmais[.]net/bebemaria/download/DOC/s5cltyz/

Command & Control (C2):

216.10.40.16:80210.1.219.238:80181.30.61.163:443
91.121.54.71:8080162.144.42.60:8080177.74.228.34:80
209.236.123.42:8080134.209.193.138:443199.203.62.165:80
77.55.211.77:808068.183.233.80:8080177.72.13.80:80
85.105.140.135:443172.105.78.244:808058.171.153.81:80
138.97.60.141:7080181.113.229.139:44373.213.208.163:80
217.13.106.14:8080139.59.12.63:808024.148.98.177:80
190.2.31.172:80185.142.236.163:443190.195.129.227:8090
94.176.234.118:443113.203.250.121:443192.241.146.84:8080
191.182.6.118:8074.208.173.91:808012.162.84.2:8080
111.67.12.221:8080173.94.215.84:8072.47.248.48:7080
91.219.169.180:8031.146.61.34:80172.96.190.154:8080
70.32.115.157:8080115.78.11.155:80113.161.148.81:80
45.33.77.42:808095.216.205.155:8080190.164.75.175:80
177.73.0.98:44382.239.200.118:8075.127.14.170:8080
219.92.8.17:808081.17.93.134:80177.144.130.105:443
212.174.55.22:443179.5.118.12:8071.57.180.213:80
189.2.177.210:443162.249.220.190:8086.98.143.163:80
46.28.111.142:708077.74.78.80:443220.254.198.228:443
37.52.87.0:8024.26.151.3:80190.136.179.102:80
45.173.88.33:80188.0.135.237:80195.201.56.70:8080
103.106.236.83:8080192.241.220.183:808051.38.201.19:7080
87.106.46.107:8080190.53.144.120:80179.62.238.49:80
104.131.103.37:808060.125.114.64:443157.7.164.178:8081
190.6.193.152:808050.116.78.109:8080175.139.144.229:8080
65.36.62.20:802.144.244.204:44337.46.129.215:8080
152.169.22.67:80192.210.217.94:8080222.159.240.58:80
83.169.21.32:7080201.213.177.139:80190.190.15.20:80
98.13.75.196:8081.214.253.80:44346.32.229.152:8080
51.159.23.217:443178.33.167.120:808066.61.94.36:80
71.197.211.156:80186.227.146.102:80143.95.101.72:8080
170.81.48.2:80201.235.10.215:80190.212.140.6:80
190.24.243.186:8037.205.9.252:7080168.0.97.6:80
178.250.54.208:8080198.57.203.63:8080177.32.8.85:80
104.131.41.185:8080175.29.183.2:80185.208.226.142:8080
181.129.96.162:8080181.137.229.1:80105.209.235.113:8080
213.60.96.117:80185.86.148.68:443197.221.158.162:80
95.9.180.128:8046.105.131.68:808041.185.29.128:8080
64.201.88.132:80118.101.24.148:80103.80.51.61:8080
174.100.27.229:80115.79.195.246:80177.94.227.143:80
82.196.15.205:8080188.251.213.180:44350.28.51.143:8080
191.99.160.58:8088.249.181.198:44351.255.165.160:8080
114.109.179.60:8091.83.93.103:44385.109.159.61:443
72.135.200.124:805.79.70.250:8080190.190.148.27:8080
45.16.226.117:44354.38.143.245:8080172.104.169.32:8080
61.92.159.208:808045.182.161.17:80213.197.182.158:8080
2.47.112.152:8091.75.75.46:80187.162.248.237:80
186.103.141.250:44337.187.100.220:708072.167.223.217:8080
190.147.137.153:443190.96.15.50:80217.199.160.224:7080
178.79.163.131:8080189.39.32.161:80188.2.217.94:80
70.32.84.74:8080181.122.154.240:8024.135.1.177:80
67.247.242.247:80190.55.186.229:80137.74.106.111:7080
190.128.173.10:80203.153.216.178:7080206.15.68.237:443
186.70.127.199:8090157.245.138.101:708045.161.242.102:80
190.163.31.26:80190.225.150.234:80219.92.13.25:80
192.241.143.52:8080192.163.221.191:8080185.94.252.12:80
190.115.18.139:8080107.161.30.122:8080110.142.219.51:80
178.148.55.236:8080197.232.36.108:8077.238.212.227:80
185.94.252.27:44368.183.170.114:8080212.71.237.140:8080
77.90.136.129:8080184.66.18.83:80204.225.249.100:7080
188.135.15.49:805.196.35.138:708082.76.111.249:443
189.131.57.131:8068.183.190.199:8080