Originally designed as banking malware, Emotet was discovered in 2014 and is known to be among the most active and successful malware campaigns in existence. Emotet leverages malicious SPAM to seed the initial infection chain. SPAM operations took a break between January and November of 2021, and again from June of this year until just today.... just in time for the November Black Friday shopping season.
So far, all email samples we have seen include malicious Microsoft Excel (XLS) attachments containing a new coercion approach with a graphical lure designed to look like a legitimate "ribbon", depicted here.
Generated the following list on November 4th via InQuest Labs CLI/Library plus a sprinkle of JQ/Bash around the an OCR content pivot.
for h in `inquest_labs dfi search ocr "RELAUNCH REQUIRED" | jq -r ".[].sha256" | sort`
do
inquest_labs dfi attributes $h --filter url | jq -r ".[].value"
done | sort -u | sed 's/http/hxxp/'
Generates the following list of IOCs:
hxxp://9hym.com/images/SXVIe4tbJw8ZCfa4TEt/
hxxp://aibwireless.com/cgi-bin/zR2mG25Ssk8dH/
hxxp://alagi.ge/application/irnz5Rs8qWvQrf/
hxxp://alvaovillagecamping.pt/wp-content/Ra9iwOPb6uLf/
hxxp://andrewpharma.com/ost/NjKVUWPAuvq4Sr/
hxxp://anguklaw.com/microsoft-clearscript/oVgMlzJ61/
hxxp://app.clubdedocentes.com/storage/DCcq9ekgH99sI/
hxxp://aquariorecords.com.br/wp-content/A8G3ownNApEj1L4hF/
hxxp://armannahalpersian.ir/3H5qqUOB/
hxxp://brittknight.com/PHP/Aqxf09OugZ/
hxxp://cagdassahin.com/wp-content/no72w36Uoo6zzgP8JolL/
hxxp://canterapola.es/semihibernation/5H44GMEZ17GrW/
hxxp://coinkub.com/wp-content/WwrJvjumS/
hxxp://contactworks.nl/images_old/NuEAhfF0PCFhvv/
hxxp://cultura.educad.pe/wp-content/A86I7QxwuEZV/
hxxp://cursosinterativos.com.br/semprichickoff2/pEl/
hxxp://cybertech.freeoda.com/ct/go6hL733p4vjEnuu/
hxxp://danoblab.com/wordpress_4/Fw/
hxxp://demo.cansunoto.com/lYqTuQ0qe5r2Y/
hxxp://ftp.agir-santeinternationale.com/doctors/KAacngW97n4ApzVBDdGy/
hxxp://ftp.annuncivendereairussi.it/oc-admin/7RVaIAsFF/
hxxp://ftp.pricoat.com.mx/Fichas/3ybJLLXu5zqqn8Sx/
hxxp://helpeve.com/multiwp/cxpkaAkAKPRUs4KL/
hxxp://hsweixintp.com/wp-admin/3c2etiFC2RwmHfTS/
hxxp://intolove.co.uk/wp-admin/FbGhiWtrEzrQ/
hxxp://isc.net.ua/themes/3rU/
hxxp://kabaruntukrakyat.com/wp-content/B9oJ0jh/
hxxp://laboritm2022.scienceontheweb.net/css/RoMZndfiNHp/
hxxp://linhkiendoc.com/app/payments/qoy5JqpLqrbsKl/
hxxp://ly.yjlianyi.top/wp-admin/NRAdJ/
hxxp://mulmatdol.com/adm/Fa/
hxxp://navylin.com/bsavxiv/axHQYKl/
hxxp://nlasandbox.com/facebookpage/JFqg2Aqkl3UPZi6xGz/
hxxp://ruitaiwz.com/wp-admin/sV1NeVxLDiHJ1xm/
hxxps://aberractivity.hu/iqq/Dmtv/
hxxps://akarweb.net/cgi-bin/fWWuTf6mddh6Idq/
hxxps://akuntansi.itny.ac.id/asset/9aVFvYeaSKOhGBSLx/
hxxps://aldina.jp/wp-admin/YvD46yh/
hxxps://amorecuidados.com.br/wp-admin/t3D/
hxxps://anamafegarcia.es/css/HfFXMTXvc40t/
hxxps://andorsat.com/css/5xdvDtgW0H4SrZokxM/
hxxps://aprendeconmireia.com/images/wBu/
hxxp://sat7ate.com/wordpress/ZAf5j4MG8Hwnig/
hxxps://atlantia.sca.org/php_fragments/D8Nwm2F80BL4s/
hxxps://audioselec.com/about/dDw5ggtyMojggTqhc/
hxxps://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/
hxxps://geringer-muehle.de/wp-admin/G/
hxxp://sourcecool.com/throng/iOD/
hxxp://sourceintership.com/vendor/rZnJL9pPUjA9pU/
hxxp://swiftwebbox.com/cgi-bin/vNqoMtQilpysJYRwtGu/
hxxps://wijsneusmedia.nl/cgi-bin/DvxmZndf0/
hxxps://www.alliance-habitat.com/cache/lE8/
hxxps://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/
hxxp://thuybaohuy.com/wp-content/u3MJwXSP9tmiaTCyZD/
hxxp://times.my/wp-includes/1OgxQPFaUhS/
hxxp://updailymail.com/cgi-bin/gBYmfqRi2utIS2n/
hxxp://voinet.ca/cgi-bin/RXDWHpi8dHHZf8/
hxxp://vourakilina.gr/6vtelq/Xo7C7m/
hxxp://webboxrep.com/cgi-bin/WSc3x09KmXuRK8Bpro/
hxxp://wordpress.xinmoshiwang.com/list/cRIH9Bd/
hxxp://www.3d-stickers.com/Content/Afa1PcRuxh/
hxxp://www.angloextrema.com.br/assets/mQVRrHu7o0eJXxTFu/
hxxp://www.aymanwahdan.at/seite/FAeyew9/
hxxp://www.campusconindigital.org/moodle/LumMe/
hxxp://www.darularqompatean.com/asq/IcVMFfwR65Yf8fMd5G/
hxxp://www.detertecnica.com/var/azLISfW/
hxxp://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/
hxxp://www.mountaineering.org.tw/jp.bad/WWhvAMebz5qT/
hxxp://www.muyehuayi.com/cmp/Vtm2m7z88g/
hxxp://www.spinbalence.com/Adapter/moycMR/
hxxp://www.stickers-et-deco.com/Adapter/lYw/
hxxp://www.thebeginningstore.in/0202498070/m2x8inU7TSiuO3px/
hxxp://www.tugarden.com/docs/csv_import/rf6bMPAtbBPiDK/
hxxp://www.vinyz.com/admin3693/BDFFgAZ6zBRumcUSG/
hxxp://yesdeko.com/app/yTjFWTnDxio/
hxxp://yuanliao.raluking.com/overemotionality/Vfc9v1ebcmaEguw/
Additional IOCs shared from the community:
>> Courtesy of Jeremy Scion (Veepee.com) November 4th
hxxp://anguklaw.com/microsoft-clearscript/oVgMlzJ61/
hxxp://intolove.co.uk/wp-admin/FbGhiWtrEzrQ/
hxxp://isc.net.ua/themes/3rU/
hxxps://aldina.jp/wp-admin/YvD46yh/
hxxps://andorsat.com/css/5xdvDtgW0H4SrZokxM/
hxxps://audioselec.com/about/dDw5ggtyMojggTqhc/
hxxps://geringer-muehle.de/wp-admin/G/
hxxps://www.alliance-habitat.com/cache/lE8/
InQuest File Detection and Response (FDR) solutions protect your end users from the myriad of attacks of today and the evolving threats of tomorrow. Email, web, API, network. At-rest, in-motion, in-use. Complete file protection.
InQuest Labs is an open research portal providing infosec analysts with access to file samples, threat intelligence, and tooling in a crowdsourced effort to unearth novel threats and generally poke bad guys in the eye.