#emotet 20180924 - 23:00 BST

new #emotet EXE set (9/23/2018 21:57:00) to urlhaus

http://kulikovonn.ru/l5vT7q19U
http://montegrappa.com.pa/OkyoMANm
http://optics-line.com/vUUp9ygDE
http://lonestarcustompainting.com/BLC3RY4O
http://kristianmarlow.com/mhFm2oA4Q

DOC - https://app.any.run/tasks/fb84be71-5512-4cf0-943d-5ea88f67e690
EXE - https://app.any.run/tasks/e9f5b922-d76e-4e05-a3b2-e8232a2a15ac

C2
http://95.6.64.119:8080/
http://187.193.161.58:8080/
http://201.242.55.19:8080/
http://77.86.23.44:8443/
http://100.17.27.26/
http://148.245.232.121:8443/
http://96.64.183.227:8080/
http://96.242.246.128/
http://133.242.208.183:8080/
http://201.244.125.210:53/
http://70.184.148.77:20/
http://71.45.208.246:8080/
http://139.162.237.94:7080/
http://178.63.118.195:8080/
http://139.59.242.76:8080/
http://69.70.248.98:8443/
http://190.189.12.16:8080/
http://217.13.106.203:4143/
http://220.253.68.95:8080/
http://49.212.135.76:443/
http://96.23.80.242:50000/
http://198.199.185.25:443/
http://203.198.129.4:8080/
http://104.236.24.85:8080/
http://210.2.86.94:8080/
http://37.120.175.15/
http://181.123.205.219/
http://72.50.72.164:22/
http://200.105.149.226/


----

new #emotet EXE set (9/24/2018 07:37:00) to urlhaus

hxxp://omlinux.com/EjgPh
hxxp://spectrumbookslimited.com/SawGapld
hxxp://circuloproviamiga.com/wp-content/themes/5Db8XGz
hxxp://www.ultigamer.com/wp-admin/includes/QV0VCt
hxxp://supermercadoyip.com/R

DOC - https://app.any.run/tasks/97a0d1e8-070f-48dc-bea8-b230d540d85b
EXE - https://app.any.run/tasks/4157e685-1332-44d6-9dbf-2ca09de02f40

C2
http://115.47.147.24:8080/
http://73.51.79.185:8443/
http://78.187.122.37:8443/
http://108.166.150.58/
http://38.29.209.76/
http://175.136.149.221:8080/
http://76.182.36.8/
http://54.37.77.86:8080/
http://210.215.155.44:443/
http://97.87.198.18:8090/
http://54.39.176.22/
http://113.193.217.34/
http://71.94.35.102/
http://159.69.2.128:7080/
http://81.215.192.201/
http://95.141.175.240:443/
http://106.187.52.135:443/
http://146.185.170.222:8080/
http://204.29.213.242/
http://12.139.45.113/
http://84.200.106.120:8080/
http://75.140.48.194:465/
http://211.115.111.19:443/
http://199.119.78.9:443/
http://216.215.112.198/
http://199.119.78.23:443/
http://118.244.214.210:443/
http://174.67.38.138:8090/
http://153.122.38.158:443/
http://185.97.32.6:443/
http://78.47.182.42:8080/
http://69.198.17.7:8080/
http://217.174.206.181:443/
http://24.116.195.92:8080/
http://222.214.218.192:4143/
http://157.7.164.23:8080/

----

new #emotet EXE set (9/24/2018 10:51:00) to urlhaus

http://peekaboorevue.com/0B5WOLOKFg
http://atgmail.net/Jj6SClPro
http://krever.jp/njwxGImMd
http://gabrielamenna.com/RLDjDvQJw
http://desnmsp.com/oEdTUUscJA

DOC - https://app.any.run/tasks/de128dc6-e351-4807-b357-46d14b859707
EXE - https://app.any.run/tasks/e760830a-1e23-45ec-9f91-39d699229d4b

C2
http://128.193.56.47/
http://24.14.188.26/
http://189.210.142.250:443/
http://189.252.25.74:8080/
http://183.82.101.39/
http://190.110.217.70/
http://187.188.45.145:50000/
http://207.134.145.72:443/
http://186.68.94.62:443/
http://95.6.64.119:8080/
http://139.162.237.94:7080/
http://133.242.208.183:8080/
http://139.59.242.76:8080/
http://217.13.106.203:4143/
http://200.85.46.122:443/
http://201.244.125.210:53/
http://71.45.208.246:8080/
http://96.23.80.242:50000/
http://181.123.205.219/
http://187.176.67.240:443/
http://49.212.135.76:443/
http://190.189.12.16:8080/
http://37.120.175.15/
http://203.198.129.4:8080/
http://210.2.86.94:8080/
http://200.105.149.226/
http://178.63.118.195:8080/
http://69.70.248.98:8443/
http://104.236.24.85:8080/
http://198.199.185.25:443/
http://220.253.68.95:8080/

----

new #emotet EXE set (9/24/2018 16:45:00)

HTTP/HTTPS requests
http://www.capreve.jp/mv338Rs
http://raidking.com/EVuurgG
http://optics-line.com/MCwej9Q
http://montegrappa.com.pa/hnAvza7
http://atuare.com.br/UiWyojIN4g

DOC - https://app.any.run/tasks/c47c0684-3059-4173-be39-3f69df2006b5
EXE - https://app.any.run/tasks/86b52725-7ccc-4213-8711-c28ec60ef21e

C2
http://24.14.188.26/
http://128.193.56.47/
http://189.210.142.250:443/
http://207.134.145.72:443/
http://189.252.25.74:8080/
http://190.110.217.70/
http://187.188.45.145:50000/
http://183.82.101.39/
http://95.6.64.119:8080/
http://186.68.94.62:443/
http://139.59.242.76:8080/
http://139.162.237.94:7080/
http://133.242.208.183:8080/
http://217.13.106.203:4143/
http://201.244.125.210:53/
http://181.123.205.219/
http://96.23.80.242:50000/
http://200.85.46.122:443/
http://190.189.12.16:8080/
http://49.212.135.76:443/
http://71.45.208.246:8080/
http://37.120.175.15/
http://187.176.67.240:443/
http://220.253.68.95:8080/
http://198.199.185.25:443/
http://203.198.129.4:8080/
http://200.105.149.226/
http://178.63.118.195:8080/
http://69.70.248.98:8443/
http://210.2.86.94:8080/
http://104.236.24.85:8080/

----

new #emotet EXE set (9/24/2018 20:59:00)

http://websitedesigngarden.com/e6vTCit
http://emicontrol.com/85a
http://grupoembatec.com/zHVN
http://w-maassltd.co.uk/il
http://geotraveltours.com/plV0mt

DOC - https://app.any.run/tasks/1692601c-4321-4de0-a1e2-d5cc3143b338
EXE - https://app.any.run/tasks/7edc2f5c-3c1a-46cc-9900-1b5327b41fcb

C2
http://108.166.150.58/
http://78.187.122.37:8443/
http://73.51.79.185:8443/
http://38.29.209.76/
http://175.136.149.221:8080/
http://76.182.36.8/
http://54.37.77.86:8080/
http://97.87.198.18:8090/
http://210.215.155.44:443/
http://54.39.176.22/
http://159.69.2.128:7080/
http://71.94.35.102/
http://115.47.147.24:8080/
http://113.193.217.34/
http://81.215.192.201/
http://95.141.175.240:443/
http://146.185.170.222:8080/
http://12.139.45.113/
http://84.200.106.120:8080/
http://204.29.213.242/
http://106.187.52.135:443/
http://75.140.48.194:465/
http://216.215.112.198/
http://199.119.78.9:443/
http://211.115.111.19:443/
http://199.119.78.23:443/
http://118.244.214.210:443/
http://185.97.32.6:443/
http://153.122.38.158:443/
http://217.174.206.181:443/
http://78.47.182.42:8080/
http://24.116.195.92:8080/
http://174.67.38.138:8090/
http://69.198.17.7:8080/
http://222.214.218.192:4143/
http://157.7.164.23:8080/