2018-02-12 & 2018-02-13 EMOTET IOCs

DOC DISTRIBUTION:
hxxp://anhbanghd.thememoi.com/UPS-Express-Domestic/Feb-12-18-04-37-56/
hxxp://ats-arabiantravel.com/587-96-963622-078-587-96-963622-985/
hxxp://biotecnologiaaldia.es/UPS-Express-Domestic/Feb-12-18-06-29-19
hxxp://detskaya-mebel-sonya.ru/Sales-Invoice/
hxxp://dr-woelfl.de/Invoice-for-you/
hxxp://fonngroup.com/Sales-Invoice/
hxxp://haslund-olst-kirke.dk/Past-Due-Invoices/
hxxp://hdanielflors.com/Question/
hxxp://hotelsuescun.com/Paid-Invoice-Credit-Card-Receipt/
hxxp://hsg-schoenbuch.de/Invoices-Overdue/
hxxp://hzistiran.com/Invoice-for-you/
hxxp://il-biscione.de/Invoice-86105812-February/
hxxp://lcmagalhaes.com.br/Invoice-t/h-February/
hxxp://mudanzashuelvaramirez.com/Invoices-attached/
hxxp://riverfallslaw.com/Invoice-for-t/c-02/13/2018/
hxxp://stumptowncreative.com/Important-Please-Read/
hxxp://tappol.pl/Tracking-Number-3X38066463693270/Feb-12-18-05-22-21/
hxxp://vesterlins.se/Past-Due-Invoices/
hxxp://www.52meifeng.com/Question/
hxxp://www.avrupakarolaj.xyz/UPS-Quantum-View/Feb-12-18-04-58-06/
hxxp://www.california-rehab-directory.com/UPS-Quantum-View/Feb-12-18-06-21-46/
hxxp://www.grosirateka.com/Paid-Invoice/
hxxp://www.iglesiacem.com/ACH-form/
hxxp://www.noticias-cristianas.org/UPS/Feb-12-18-05-40-16/
hxxp://www.rolleta.od.ua/Document-needed/
hxxp://www.studioingrenatolunelli.it/Document-needed/
hxxp://www.taxila.co/ACH-form/
hxxp://www.tianfubio.cc/Invoice/
hxxp://www.topdogafrica.com/wp-content/Invoice-Number-670560/
hxxp://www.tvpackage.deals/Invoice-receipt/
hxxp://iprimicristiani.com/ACH-form/

DOC(S) DELIVERED:
9dd2eeb8e19cc4fc51641fb8b4356d52
e3b01e57c810dfdefc08e93b5131438d31ef4108834cfc11a6f6fd9b44a1f0ab

b64546e52401a78e316c07cf2288959d
8ff51b8a6823376dc08b13467f0382782f77b77f0a8d1fd27bee2a6d854dcdd4

19c148b3aa47e5961b1463e1d3642e63
2500ed517291c0cae28bbaf329acf732ae8b07b2652001e92441936847488e48

d0247ac392bb756d33303ac94d551272
2dffd9b326bda42aca5c5e1473c63fbca0263202b214bf109ca0d7b379c9fe8b

616ffd723dd5729b19fb0936175a51ad
6c81a06228b68121daed85eeaff04fea88620dc3681ebe6ec34494b279ae8acb

8db1ba9a69900fa73f7a020291d533ba
93f2f1c385dcfbbf2613b413f64764c6fb480905bbb5240b98c69b0f8e24dd60

4169e0770526b833e39a053ef8b26dd0
206d6c776df4d148e01dd89f5ac8d52d83edbb0bccd6aab4c0fad5ec6618b3c1

PAYLOAD DISTRIBUTION:
hxxp://bergindepolder.nl/EAQ6Y/
hxxp://dorschdi.com/ly4Iv/
hxxp://mylandlove.com/GEfWNrr/
hxxp://sportid.net/02wdi/
hxxp://test.magnumsport.com/k1u6dtw/
hxxp://tourspacegeorgia.com/avt2BFL/
hxxp://valenciainvest.com.br/j9r7LSG/
hxxp://www.baby-glamour.de/oDVrTu2/
hxxp://www.enjoyexotictrips.com/uRdX3d7/
hxxp://www.hopadilida.ro/0LCTG2/
hxxp://www.rangeloproductions.com/NP4gK/
hxxp://www.sbktravel.com.my/MoGJD/
hxxp://www.suacuasat.vn/UpRVLy/

PAYLOAD(S) DELIVERED:
94b60356e80edd2c1997060513e82c2d
960855f18e6e6ac36dbbd6262baf704a9dc790faf49596981a6402479fd0a892

a9133f0366ee1d0521e290c1c7db723a
83f8421f5e1e800cd1a822797a0c77317a9f3ead827bf1a86e32fb9568d9019c

4378e3629087b8cf8d5d224d43c08f65
52436172f4de94d09b95d3dad45043c28bd835da741c27e9cf1d87a44c516f6a

6f3fe52b43414f8515e268c67ca33669
763e07102b5564b24468796ce06c732adbfac304321cdf51c0d9fb8b6cbf74cf

700f422cc48fa669aa53ce967486c6f1
503d809dbfb9c6e5c663d23cb4b92cd0f7a55524075cab4176906db84ac577f1

117ec2b318abe7f4c047d2114ed1ac50
660753972cda178e024db4b217934b353cbae33fb2907babc9504729609a1a4e

d0247ac392bb756d33303ac94d551272
2dffd9b326bda42aca5c5e1473c63fbca0263202b214bf109ca0d7b379c9fe8b

dbd86d5e1f69d339996e15465fe4fb8f
3b2a1ba664e71cbd45f76339a9cb45b319d1faea631f580020b2515afa5c2c80

9dd2eeb8e19cc4fc51641fb8b4356d52
e3b01e57c810dfdefc08e93b5131438d31ef4108834cfc11a6f6fd9b44a1f0ab

C2:
hxxp://84.200.208.98/
hxxp://71.244.60.231:4143/
hxxp://193.169.54.12:8080/
hxxp://186.103.199.252:4143/
hxxp://71.244.60.231:4143/
hxxp://37.187.57.57:443/
hxxp://104.130.204.251:80
hxxp://37.187.57.57:443