#BANLOAD IoC 20190627 ----------------- Received: from vm.oabpe.org.br (unknown [198.136.56.252]) Received: from [179.104.151.122] (port=49905 helo=DESKTOP-9OIBDPR) From: [email protected] Date: 25 Jun 2019 09:56:05 -0300 Subject: Tax receipt submission ref-**** Data: 25/06/2019 Received: from webserver02.floripa.com.br (unknown [187.49.226.10]) Received: from [179.246.63.229] (port=57661 helo=DESKTOP-6AA08KF) From: [email protected] Date: 25 Jun 2019 21:15:46 -0300 Subject: Tax receipt submission Data: 25/06/2019 Received: from br1.ensite.com.br (unknown [187.17.160.13]) Received: from [2804:18:481a:9bd9:bd46:69e:60ad:a5b1] (port=59040 helo=DESKTOP-6AA08KF) From: [email protected] Date: 25 Jun 2019 22:15:14 -0300 Subject: Tax receipt submission Data: 25/06/2019 Received: from vps.midialagos.com.br (unknown [162.241.36.77]) Received: from [191.27.85.15] (port=56847 helo=DESKTOP-6AA08KF) From: [email protected] Date: 26 Jun 2019 21:11:39 -0300 Subject: Tax receipt submission ref- ********** Data: 26/06/2019 Received: from vps.dec9.com.br (unknown [162.241.134.169]) Received: from 44.ip-51-91-56.eu ([51.91.56.44]:60426 helo=WIN-6BQ8HFCGDCA) From: [email protected] Date: 26 Jun 2019 17:17:17 -0700 Subject: Tax receipt submission ref-********** Data: 26/06/2019 Received: from cliente1.ensite.com.br (unknown [187.17.160.7]) Received: from [191.27.85.15] (port=59084 helo=DESKTOP-6AA08KF) From: [email protected] Date: 26 Jun 2019 22:35:39 -0300 Subject: Tax receipt submission ref- ********** Data: 26/06/2019 Received: from sda117.playunix.com (unknown [177.53.142.228]) Received: from 44.ip-51-91-56.eu ([51.91.56.44]:53050 helo=WIN-6BQ8HFCGDCA) From: [email protected] Date: 26 Jun 2019 19:06:51 -0700 Subject: Tax receipt submission ref-********** Data: 26/06/2019 Received: from mg.britania.com.br (unknown [189.2.203.70]) Received: FROM [email protected] (191-27-85-15.user.vivozap.com.br [191.27.85.15]) From: [email protected] Date: 27 Jun 2019 00:01:42 -0300 Subject: Tax receipt submission ref- ********** Data: 27/06/2019 -------ADDITIONAL_EMAIL---------- [email protected] [email protected] [email protected] [email protected] -------OBSERVED_URL---------- Initial destination http://unbouncepages.com/comprobante-ref0012/?***** http://199.192.29.182/Folder/Downloader.php?**** PowerShell script http://51.75.142.21/l2406/uk/kk/20938092830482 http://51.75.142.21/l2406/uk/al/20938092830482 http://51.75.142.21/l2406/uk/nn/20938092830482 http://51.75.142.21/l2406/uk/pz/20938092830482 Malware (all on anyrun) http://51.91.248.86/uk/M2406/kk/md.zip sha256 d3f80b7d6f4812634d9c9e04f787059a0143b7c952bc564ec01a5b5fd3537e5a sha1 1cbc0151175d76889af4453dccb2a80c1d4dc2e8 md5 9ab7eeb6ef2c6a5fcc24572474dd8dc3 http://51.91.248.86/M1106/al/md.zip sha256 742ecf7b71060e0b422632225712e394950a36d296e67f910bf9c4673aa66801 sha1 9c47bbdf1e9209b2a3a8383d8e8a74ac672cccc3 md5 6764d481442d801167012f7681fb113b http://51.75.142.21/M2406/nn/md.zip sha256 4f7ee2f0b15e8c78849483a2a14bca4037c5b67e3f0759bb687b6af7b148fb5f sha1 1f444c2667dbee0c3689bf10d8036b9d39bc8902 md5 c4ce00751f365ccc984ff647d8bf0248 http://51.91.248.86/M1106/pz/md.zip sha256 b3b873184cb37b118d807669a992140667dc961828ca909411945c70512e6a17 sha1 c488185479c4ba8e5430e6e8ba42af1b0de668a2 md5 f8f07fc4560ce3e7222fc763a523b9f9
Comments