API tools faq
paste
Advertisement
jroosen

Emotet Malware IoCs for 2019/10/16

jroosen
Oct 17th, 2019
2,792
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 62.87 KB | None | 0 0
raw download clone embed print report
  1. ## Emotet Malware Document links/IOCs for 10/16/19 as of 10/17/19 01:45 EDT ##
  2. *Notes and Credits at the bottom.* Follow us on Twitter @cryptolaemus1 for more updates.
  3.  
  4. ### Document Downloader Links ###
  5.  
  6. #### Epoch 1 Document/Downloader links ####
  7. ```
  8. http://adonis-negar.com/wp-admin/Amazon/En/Orders_details/2019-10/
  9. http://antsmontessori.in/wp-admin/Amazon/EN/Transaction_details/102019/
  10. http://avis.life/thumbnails/Amazon/En/Transactions/2019-10/
  11. http://castalv.com.mx/blogs/AMAZON/Clients_transactions/102019/
  12. http://domainresearch.site/wp-admin/AMAZON/Clients_transactions/102019/
  13. http://doypack.net.pl/wp-content/Amazon/En/Information/102019/
  14. http://dtj.com.vn/wp-content/Amazon/En/Transactions-details/10_19/
  15. http://gebrauchtwohnwagen24.de/wp-content/Amazon/En/Details/2019-10/
  16. http://i5t.ir/wp-admin/Amazon/Clients_Messages/2019-10/
  17. http://internetordbogen.dk/cgi-bin/Amazon/En/Clients_transactions/102019/
  18. http://iranmadan.com/rdwfl/Amazon/Clients_Messages/10_19/
  19. http://kursy-bhp-sieradz.pl/pub/Amazon/EN/Transaction_details/102019/
  20. http://minemoore.com/wp-admin/AMAZON/Details/102019/
  21. http://noithat168.vn/assets/Amazon/En/Clients_Messages/102019/
  22. http://sgnr.in/dietitiansakshi/Amazon/Transactions/102019/
  23. http://sozvezdie.sgu.ru/wp-content/Amazon/Clients_information/10_19/
  24. http://tessblomportfolio.nl/wp-content/AMAZON/Clients/102019/
  25. http://test2.hunterxx.com/wp-includes/Amazon/En/Orders-details/2019-10/
  26. http://theamericanaboriginal.com/class.popular/Amazon/En/Attachments/102019/
  27. http://tomasoni.ind.br/dashboard/Amazon/En/Transactions-details/10_19/
  28. http://trungtamdayhocthaonguyen.edu.vn/cgialfa/Amazon/En/Transactions-details/102019/
  29. http://usad.sytes.net/usad/amazon/details/102019/
  30. http://vls-online.de/ab2ffb56648fc08f89197ae37a33a579/Amazon/EN/Payments/102019/
  31. http://weidling.com.bo/CatalogoWeidling/Amazon/En/Clients_information/102019/
  32. http://www.mobileheadlines.mobi/wp-content/Amazon/Payments/2019-10/
  33. https://aideah.com/address/Amazon/Orders_details/10_19/
  34. https://aideah.com/address/AMAZON/Payments/10_19/
  35. https://dakotv.online/wp-admin/Amazon/En/Payments_details/2019-10/
  36. https://dibarcellona.it/tropcj8kfd/Amazon/EN/Transactions/102019/
  37. https://diezeitinsel.de/wp-admin/Amazon/Clients_transactions/2019-10/
  38. https://drovus.com/wp-content/Amazon/Clients/10_19/
  39. https://ecotech.wegostation.com/yf92/Amazon/EN/Details/2019-10/
  40. https://ghpctech.co.za/cgi-bin/AMAZON/Information/102019/
  41. https://happyfava.com/Fb/Amazon/Details/102019/
  42. https://i5t.ir/wp-admin/Amazon/Clients_Messages/2019-10/
  43. https://jailaxmidigi.com/y0k0/Amazon/EN/Transactions/2019-10/
  44. https://phamthaifood.com/4ib60l/Amazon/Orders-details/10_19/
  45. https://taxisieradz.pl/wp-includes/Amazon/Transactions/102019/
  46. https://womenslifestyle.co.za/wp-admin/Amazon/Attachments/10_19/
  47. https://www.mxsii.com/wp-content/Amazon/En/Payments/2019-10/
  48. https://zin.com.vn/wp-includes/Amazon/En/Orders_details/10_19/
  49. ```
  50. #### Epoch 2 Document/Downloader links ####
  51. ```
  52. http://bluecrayonconsulting.com/if7u/GjDPcdCwXkkNslRcCCJwroZdRuVrdm/
  53. http://doubscoton.fr/ghana-visa/fapigpcxajzexv/
  54. http://echoxc.com/wp-content/ezz1hnj7vlk41ai5i28pkqb8eironillckl4e6/
  55. http://fanalwriters.com/cgi-bin/x3e8rvi79heio62re/
  56. http://ftk.unsada.ac.id/u8uu/ru046mehrv3m1x6ufa4iblgokynts0eyfc38eo/
  57. http://homeconcept.rs/cgi-bin/kf5is9fl37n0lo7ddczwx2oxd/
  58. http://infinite-help.org/blogs/uuw3a2dqi4y4e9lts/
  59. http://mododimarmi.co.uk/balloon_lib/5630dcudhqdpepof3hwh6nhwhq1qlkp222/
  60. http://nucleitech.co/cgi-bin/hapllbfq4h2ow26z6pufhxtj/
  61. http://pandajj.jp/mobile/u7uo2wgjrrriurf2813wntl14t/
  62. http://phukiennhabepgiare.com/asgypk/sklsdbzy202mcb/
  63. http://propase.de/bia/SdSLXJuUwuNru/
  64. http://quangcaogiaodich.com/wp-content/upgrade/xgzh62p8cavq8mkb/
  65. http://resenderocha.com.br/Antigo/bkp_resenderocha.com.br/httpdocs-19-09-14/Backup/sstmj3ki3ay3q623mz/
  66. http://vencury.com/wp-includes/bypz06s0cpojqzdhq2h386dd018n4k633/
  67. http://www.computerservicecenter.it/wp-content/ggl5odmqj8118aclyyjygf0mbkhcts1/
  68. http://www.fanalwriters.com/cgi-bin/x3e8rvi79heio62re/
  69. http://www.thebloodhandmovie.com/4f1wvc8cql/aGVSsdeXvA/
  70. http://www.uk-scholars.co.uk/tmp/JUfUimFF/
  71. https://6-milescoast.vn/wp-content/s7rfibr3s3jbyrl30/
  72. https://abelincolnplumbing.com/sitemap/lph4cp3uhcerg4eyyfuj8wshre/
  73. https://decorstyle.ig.com.br/wp-content/languages/cAYciQWuiFGdqx/
  74. https://homeconcept.rs/cgi-bin/kf5is9fl37n0lo7ddczwx2oxd/
  75. https://integralmakeup.com/blogs/5epbb5lije9k5lkyp/
  76. https://mimaarifsumbersariunggul.com/tipskeluar.ga/0n8wfvk3ymnb946y4gbsnre6p/
  77. https://mododimarmi.co.uk/balloon_lib/5630dcudhqdpepof3hwh6nhwhq1qlkp222/
  78. https://www.fanalwriters.com/cgi-bin/x3e8rvi79heio62re/
  79. ```
  80. #### Epoch 3 Document/Downloader links ####
  81. ```
  82. <none>
  83. ```
  84.  
  85. ### Payloads per Epoch by Document ###
  86.  
  87. #### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
  88. ```
  89. Creation Time 2019:10:16 19:27:00 (Attachment Only - Doc based - Activation Wizard)
  90. SHA256:
  91. 65c3dd5f7ce5db9b88688af1ed18430bcd7904ae13718c196c68a09816f55e99
  92. 5fdd4dea8ef4774a2973120db27fc04eb5aed4b73c7facf790748d3443afee87
  93. 084a58885332b475d65e42463227f45b67b86ecb67d8eef976fbc1934f721993
  94. d04bd4920dab3584e3b841c298dcf06cdc796b6dc4adad4eff985114e4310b87
  95. c951ff09e00d293e220424246f75bb6847a8b7c8c8ce9b2e5a9545fd80072d8a
  96. 42c26e497cf6219a523fb53dbbe260f6b9b6a864f935332d10d202d41263d286
  97. 7c4a072c4caf0b4b216ef0ae257c44177aa58d5391d69a11b9edf9c2a2c57a7f
  98. 5722f8d739afb47845aed941d30e9216e1ad27a8275434b0625c61a9b82d6338
  99. 2525e2bd32f9b50211ac6d07f49b9ae5f325dcea831b75383512e2008f1409e9
  100. 6c4cd3e9207deb35e13d091a5b88d16953293965a7e2c1ba1a34481416c3405c
  101. 19ef0a90da055aad9e574b1e968c4f06e02b1f48bb79ef396c9e494c19ba8848
  102. 6b558206510c7186960148d94f941f999a5e410e9674ee7061054949574840d0
  103. 77965cc7b31feca16087e98c1f380502ea8d76f5dca3a7451567eab38beb4bff
  104. f5a8ea0537768af5ceda1616dba8b6cc5076b957347e18bfcda5ff91e70e1796
  105. 367af7cc31805da4e3cec362a53fec387a46b17bbdc4865949c661769cb30062
  106.  
  107. https://barirahb.com/wp-content/kewm6p6/
  108. http://www.vardancards.com/bu6oo37/48409/
  109. https://desertskyvacationrentals.com/thickbox/zbbbdi2/
  110. http://beauty-fullbox.com/35wl6i8jx/1h9y38/
  111. http://afimangement.com/directions/ezvyt0/
  112.  
  113.  
  114. Creation Time 2019:10:16 17:20:00 (Attachment Only - Doc based - Activation Wizard)
  115. SHA256:
  116. 7f0b01469adf22de915d7cc38bde5d239ee6308c6f609a94330199582bc4f1b1
  117. 1fe20ba8a44f92b5c92f671cadf36f6afb15539d4a1f09e6d6c0f68d1314517b
  118. f30996f2310cc43163696d9957126d14f5b24e630907181687454d630957d2d0
  119. 61cc397ab6ad7e4d5b5c9d07ad648f448acc473eca57d65dc3cee56998238a0a
  120. e9cb4cf22b1945f0c4eca43ab041ee513c71a1d57ee6a269b58c52f31137b38c
  121. d1c49eeb9e4350c4ebbd656ab9d6fa457c3a057b25755d41104854eb410081dc
  122. d3d0919a80cc46fba029eb2f331804b34ca4ac839f2291843d31a91912b516fe
  123. b9fab5e620ea5ec59c44a3872cafba4df29184c9575a24c2938652ab117853ea
  124. 3207b07d4dad052adf1f5447b56722f8a1a22186e5c49e3478d85be6766f0dfb
  125. 40c4beeaa000e872f1dda534948f075daf934fead512eba803296db0f591a598
  126.  
  127. http://pharm-aidrx.com/wp-admin/ot6561/
  128. https://bhoroshasthol.com/wp-content/8e117/
  129. http://www.projectolynx.com/p/gft60h704/
  130. http://kk1793.com/pkk7qh/p6g7y1194/
  131. http://kuliner.ilmci.com/wp-content/27f7319/
  132.  
  133.  
  134. Creation Time 2019:10:16 07:22:00 (Attachment Only - Doc based - Office 365 Light Blue)
  135. SHA256:
  136. b766a6248bed437ad2c0d2d2055c4a82928ee74cff88d230966d8b2100b8fc4a
  137. 8d2220048f9fa5cf1e3c7bb43dba8959516c194c1c9e4c2f1994d9be64c6dc33
  138. cc3772cfe5954f1c59f5be20293d734534edc6eeb4950d007de497bfebdede8b
  139. f1b2186b2ab24255e01802ea85e8ba6095fa66d501317aaea91414aed22e6fea
  140. fc747121685a6c566906c82a9f8b1d2cf213200a861550773d4b7bafacab3f02
  141. 02959cf996973f33ec758e015470ec1a1e2110a8cc6fdcd059d150c9b232b4bb
  142. 54718cd2bc913b768f2636ad0cb7133e1049422fa6268f6717ba6f74635adb48
  143. 22197653ce951cc0e8ce80aa01e02b59c46f49d7456b16566d1d08ed793097a3
  144. d69107dce42c4cda2ecba1747c37b132d0a3fc299ac45febd96d86cf71c7b0e7
  145. 2e5bf48b5671d8f82be548ab0c9bb951ee591abaa51fb1a6ee3085e2bf8ef381
  146. b705b431d50d762c2b7f7cfb59e263cb4eae36a7a66ee2f8e807d04158ce0130
  147. b4bad626fccc04d3132b0bb47a8df1d619a6f2fa73608029224d83ca97a69fe4
  148. f5516b7a53a843f2555b2b71e14ca6cb85c60574d166a424a90dfe4682290b81
  149. 3d27850b2d61c2cade907ec4eac0d6e4c2ab7cc563aeb4cb9f5f41a9568edb23
  150. 84278b1c6e871587613320552b95a44fbfacb263c2ad08c86905a4fe59a95ed2
  151. d4ed786dd07dccec1d0944e3233d47627835fec0689e1c4228d4887eebdee7cc
  152. 519af6f843508765c264ef6ccc8381315fd586b39a3438459e4bcb371dad169d
  153. 953560016ec03355339dc1bdc6395603d7878eda41c71d2fffbc3fd71bedb5fd
  154. 4119ad4a0d4da1bfd4bc7aafa245505153a9091efcbaeaf82a02a4ca795ffb7e
  155.  
  156. http://timurjayaindosteel.com/wp-content/suqzjgt3871/
  157. http://gioitrerusseykeo.com/wp-content/81q8053/
  158. https://insideiost.com/is32htu/zbmm4323/
  159. http://supremesaadiq.com/wordpress/uf7kz53/
  160. http://kelseygouldie.com/cgi-bin/91ap40244/
  161.  
  162.  
  163. Creation Time 2019:10:16 06:33:00 (Attachment Only - Doc based - Product Notice)
  164. SHA256:
  165. 636553897561912f546d80d66b2b331b6a1d75e1437f68117ebabd3cf1a329cf
  166. 84f61bb97661641dcb52867577b761a3582ccd8333afd5d066241e27bbdc2b3c
  167. 5e3b730738ac4fade0befe4bbb06f586a2c0715f04a2529df4f3514ae8af5c32
  168. 0f82231a6865282349a30c4ae6a8de3ed8a07a4734fe6e908289e4e3b1158b41
  169. 9db72c54df449d89c6dddd8d3b2192ae5805106a313fbdaa5778aef7d328a10b
  170. d38a7caab0e7247ad678a7e99612b3925f7bf2b038eee52227cce214d09ce576
  171. f7df4126d9ae958be542583f0da746c4097bcc33b743a7af3896a3292de52282
  172. 85f32dad18040f449f4c7f44b18c9d5daee48697f41b73b902cafb7de809dd2a
  173. bbfcf034f3d5c4226ea17c24621c445dcff230ec88b7fd7cb584e379f09eb710
  174. af9ad0fc56d8bf4aaa5b9e22a6f610fe34c5af2747f60514cedbd692b646a4e5
  175. 781ed0cf7317951cfbb696a6780e58cec85ade8151752cf4276bbeb30a0875bd
  176. affc2f4e23f6c44b12f67ada74456462f39ff5aaea35ea5f94d56a73c087fc5a
  177. d4243a3f254e437f834609274b929077c88d2acdecbc32e595eda00e2cb12019
  178. c56d52e913e2b36bdf1b10cefb63fb297e266fd94153493af319ec8edf0ced99
  179. b09c4aea6ac02ee1d08163c8699b74a40ffba160b45d55b5abd011fc62491473
  180. a666ddd2a171863b96c97ef3b6e30439f74d1f6aceece9a7483cbcd946c990c9
  181. 38e99248b211afe492e15b9280f202872163ab8a2d9dc6ccdbc5d4c9715aa5c8
  182.  
  183. http://complaintboardonline.com/wp-admin/qekr3925/
  184. https://frazischool.com/wp-includes/ozi2y6740/
  185. https://sagarngofoundation.com/jxc5c/q54824/
  186. https://naturerepublickh.com/test/wvvqa9/
  187. https://watonlight.com/wp-admin/wa31628/
  188. ```
  189. #### SHA256s for Epoch 1 Payload EXEs ####
  190. ```
  191. 4f1d5519d9e7d900ff887b9977b430544b505c6266ea5f8029ebe7dd60c8e79f
  192. 513a61575b181d381a0adac2ec86efefa2621c7928dc013e652e719ba256ea90
  193. 379948779f39dc553e8627926591e50544aeb1e4b6dd59790e28ebc33493eeda
  194. e99c01545118def67b1f89cd941bce695d5aa627d64baa58a0231265debfc414
  195. 9f0a945cc0ff30484ce071472188663cadba7030b996391a74bce49c014436ee
  196. e8eb0ff0403ad804f0ae26d956fe4d5ce05a92c9746d8c7a2c1dbc5ece108d03
  197. 7b64b287b1153316afcf05df5fa65f2fd17c6a2b5a07ba9fac4834a253eb4de6
  198. 3e2d434f909621822044ea7537a731c5fe81e47d985e6019d557ba62e26f2e28
  199. c90871bbbec4ed5bff30ab395e4ab4fabb33f562aac0a56410b11c1498d89c04
  200. 90600c681309aafcf0af9f92d7d28005aac72edaa6388ddefd9a98e0bbbf81b6
  201. 8712309d09cd2338a75db717b86f7eea6ed2980e117fbc36609bfced0bff639f
  202. 2dbf7ad1dd27a16a721ddd0f17cf8ca8b5423ab09b45b37a1a57754698eed405
  203. f5ccc4d584b9fd0dafb28bc0683790659fdb49bcba722fc9819e04cddc06b719
  204. 9a37fdd27cb1816aa1b568b608fe82a36ac88db1b82119509bbc32e7f9652002
  205. 251edf43969a3630d66e392be371c107ab5641b1945bacef0e046dd0688d7a97
  206. 7f9e93c85066ee6d4fb004a0bee1c4627873746cabf5c9817b2e2e6f8f63d331
  207. 9580d226b453b406c9442509de09bbfca0895e6e372b3b18675cfa8c43eda568
  208. 9b7a2c3147512176bb385c5b4f439ba870e6270a9c8f66efd49136fc68d1a597
  209. 31283e85ae5579468d6abf940d74dd76a949053396d5b05f4493608ca4f15355
  210. 86143401c2640025c7b30bb8464a76ad27d3c548622a1bdea8b53db7dcc5e1e7
  211. 87db94064164c629ad184f15c2be6b9644ff7ebf4280a9a0a9abb5b2a1734cce
  212. 03ce3f14713218a35f9be687dd71bd71a3091be5337be7bcdd6ad5f1bbd06b90
  213. 6f6d378ca3c3e16a23fa675e59a087ae19769c6236f674eef397c19f44eed4dd
  214. 51cbe368e45a5da02d4723762677da75bd30c28f7bf8756a06311b7db654127c
  215. 703f4fbcf3bbf8e0f1c3132036c78e53a5bb6d2113fff46855adfa57fb86e6ed
  216. c952447e89eb5f05030eb32297fa32c86a7df135501a1489393d29d1237d0427
  217. e809c11124031db9e7f0d1ad50ae8dc6b03cb9d77e75f10457929eea17a5c344
  218. fae4caff4e43df56a6f6e8f97fb51420823989d6cc33f479e2256e3dad7c2892
  219. 7289b675c99dd406135603183394fc83a5c3a9f08b22826a6e6f3e05557b7349
  220. 8ab5c5e014d36a4421f71ad2b231fcfb44b6be6c71e7b9be02baab79eadd30b4
  221. 551458e1d3a923fda10e4f6515eaad2c052cb994e448fd109015783b8e08527c
  222. ee9c6a948e18cf71d6dbbcf183e1f27e9f52f379dd318d95f7f49a60f101cd36
  223. 76b4123a2eff380203c406c28361e78e28208e7a0eba860c51610b18690a5262
  224. 6f69b2b123ca136dd5355d2b01bdb8e2691a16e0385b7c00cf25ad90079d12e2
  225. f55cb278b4558b5e174034472901b253618ee444617ae00b6f77b455179edee8
  226. b8dc848b0f56db1c66a836c15e918aed812b0a48718d53980547736b919cade5
  227. 183e696849979536adfa829629bbb11080a47e372140d7ded4093d45ba98fe25
  228. 62a462ecbad4431290876006d11dba572c2b43a6462effa9bbddda0a276c0abb
  229. 62a462ecbad4431290876006d11dba572c2b43a6462effa9bbddda0a276c0abb
  230. 2921469462775da2803809620e2321c0abefcca72e6bff347b8ea0c6a23dfe14
  231. 7a37a4018a6bf49602bf3eb6cfdc3f2f4456c80d117260f6429f365dd3aa508b
  232. 662b28cecd0ca4d2f2bef27c210d3492da85764c0a6afd66964caeb9e1549225
  233. 683fa61608bc8c257b2a5198aa8a435c77b1a02304abfbabb280ae988ed90c65
  234. 34e3f938695dfdaa98fabee8f053f7b318a54ce507cfb32b7137f633251433a3
  235. 78bb5502a888b426c3da8f67e2d0e3e148665bd90fd7dcd2cbd1eaea8ff56fc9
  236. 4ff8aa72eafe9a973440de8eb5907f3262038f6d82d7cd5c07c6428608d9f6ac
  237. 8b85faeb1996d0247bf5454341181a5e4f539d65361ec05228bd5ae919740499
  238. bf58b966cf3dacc2386de5432f9c305bda11aa2411a176bc23a21449221a179f
  239. e9c7f05199802d400968e57550fbd95431559484c5c906a967926d036f0efab2
  240. 40a4135b54149f01de1752678a5b624a6641439981b8d975d08e3269c4bc7378
  241. f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b
  242. 0c6856553d81ab2c73b9136cc3ea46d13216c23880def8eaa2820a5a4c252b16
  243. 5ed2bd64262123fc0c0a7be32dea0a4f9a81c1b91832a638f8757301de75a007
  244. 400e542832e57d4a29e60d2a09027d524d8b05e1554c12b93ed602c286f113ed
  245. 68d957c7a70f970ceeba97e7146c38979b044a24062583c20848783e5f112491
  246. b84ac3bed5602a694c0f57d6cd79624b34962dc4142dff0d0eee5a537a9d613a
  247. 84e8ce02b2ee95738d1f4716e53bc42b860b35aad7e04dcff93b8f6fa4c28dae
  248. 4bce582d8843b2601a6dce85f491f06ad9ba7a08cc0158405dd9b884dc46b3d3
  249. 2326d30db040f097713159511be19236cc9f5967135322d05792a1a947d4495e
  250. 9d8bea99ba332647fa5ef74bec2f5b594256cc2edd6b5054c6f09c1eb9e29a8a
  251. cc75d8c5654318eb011d072c7146bf5a900ab55872dbb6c79327ec6b96b29b38
  252. 5299ef3beec4f37f2bd985ab8f7f1495d613c1d9a19568706b0d4282eaee02a3
  253. 58e2b7fb00e4c62405c7a6705911452a4f49ef16b364ad47f48420138aba356e
  254. 58d2fa896ba9472fb5dd53a1c4afbc34a59985174a0cb71244c2eee48b8cc67d
  255. 1f6fc1b43e085d2fcf0d8d355f569a0a43ccb9bc7f7198fe1fe852b543e7d5f9
  256. e366d86e98c1fc1336f4da375cc2ab7126d3ebf68cd017830bfcbb83982ed37e
  257. 8e30623585ef8509be49980ed38b921582fd5213c2fd8e1de84349d91ed02d24
  258. 5963bd2b2803cea1a4dda649f078c169f49ef2ea8f088b27ca5a2b6f3d7fe510
  259. ebcd953e26d003f15a752a1b6488539dc323298e6f3905fa783bd4b860b0ed3d
  260. a6c3c2365535f38cb2b59ea8e65ea3063c6f80a906d7da780071489412665775
  261. d987a2aa1027fd484c18f117ae0b6ea3bdd9fb1e1521efc09e2a9a26c373d9a9
  262. 4425c2a760c4d4e1d3f72c16d34339ebc4bd3112162fa3fe11236fb3a61fb2c5
  263. 55db546bb44b930605536a2cfb22b7b65fd4037d5484da65a988e3c1e4f472e6
  264. 34b97388090fe4d3be5f9ca55f04bd6be275ef7c649574bd233bbe7b902c6972
  265. 530a55cbb27305f9d403d6dcb4630169f9d25f93e5345002bd0e9e13d3753732
  266. 812b89e2010c7512e00ee38e8a17909e2b62e5c84c2e2e934046bb9041fc7781
  267. c8fa972553a3f81d92376afd8b53ae1c54b3f500988228933cd941b393c3d7be
  268. 37024639deda719c694f0c485479c6913eb02213fb921236d215a69276dd76ca
  269. 01cede0377a77224aab8f8b9926b366c5a60fd39fcc392fe61d2dbf5a00f3a0f
  270. d9a577aa143a03c45d44160eaa67e1d8caefdc31e39e882a14678ca1d7f6c656
  271. 049017edc62f9603878977e784b74c62472bcea02b37091f24fca3347f447c06
  272. a719f1a8554f6c751644e946b39c64628e72564145be8d79c4a3a441db875891
  273. 26fa48403556397e0b60426a9d70ceafbdb61a4c4a6216199c683ef9df805deb
  274. 2b59063199600c091a553c1b7ebf6db59aec5e2be4b313f8e31f6ddf7e96931f
  275. 2389b23839386574a80be9a68dd572ef4ecc6876e796756e9a0cb0ca8d80cbe2
  276. 4178f1fac90d64e862c437ba638ce5d7e199b86d6b2e265e9669e879baed3416
  277. 6fd58868748d36f745b912cf4bd828f55951465f8055e4e0ac0372497875b26b
  278. 4d0c1361add36a6bc0fbd715a361c5c91d2691ce124b8902fd4fab29017d3fbd
  279. 553a4dc125ffe8c6d1510ee858b6966286f63dd4d959e293905b2ca249d6e92b
  280. 8026d419895c0cdfcdc06eb3859ed8e3016701833538088a368a8288f1952e02
  281. cd3463e0674fb5c36a5f82d6285add9c9e95a23652a368e94f984dd9939ecc8e
  282. 3e483a8a232fd14787b3cce8c6c62344e30762030c5104eab2b7cd7212e91a3c
  283. e2fa58748a08d5195697bc93e3bcaf89862303cb957404a90213604dd2cabb26
  284. 6e1792d57a780f2329dfd2f757647adc256a0794dc92c7c3a5cd5da19f667789
  285. 0c0b643e63da74e81402a3ecbbed7c01e8f17a562bf301f4333405a6ee6bacd7
  286. 658bcaea37da875ba23f65cce4f45d4eef0641167702b79181727220a4298256
  287. 7558f4712e29920108d6c9254e9ef09fdcd255ea4fd21684075c5bde1ae86a55
  288. 54a1e08bc5fa0d1513a3059e3e0e23ad777699d874cdcf858594cc542c310e85
  289. 824587a9c71c0d8a8939839fa70c92a32cb99bad924a695a7073681b5591cd75
  290. 0befdabf47e740c03a7f724e48d827b57932fd0e79feb4e7adb5a5a5a581db72
  291. 160458839a99f1d4e7b30820f8384557576a9b9a6d4f35342dd38310c529b842
  292. 82fdac92fe0c138b470691df63f35c7012c177c257d4c4771c0fc850ea2174b1
  293. f171612325d8ab2f97912854f538ea4210ba1ab38097be55be4f8e2f1a925fcd
  294. 88d0e6290152c3176671c0b0a5aad6339e1f173ecc19a53a899f4d85ea031afb
  295. e46b053d05684012f07e34daeb806103f4559a90058d0d1e5b800f12b7f70c57
  296. 6b1772ff8e8870c714b4acea5275000a20adce2982bdd0f0f99d1df778728d27
  297. 1d1c6a6c57f20f1b506c5cbe40c15de0fb92de15b50c0405a2adb17851b1e0b1
  298. 22ebb35cb9c876bd3234e78e53a8e04db617e25f4e553358edbbe0cc4c4c7ee1
  299. 5e5e5cfd888d62dab0d8ec3fa91b1f05298b71af4f3ec0651dd08e598e72a135
  300. 08fbc86ba8f6712240483de110737e1b2b38f9b50877385beecbb3ecd9332dcb
  301. e40986bd193dd50ddef9e88c5c109a67ed81d1fac9bf0be4b8dfc3ac21070da1
  302. 9288b680f2e09928cabf91aa0f79ac8f19719c58bab4c3e829dc0cdcfc7610fd
  303. 4edfe4e2b6bb813b3b8fadf6d8f1cad81837f0f710565cf0f339f397b71e9aea
  304. 4425ffdea11e5aa0fb5b14e87206b841c518c58bfba8b15f868acdc2cf2bbc73
  305. 27325df39c38a17e0e49b82b7bd2d3484ca66e50282931b1e2b88dab9bb556c8
  306. 9adce19fb00715bb64552e54796e9bec193abf3a84db92c67578158839e53373
  307. 61dc30ea87e23de423759c239054c1fc6855e3df5f5544d21ca6ce1ce2c6e63c
  308. 8bc3048f46aa0c523d75b19f672a8d164c0fc8c65d7db05cc73e6ed9779b426c
  309. 12f3366db5c7a5cf1c77db7673c93cebfbd9652ce49f2c662cbf5e8bf8a654a5
  310. 73173a4ef9ee540b1e3e69b2a0f52290d6175c3e86b5b7306136003183105962
  311. fa5f5053ff68a844de84d5ba5abb7e26a677fab47a439b0b0cb890f36c5e8387
  312. 795de55e4c30ec87c7179e367129b08640ceae0f91ecb988ba471a93b9873298
  313. 471fc3232f71401db42d238845bc18dd8e93cac3ac38ec9e6007751ce2c7b238
  314. 89c9861013b3c4272af97761eadd432aeb9e7efe1741d175bf0bdf7d6a488f03
  315. 3829b36d9ca1a3e51a53ea1ecbfe8737c0d13af8bb67831a4c5eab9afa9e792f
  316. 754bd636de2fcf00a0381221b532306d154993ee0e4afba9346f83121159f6ad
  317. 865d14733c8a7b48075520b74222c325c2c409b3383b45ce5bdaf03966dcedb5
  318. 58977bb211c036dbdd3ca821e6a76b6225aaa30382438dcc2de7843e685e3b3d
  319. 801700320b72f00ae436684e1e653f0a0778d6968f26c66bf253e8a76e8e6237
  320. 62d837f970b423d6fee25749a31207243aaf7f2441aa0e843c4f832c6967075f
  321. ddaf0d5768cf4bd559f518b36a9a9ffdf7db8825370a01a235c1c6af73d47ed6
  322. b9228960208c6a24971522a60096343a9bc7ccd531047e33446f5018d176a55d
  323. 0a00db3df1d7a4487935c308cdfe316e90d43b29a0a186dea9e305f9b54e16cd
  324. 989c98d9f3b87ae105ab068fcf70e52a97355880e8f5fd1f77b847dfa3bef0c5
  325. 457dda6188c79d5db912d590e5a138e723753a75e9f5b3f7e6e6d6cbb8d8f53c
  326. b1d9fa3a2444bddc897493963c901d9c36b7c0f6b7f7e322d19209cb90eb82ee
  327. a2627e9dcc3399f4c3c2079ef208e90c32d8f2c1eb0be9076d56f79dfd9e0945
  328. c61e9f77dee17d7233e0d012cee1509782d62933c6b1992d32432a440224da12
  329. 9a4a0c1d824f7ecc2582184538e11ff428d4cdfb9217436dad669b37e9d8fc7b
  330. 39f8c9d90a130027e26e3c528e0e18ac79218c48244304ac11500fecd00f9a4a
  331. 9e064acd95fded6f448ab45ec40cd27b1c2641995d310abab1f06d18bde8e973
  332. 17eb37e18066b9b9a42a26804d0e214882d709d5411ce5f9638bf6b53f2740bd
  333. c90c5c7351fceb788dd818608c0c092a003fca6e786076a31e3df45ad417f863
  334. 0e78ae7ca467b65ef950db11f4f8401f0321bf11f5e9b1a2dbd14474968ec0ce
  335. f2de9fab6890a98a9119749e8cad616ba531a8f96d73671859547a139ac08ed4
  336. ae3c7a2d6fc513f192568620d3352d5dd3183d4f59e08d4d026833de7f291822
  337. 11f9207a18156c349d2f237639caea7a3aa77f2907620c9e8d959ef4e20f05ce
  338. e79e35cf0aa94b0539182d43226af943673a9859754fb9191d4dc736a9734e26
  339. 279528c7d30318ff4d2b6633490ca457715f873f7a442b7991344dd7a7819e1a
  340. 63a1d5700eecb950e52e292f9e611fdbf8a90061c2906013243efd06fc8736ec
  341. cd85a5b846d8d723ef9631b71b0f4d32910a0db5f0cad7a6cf7b47329b4e6e50
  342. 3e71f593e2bdf7b3ba89aabb319295df161e3650578fff1e3e3961bb0e8848ba
  343. 337d68e43aba2f21672018839b6a802571850351d8be720fe27ce1337215fb62
  344. c77e64fde0a844f64c497b463e95e06629ee86471be918c1c0f5d14fdeb8de09
  345. dd67352f9802b2f1b78b227d519c2d02e0d7b8bd19c8bc72d1d34d87fd990561
  346. cea07d88989b703cb92c760bf6ba80f67a297c81a0bc8b6d644b31cd0c3a7266
  347. fb0a0f10cbebefb5dbe6034c3bdfe246179e444c68a6e36c4d20232d52fc07a7
  348. e760fc0b42582d93198e24a1eb9f335eee399ed61e04255cdec3b3edded2abfc
  349.  
  350.  
  351. ```
  352. #### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
  353. ```
  354.  
  355. Creation Time 2019-10-16 22:57:00 (Attachment Only - Doc based - Activation Wizard)
  356. SHA256:
  357. 86e64d2dfd3bd73063878257a6f745d7c96cc8b20c7514934cb4bc69cd559d89
  358. eaba2b2b588c28c79c3915d8316a8d72ba562525eb26b0882935ddad8b5459b7
  359. 96b9531bcc054faef78150e120f275832c64dc4bc81343664558cd4c51b97558
  360. 96966e6579f86faf31365e299c5eeb09dea1eb9d79d9ad0047277873be0bbcd9
  361. 0bb3d00b50b4b679633d826e8a521f5e109937a7b0d50c6b635d5cd6bc917fc8
  362.  
  363. https://keeppcsafety.com/9ultjb/5bm/
  364. https://abundancetradingmarketing.com/cream.lib/VHK7S/
  365. https://knightplanning.com/075877mb/lx/
  366. http://cpleadsoffers.com/track.cpleadsoffers.com/71yxxan/
  367. https://experiortec.com/0aw9tol/HCbZK/
  368.  
  369.  
  370. Creation Time 2019:10:16 19:01:00 (Attachment Only - Doc based - Activation Wizard)
  371. SHA256:
  372. a7b3a6285a0378c18764d0a89ccdbccf5d7049768151a84ef05212e6584298e6
  373. fb0dbc19d8e6412ea5c0955054a4ea24c06242f1ab2328ae8a239cc782826928
  374. 428ca0f56c6e0307fdd29d1929e2658063bbe5d59356297dc2cb93d7d0ef01a3
  375. b17fb2f5bf681aa68b9bf928aa0d085ad5462b3e34d32c082528dfaf9d49043f
  376. 588c31be25afc204396562aff6705d4804228c6ffaa2d9a176f547d8edaf40d0
  377. aeba2e2e09d8b5cff303529697a02d484f722854e1a9ec656bbe7e29f21b24c6
  378. ff7a0349d67c4b0df11010be60c4ca63b5dea8de62629baebc99f8fbc640f6bc
  379. d72e468340119f5d70f592bfa01b43386160c851bc1b6ea46141739d45d29ffe
  380.  
  381. https://www.ioe-learning.com/wp-content/9NUnmp/
  382. https://kervanlokum.com/public_html/7DO5on/
  383. http://www.octra360.com/wp-content/0Y/
  384. http://www.ligapap507.com/wp-includes/3g12e/
  385. https://afromindcs.com/wp-admin/v91/
  386.  
  387.  
  388. Creation Time 2019:10:16 14:25:00 (Attachment Only - Doc based - Activation Wizard)
  389. SHA256:
  390. 78a78d9f3dd349ccd1bf05a5581c6c7537ceae277a7075874c8fa86dd7c01c86
  391. 1613596a0323a9fd9586b4b03fe78b6b5b2ee67b251e99701727c65fc1f72ec9
  392. 7646d24f5defd0a7d4588c645f07bab7c2dc56931b580f93cb68cc2df8795645
  393. 01ac42603a27163d006f753227ca00e92c906cf00f45b32746114ce8c4d646fb
  394. 8ed6cc2218cb428e97cee9095babd600138cdf430d0ece9fafc61c4d3e70baf7
  395. 5810965a257ac2dcc50ff8d6bb2b3259a5db193bb0eb22251c58e1ed44c6d3fe
  396. 6894b8039fdeb6e7cc2de9019623b5cdc876ab6efd5eb45c544963f5b959194b
  397. 6f24c1d2d75199f6bb8e969c573d7d74e7b09be4142205d493d96b8f6a3211a6
  398. 7d9aa1a590c214cd917fa7646646965c30f71f55f7f7c67b30c3a6c0d70f43e3
  399. 7c070417cc1d4258fa1071bd39c581a627f399c84cd7819a856c8ecb7545de9c
  400. ed3e811200f9dea8dad94260e87fd28a7d4060ee67a95e5425a396f6ea495792
  401. 2263534c254f576bb3e3976ca32e8459b2e4c2006877ea58b86d73305bc6d58d
  402.  
  403. https://anthonyconsiglio.com/wp-content/aXeDXHH5/
  404. http://www.sapphiregraphicsarts.com/email-sent/A7MvrVU/
  405. https://medsigmahc.com/api.strip/h/
  406. https://alsusannarentjo.com/wp-includes/X/
  407. https://awolsportspro.com/pe43/J5mXJ/
  408.  
  409.  
  410. Creation Time 2019:10:16 10:44:00 (Attachment Only - Doc based - Activation Wizard)
  411. SHA256:
  412. 3031853bcfd66e200fc19f652c983e45cec39da9dd8b0851abe6220c15701b46
  413. b4adfb6aa95b5a86de27d5755433bfb07c18dfab94b2ecacd9fbe5c8f2d5f8fc
  414. 30001fe4e61e3812e366997b6a3e1d64909ee3e8a2ea6084d9318274bffc576e
  415. 447d422b8fc85f7b2adacb6312694d81857c00922515d521330517e163b46401
  416. c1a8b814bfd86fe27317df6dd7038524c66c73502dd63d1a7166105c8f0f108a
  417. 77c9f3d5fd11f8ef620e93bb2428d64bcd39be89e17febc104da1d4835652fd6
  418. 005ab4808358bdf1a7902bbe037cd8bf831140894f059bd59f095aac256ad7c0
  419. d850b092fdefdaccdbfc2988af92d54d7f2d012561749e8457e7750adc61d2b9
  420. 7d02df19a44da38e4abccda265cef9c00f23a281a600a166a9264040332e5670
  421. f6f9ed6d8be740ca6bef4a08e1cb5264960cf8a8e65c3b6578bc2a2a2966d790
  422. 66e0335d6c11fe9f75ff31054c0cbd6d714d78025385b75d659a9db2bfb8644f
  423. 259d7a740ed67c3214f3cd95392585136e2ad8535eb1bbbabf233d0a3362429b
  424.  
  425.  
  426. https://chaudoantown.com/engl/kzq/
  427. http://rngmansion.com/brandpulse/vKCBIp9x/
  428. http://www.limousineservicestoronto.com/zpbp/6N2KB/
  429. http://www.svetijosip.eu/links/1hLeG/
  430. https://www.uoabogados.com/wp-admin/W3Ai8ILu/
  431.  
  432.  
  433. Creation Time 2019:10:16 07:04:00 (Link Based - Doc based - Activation Wizard)
  434. SHA256:
  435. 0eb91666c74a9449a68a93b09736f02230e4a3fd9d0cb7e157fc29a335a81093
  436. bb96474779e36beb94dc27995c6ed4f40fa8488728ba430f958424d02d41a34f
  437. 41e9ea183841dd5d3b6a4801ec0c340ed38da9369f2e70e368fa51d7083914ab
  438. 58a7b75a6577e87c117797ecbeabec0f68eaa57642a2396eb0c33b34d20df4ca
  439. 5004bfec9454051db57a0eefd5beaa12eedf322a7461c7fd482106db8a74d8b3
  440. c85f1be844f1d9f2dc2ff79ff2af5876b24b8edd612b9399ac70b6be1d10f641
  441. d38abb8ace1dfbf6902419988d11db3e86b1c76a73bd43b91bfaad0de1497067
  442. 7c53e814143ef13655bb6dfb2e06e71aec8e4bb856edf72f59b5ecfa7676eac2
  443. 232dfdc3c3f3799103969634d9ede4d5bc51db18789e2d573b26d11db868c158
  444. d563fc994253407c9371bc12352176734a403afb86b156223f6a079fb1e7f499
  445. 4fb844d1dedc76e105c03594c3d6d1e3f2a36a58b4c3125320f50cd91d4bae46
  446. 6a33f512fa8ff68aa257676df1b4d135d7e341c9a6e87332f6c10999c7904ec7
  447. 88a8bf36a5ef6d5944cf835cc55d93aa2802588f3bcad5aed68adbcd6a2d13fb
  448.  
  449. https://diverzeent.com/bkup/7f/
  450. https://comvcdigital.com.br/jkcaztm/tsun/
  451. https://lara-service.com/wp-admin/74d/
  452. https://samuelselectrical.co.uk/wp-includes/ymt76/
  453. https://cryptomat.blog/0z7f3/JSaGNG/
  454.  
  455.  
  456. Creation Time 2019:10:15 16:36:00 (Attachment Only - Doc based - Activation Wizard)
  457. SHA256:
  458. e411e594425716e8a57d6e6de60cd1cccf7534c507ac8aa79c751d1217e4c24d
  459. 248fe4adc2a7e36c69cf613af163d61a87132fafbf265ecaaf3dc726f8ac46f4
  460. a6e60b6acb3698f8fa7bcf99fbe2e075c33c7517d7edf68da07bdb07a9df8a63
  461. e931e7f8d1a95ab74b12a268e5fabdae879c803370f422787229125d1a426e04
  462. 04da7b17d841edede9c5c359c9f9147d0405fbd49297e33cdbb53df9a28920d9
  463. 35667a29627802dae416be54529201604456031441e39e867e1acb941368de81
  464. 3ce6e7675e40cf8867b177bb1128f6324ac8ce0e46c282225e7d0dd7e470d4ab
  465. a63eea089da8f02c56d47fb07e87c1e3d3abec5dcb25e4bd136e053ed4b50bb8
  466. a51fcd13d8f7817d9dbf8e01a74b2e9807aa5ed6b5cbff28e23753dd3cb2f6c2
  467. fd1eee244ccae87933c01a3f0015421c749776544e5e8e089b4a1ec1918768c9
  468. a08848d05027e109fe7d0dfde4f14237015e9cd8c06d5fe5485595c03e81bbd6
  469. 6fc5a96e4f96850faeb2bc6f4f3253cf72226a3d11e40ed6fea688e335dbe720
  470. 9f0aab18699ef5acee1b53dd5d02f62b5f072dd3edc7a48bd925c29de17c8199
  471. c1dd43795c094107870de59fd3053a3b4e20cbe848bee9e59ca6cea6cc0e4939
  472.  
  473. https://staging.smsmagica.com/wp-content/gq9n3kf/
  474. https://shopteeparty.com/checkformats/xr0r/
  475. https://hertmanlaw.com/calendar/3l9lt3/
  476. http://fletchertours.goodwow.net/calendar/nzbepxw/
  477. https://teledyskslubny.pl/strefa-klienta/ScYMD1I/
  478. ```
  479. #### SHA256s for Epoch 2 Payload EXEs ####
  480. ```
  481.  
  482. c8f5bfd038088da96af341813e29553a7b719296df1a55bc01e5f922164bb4a7
  483. 9f5af46eae9578a83e8335ceed9047fc3cf47aedd7faa5815bdde6491ae5e347
  484. de01ee9a944097b5b0493fc36324b3d563ef415368a6e57589c132d21d1d4a10
  485. 0189ae1cd6b2f5720e9ecabbc349d721127ee8828737b16b3d04dbbf2cbb3f53
  486. 1768d17a670a91098415db1f043cd8c27cdba6a054dd635911acbbf4f1d52af1
  487. 6c84e11a8ab4641b496bcaccbe182a5f44fb9cf16e7ffe754815e89653f37eff
  488. 4e14a79519bfa659190759549fe23814e984846a89acaac853ae5ebd1473b197
  489. 23f62e407b47eda7162d8df5ffc7bf78f5e72fb725ae573d829c0adb115d2984
  490. edea513e85e7a25bbeb5a0b130138296a2f3c8f1dacbd9db595efa911f057bb1
  491. 2d55fe57f2ff6fa3f59c6e83d96fce23b0a8173c4e2498ea87d399ebcfcc581a
  492. 4b58c4ea81deaa87adb481f436d5d31523f971f457e6a41f6becb5fd39c4f2bf
  493. f05de9b7f506e8dfe3b6bbc692c476451b792052ddf8c7326e499f2cfa5e2192
  494. cc7c8d6c5100890bee2632cbe34e24fa018cacbc865807f443d449aefc8e394b
  495. 27ee9df7ae188763b6c6e0a0fbc2138dd377f7d07266326bf57337f99a747054
  496. 64f0b743579dd6806bf7e7a9aaf8d5405ad73b8ca8a2d58b84c4e18d46e16e31
  497. dda7fe1906eb4c88dca052af685d2b5b7e388dd46ea19429ef0a020194a74ddb
  498. 4c2d69bc44bafd081c91f1f0ed4e60e55d986bb2bc0b8b8e65c1cb2a81693ba9
  499. aa28aa1670cae4384d0a691037348773825faaccf893accaa85160c49c021ba9
  500. 0c9d7e5125e6afc822461517958ac971e1cb95a9d7d155e3f77ab4e1deab367a
  501. 6dd7831eb7e74ddd68f562c6171d8616e367a1293e0d6ed1792d762fc62b08a4
  502. 97a73f582f4addaf794d1c19adac0350cc25f7533377f159665db4489f0e57cd
  503. 2f061359647c10323d0655bfeb3645942dc0fd66517d3fdf02905444b7239079
  504. 09472d6a9da060a5574965258423c210ae2e86f248aed0886658dee088f69d1d
  505. 48542500bbaae8a8fd799e390e71e2505704da6962d6579b36b950448f331d67
  506. 8f88dbec84f46145298fda59b24750d9ac1713ef6cbb9d650e602c6ac3b1d937
  507. 38d77f4fa6241520b75b5edb2851b8ff9eb2f953bea7b86396f496357e8569c9
  508. 7e327fd7d525e1e110396ed4126559b89069552d01d87f800a56c4f5493fbcbb
  509. d14f45f68355cb19ee0646c7563ce0ea469f53b3688e8e93b5e2459659f53279
  510. a16cfad58ce41893689dedebd12a6be66d6151d831b32f8b04ad267e2fa78823
  511. a2662938980cc972ea78233f40e395f085c4c77d09a6368596517939055e571d
  512. 0f080337bf09bf8b7eca996b5d376485f83c15f8a98bef1c79305e2efba762a9
  513. 9405bedeb0b199b8217fc2d3460fb195157f2ed3c91c940f55cc0a9995cad865
  514. c6c6920d69220f40e0db4ab0c9e01c8aa2a2d6566cd7f4efb93d036eb1acd575
  515. 563e4a9c9a917e80688e73c3d8146d7c12aa2d5caf1e836599ffd7512b23e0bb
  516. 295b095baa5b0404b242b451f7566c0a6371d06b7a88d650d63b2b1005f7a2e8
  517. 4f520d6cf1eab42dc8ea06d061186fd7f236dbb5b027e9fe61ef8736fdb001ad
  518. b7f6eb251838f78c15260370e237980c48a7d674d6a32648af55980026cac8a4
  519. e439b5f64309cffe1841d779072583e6036a218d6651fcca81a66b9bfd0641b4
  520. 334befbf1ac7a5e0e7d9aaa8f0e0532ebfc67d46d2e59669577788aeed8dd180
  521. 8896e49d48bf59c6c4ce98694416b590a2057e1b3ad400a1ebbe153415ca77d5
  522. fc6efbd1e3ee8cd16710623d68e89cce37253e85e0735f83fbc63226fe792c8f
  523. c5a1d41e0e21378521476fe40c78604030773fe11b3cd11c81412d71d9908ce3
  524. ab70874263864eef7a226836695dd75d236ce3511a232229705e2969b56f5013
  525. d5b13060b336c1f7ad88934ae2f233ba7185a37254c5da440dea6f00c7d6a17f
  526. 919a1dab9edf36017431963fdf69dfba0968fa843eec8d0a8c08fde47f998c17
  527. 712e3d2387d2d2f1f3919648ae9b81770b5fc11fa6bd45d83e311133d1a7a205
  528. 23b25200cfd70b44ddb8790a891694fe960cdc29fcdbe78c787d0f441b8ebeec
  529. 5a6db057d7bd551cfe5932c83e899556c2f0a746cbfd8c946f4cc69fcc188efb
  530. b5a9315c63d35b0239dee37e09a3d82141b5e0b32dfc4c6b10648294f2b4ecc3
  531. 4a660a98043e81fc1f9e126d0eac29fa01559813bcbac52fa7d5e53b8f5ad94a
  532. 21f645858f4d428aa64cff3ad35e1814e10d79a03bf9d497ae2105a71be21c27
  533. 0b6fd2cd0ecf427060c1c7580bf4611a85cd0fa1d9bb5da8d0f7982ee2e125e2
  534. 24fc71ee09a182fe80a4913dbbe037e5df6c02fa70f6337a924b8855bf5a2ead
  535. 8653eb59b1e562438824084a25030145b9926744087db04db72713590c0a5621
  536. fd1cb136365b09eb194a45192b912e940044709edd616d1c1055a23f487e79f0
  537. 7c9218030c00550eca49d41c94325f5e8d43b3543927f49a6f3bd75cf9296680
  538. e62fe8e49e2d077356458392658f48d69f70a1a379dd7dcde9b85bcab838e359
  539. abd9f3315bef31fe4f0b15ee5f1e2eca0cf96c3f8a65e1984ec37a8d45a05b67
  540. 84a13e6f60c2fe0ebedb0b649fab2d012017d69ad70db8e2de9f411b0a39438b
  541. 9ecaf02f219fc68179aedb8ec0baf0cac8289dab9d42ca3b7c40191fe32e2083
  542. af7f25fef65cf7f5de0d1be93882b43e9370374926a385d7252fc9acd8f6cbc8
  543. 87f54800fcaf60445a1028e545ab0909e8a754e513cc6befc9c087b2c81de174
  544. edf94986827fb2b0b6465bec3c43ad256066d3d342f090ac7e40e3024acc5b11
  545. 63306f7e86754fc1a27e1d0ac055fe1059ab0ccf89f138da03c6fa0f1bc73b0a
  546. fd0b9b76cc78f0f7a2d980cd14c8b6b552adcfff6e8d9f995176276433368c02
  547. 1c64aa5a3a6c3b8accbb4ec1e1c6db6951da92895d4fa8755e63584ee49ac290
  548. 8c00a1b594d352f793ecb8f7e9675502085f9a8579e36306567237c6b2741acc
  549. ffc71ad85c6af487fbfcc2f25b12ae3decca9180d89b909b6720ef2b43fea384
  550. b9ab39fdb192e5742f140751322aa0ca7bededceee61446500cd481ef4df37fb
  551. 1272c33c9f3b36e43eb85ba7029d1acbda5dae13804cf0f375d65f021c828e79
  552. 78a3c303d48af95aea2278f9ce6cdfe79754c7b2b5b85dd861bd09b563aa5ad1
  553. d6051a5ab410dbcd7b84f02fe9eb85e69d451e0303672817075ec96dd0a466dd
  554. 570986fca67897a30996b79b2eaa0a245c66bdd86b1390c2ea8322a9ae0aad4e
  555. a8737567c5a61ea9768e4173968d3398549986e4a316dca882a251c9bb3f3e19
  556. 14adfb6ba41cff5bef9f5ca36a97ea0faa7a972fa4c927c58fee4146a5d06104
  557. 29f34d70761bd90f0222ab0c02c7f802850230661f7c5fafb28562b0eae42996
  558. 3a053259b2f396529b7c84f693274f24cd93c3621450932eb1befacd9c69cbd6
  559. 4cf8d6cddbcf10823dcb836cd7632b7daac5f59b6fc7f7ae07221359c51d05da
  560. 955c33f89260cc44d1c546f3770a10b8cb96b1457686043e44942a1329247e3e
  561. 89eb23818ebb598684d7570181b82d7133705e0fd1616aadc92cc3e33425928d
  562. df308926e7bdae142511ac2316a50a867fa2f478322da829fe5d57c6f5f3b3f5
  563. 2b233ee81826f62339361030f067584069ff2d13cbfd4c93825f45dd0af6c10c
  564. 5eec48266c3a98a47301a34f464e1fda77ad01afcaefb06d99f059fe1881c872
  565. 3562d1fa1fa63c6d0bee6dde5f432e4eacbe2720a46083f9a66bd2a53d95b9cf
  566. 06879b3f5a600a821a8d6976285170eb09c0549005d96321a0e799ae74582f59
  567. 305bb17c0e7cd1c760d21f053e1c8c43e81fafb9bab78805da2c1000e4b8d9fb
  568. e3a97ca13e37294cb803734bb90b91d8ceeb2b99e8ee20fc84292060706ec62d
  569. e24f254f328850756305c4d8c0def3baa95aeee6565fe948633c9fb40e6e8305
  570. fe2dd10d4b70a41002108f3380c31f92ce82bc7a1437c19eb6c4846b54530936
  571. 307723aa0a454b7cb1a49b1ef565502f0f71fee15ed81c701a18eb3196f40125
  572. 6cbb78708f88802bfe0c677a17909231842fe75e12117111cf5b2ae64d655693
  573. 59322c536f45e7f2de6221704e1e0035686136c1266851820beee667988aef68
  574. 0d2d7873a7000382b2c0bd1c0b677529afba68f30890e981a225f3ff3078eb4d
  575. 345a8f1f856a72c5048bac55fedf599da72fe929f72749920c00d80148994cdf
  576. 27816f22fb96ed3585da1b8a369fc59b89953c5024a0b59a14394b01702e2250
  577. 41f86815fac7c65c9827a6f83bcb2b94a7db0590c93252321c49223a9c1bde8a
  578. c8ba448e6e97eafe655f6df676169c813f6f99bbe5fe77900baab2d1e4df156d
  579. a0e56d5279dec58e92640f8c456ed11470b1aac5de19f810fa31a4e26dad5693
  580. a8cb72d7f6fed290a89d7320aa539af4f2753c4f65bfbd579b2a6c8d6f50e98a
  581. 9576e7ca220c27f681b86b7708bb3a77e5df0555e984b863894b1e9e00bf6032
  582. 8e86ea78d392739a193164ea20650184b544d68b1859222a187593f67e66e1d0
  583. a5d43fdd5066856a14fd9055eb8b1b6d95ad7e1d87064c9af233a04853b388dc
  584. cd6047d0b49018852b73610188916c19daee6d1643d44110c7ca251e6d69c708
  585. c24fc003e8cd948a6b2b09e6187e55ec6f9c34dddf26588758ab34066de30e4b
  586. 714db95ee079eac88453dfc423a368aa37219e0a6ded15ab2586fe9b6707fadc
  587. 810fb97d84e68c0432b34c8956270dc7fc3ec32b25c7d48848fe5ca372bfea3f
  588. a1b9fe1530c646c44ecc0e4d645e5ba3749245f8e55459342a9b856a392e9a04
  589. d7898a2617e5c69838e9ac39b7db679ca4af45ad5234e9b95532373873d446de
  590. 3645269583e732dcbbb57b2df621641f2da3af48df84f8d2539788378c39c20d
  591. 4960ee8376cd621939f53fe5ace099a6b15b2d6347648988a278d87b04a0d8b7
  592. cca5b2130c667d8b930b10031f2aba279584ad493987dbc16b94ee2177c3b54d
  593. fc6a83531c0ce57c264bf9f5db7910721bda9b2937a15878592ff376669a0e8d
  594. 17d469ff6b206facd7badd925dcbbcb8af37e15ee8e3648d0e6597613dd0cc4c
  595. 990798583f4384da41e36b7e1cdda9f9e4e472ec553c662c14d4c414c302369a
  596. 0ea3b2b16f7a6715fbc26452fbf11ca9037627a3a34486375d38e746cbc351ed
  597. d5686e8791ee6615ed8d195523e162151248263d3cf9e82f1402490e357a1bc2
  598. af32f9d8374ff623a3bf14f6c5f43dfac949ec7173a28f1572cb09cc85364552
  599. 2e281277d98100ad96fda51977efc71c1b68bdad515f848c96b3e1224728dd23
  600. 899eb6da2a8cb29639455220a925d1c1c777b9fa3bc77554960ee8d8373cf074
  601. ebc69d24302d9f9262b4d07cd4022317358009156651555af9ae7e5a80ab151d
  602. ebc69d24302d9f9262b4d07cd4022317358009156651555af9ae7e5a80ab151d
  603. 4a72051f2734800a1d2da38a12cb968304daa44738aab87881b6190f391635d4
  604. a2bcac6fc5d7dcad6c6de34a866ea9e9c1fc8f9fe5099380b887169fcc0579c6
  605. bcda68ea14158f93eaab1d6eec4afa9a3e836a7ec5535d5598226185a21b5ffa
  606. 5f2ff7600a512ded0d6d0143088d6a4bd1e261941696f96fd5b4a0f90116f7c2
  607. 194631d3ced3271d5e48276b26cf605344f428caa82ed380fe325beac572e8d1
  608. 0e37abee42475da8b2e871625e6b50dbea86606edb95635ca1bdd700bf11b0ce
  609. 0e37abee42475da8b2e871625e6b50dbea86606edb95635ca1bdd700bf11b0ce
  610. 2af7e47b5cde47539b08fa8c429ef91d85a5b8f528614e767db24296aff603ca
  611. d044724a5321ae6f5f1f6cf5067d4a38edc69a05fcfbe27a31c9b802a4a190ca
  612. 9dd7248bb3afa7975587835a19fe7f7a3079ee57a946ac6e123f0ea9430e6fec
  613. 37a227ffa862eb78f392675fe4de45b92487328bd99992bda286ce0881cc3d66
  614. 277ba7c1dec46ee4af68163291620364ed6774fdabec562641ded11dda8bdb85
  615. df7d918c767388b2446784b83aaf1189dd7c43296ea29713faa97a671c631198
  616. 255b393cfb0655234d9a36da0bcd6d88902d18a1718dba19812b4b7d531eaedc
  617. df945983ee430bf445078c3b7ecf414c6c1d48dbf7a247b1a95728cd94e57fb6
  618. 541b2ea7d2984a98ebd2969dabd06e90f40e380e340d657208607762f03e3da6
  619. 696b6ae7ec7e329d7f9dfc595a2e9c2e7dd7e260e30e5fcb1d727fe5da51c714
  620. 1836b34b05ad413cd596eda27cadc12b051e47f68bf64029deb9606473a581a3
  621. 13d34e08f4eb2c114f0942b9beac237e9170ccd6acb09fe6f06f4d03a9094ba2
  622. 78a30834311575b84891602bc6b01d5b4ecccfc4979cc933a9e671b2749d3c6e
  623. 3f93b0ee48d52bf274a3696c900e4aa1cb495857c8483957d37fc37a84d8c3d8
  624. e75ff9aa2c0f6506af2df54217e95f6a1a3bc0f869acb25fe6dfcf87da0445ba
  625. 73b5c4a0738a91c199f56afeedd1202fa3f8a4fcfba3e618f2cd88cafb5898b9
  626. ef6af0844b3321c71024845188ddf305dabe6be2445be86eefacaaa942837e6d
  627. b9c5074f3bcdbae0e97bb784711e98999b1d0585f39dfedd3883bad6e54f4598
  628. 4bc3aa979a6ae2dd9ed93c985bac7133d18e9055111818a4b080b565e7ec3a56
  629. aff88818e9d4a74d94696447fb41592ee907b78e4c39d54f59a0322e6c67d135
  630. 8306325bbee3b0c04436321b7b89f63eb0c9b84f66da094ab86f35aaa3cb1099
  631. 6ba8c6545c91bf860e5d15f51516d4cf2f088817aad05a036b1216397dc2e2c2
  632. 291ced1ec0452d967961a3337f4f15f899bfe9c0354e70c998f36f25ab7797ff
  633. 2650a3c358a17af6337a65db241acccbe3616c0c852236a202e413d5e4d2fd58
  634. 4115446b1276077ac4afc42b15cfd5af01799fd42ed0da6ed80afaeb1e158234
  635. 3977a1e80e9fc9649dec0ad329b4c4f44a788664ded105c34dcdbcb9a8b70c0f
  636. 932801fa76d3be883cb084147e2cee7a8fe9cc54807098b3c9434f320909026b
  637. de9eddcd0f905f5126d82ec96fe6a8516546c46ab8e22d79dbc9555698c4e099
  638. d0798de6a98efa6664d4e9dbdd9ce79a86d3eba6a5fa42e031eec52408ccbbf8
  639. 763f6a6c3eb63b3670783b2c18a1c54dd9e075f0ebaece95986f8d17001745b8
  640. 282420cbde25f070c17952a133df8f72bce87e5e791dce317bc1a70b2e3b29ed
  641. 8482ec884e39ba88dc0fc76ba8e81c553f0e4572c4360540c6582bfa8a368226
  642. 5f57806615245c072c1930ac74a311cb536cfed7bf8570389f7f9ae6cac61a40
  643.  
  644. ```
  645. #### Epoch 3 Payloads by Document SHA256 - All Times UTC ####
  646. ```
  647. Creation Time 2019:10:16 19:14:00 (Attachment Only - Doc based - Activation Wizard)
  648. SHA256:
  649. 926b66e7eeca12a34192930b21857b8c2e6cef9a8a5283a2fa7d49a8775546ef
  650. 6c41dcfa432a972b96ead6697e79c79a1b4a5b7290a374180719f0fa59a6ab8c
  651. 37f3d78b3a59a6e13669fcd268021485b5675180238a7ffaa0882e5f78ff85b8
  652. 576a2bf9c4331819fbfba86449d00f30c65886c3b8a87d0bda526bf3b4857793
  653. 75f0ec8ff3162f3a4dce4d6f15ae59167f534ee4e178467a34f1a719123ed610
  654. 64053c6a5b6bc5683eb51fef7f7912c878a50be400697d95dab3eeb5b461590c
  655. 9b40cadd911034a521a04a28b7648eac967a23905e28f44e8d6a7ffd88aac3fb
  656.  
  657. https://zevarcreation.co.uk/cgi-bin/bzgo08qgw-4rpjq5g-63/
  658. https://pavia-project.net/sum.function/h32-b1c-694/
  659. http://fastprotectsolutions.com/wp-includes/ily8g-nogm0-98621/
  660. https://gopalakidz.club/cgi-bin/bxxFtbN/
  661. https://strategiceis.com/wp-content/5tv2cksm-4w1y52b-1632739/
  662.  
  663.  
  664. Creation Time 2019:10:16 17:01:00 (Attachment Only - Doc based - Activation Wizard)
  665. SHA256:
  666. 0d0caf2a420ad00e2df4fff6ab8bda533309f9f7a5d297280e3204f6c8a104ca
  667. f63fea4f22a54c02daefe985faea4a55212446f9557648767589e2b2b0ed9ea8
  668. 263c9fa433317dbeb82763c91ba9eb1d3d6db322669d9c7b5454168ec5046daf
  669. f1e4082216d5ceb09ecca828327cf7a90848771b0ab1c539e166f25ebd652caa
  670. d819d99877ea33d4877b3a4b27e7287978f5b7e767e5e170d2b4852c67e931ed
  671.  
  672. http://hirame48blog.biz/wp-admin/VmfOpW/
  673. http://www.balsamsalama.com/wp-admin/e86sz-rcpcihz-16085175/
  674. https://homesocietepromo.ca/class.Smith/t4kxcqi0v-k255dgo-0545403961/
  675. http://southernpoolcare.com/central.function/xvt-iqa0qu-6812406689/
  676. https://tenelevendirectsales.com/api.Canada/k08u-tnb-13/
  677.  
  678.  
  679. Creation Time 2019:10:16 12:08:00 (Attachment Only - Doc based - Product Notice)
  680. SHA256:
  681. f025e86e27032b4db4de12c79c7b22022b06f7070063ebf9b430bd6405e18000
  682. b24a4ce43a93821060b9042baf2839ea1897b6af9a73b25494bf452ea85094e8
  683. ae784162616d9eec2015650b020b9f595cfb884bea8a8d35c2330afa88423d32
  684. 24ff017ce6c133ba8ffac801f6e6de56fa6f7e4395747ad047c07099bde30916
  685. 3d4e0a523668ad1c22e00438c2fe99ec12052f12cedfb7762140494ab0db6a97
  686. e94b6d5c554d2bd65b67d14ff3712ac389e39ecabf7122872ea0456052724d74
  687. 49bc69eae9389eaf69fbc0e36dbae8ca8ffe712579befa006cfdac1127170ea8
  688. 5edfbbfdb8542cf4b4a0055702438d4866a5cbce9f03b17d3b5e88677ed9d89b
  689. 6dba38a0af443fbf7afd968125ec2091bcf1a42e24f6b0f14da47257b6274bc0
  690. c719f826840ce9035e3ab4df54e6de33f1f71a536eea5d3c7ee32fd5de2509bc
  691. 1a155762676eb816c7bbbb00e5ac339b4717a03ce1985175b928b90848c0c932
  692. 92b2a4a491a083da59326626ca246e92149eb58fd76ea7d8390c6a085ae5034f
  693. 32fb447c7471c3563a61dd21c1937ee5650c0c80feb57e27e0c959038520076f
  694.  
  695. http://litlyfe.net/wp-includes/2fsj8-682k0-047849/
  696. http://cfaithlifeline.org/wp-includes/vWysYOUM/
  697. http://logisticbrosllc.com/wp/oNrwAm/
  698. https://insighteyecarefoundation.com/wp-includes/mpyXsxj/
  699. https://silkrete.com/wp-includes/zk3ge6gnsi-7wap41-622/
  700.  
  701.  
  702. Creation Time 2019:10:16 06:15:00 (Attachment Only - Doc based - Activation Wizard)
  703. SHA256:
  704. 65930b524d02eeff939aacb25e3f14a085b28f2cfad1e80620428051e16efb23
  705. 92b2a4a491a083da59326626ca246e92149eb58fd76ea7d8390c6a085ae5034f
  706. 76d5be53a7aa8983c09f9beb6ab23a8822b1f7b338212b256ea2e3e26f6e6a61
  707. 1eb420265516ecf4af9f2eb1e817e890e8143c2b4d8c85d59f8031efd53ea901
  708. 214e7dd28484c57ffaeb3cb8c9a183c82df4d27e1b372c2f85a8395bf3566757
  709. 31f7618a60e24b04dd4a8111d8e485c875e7c8db79c087b8b6f4246b1cb9aac8
  710. 2b79d27e36194fac90e1a677f2ec25e386b2d38b12644a9dc0603ad28b2ab077
  711. 6b319abb193598eb06b2d8eb4e7d56d8e83234b1dac442e5ffdcd48c5104ec47
  712. 47e3f721672ce0e1fbc4d1b8a9c5139bc8a3c8d1b027d0fb507ae0f47e7bd726
  713. c7bb5f53283525d830439f8be8b2af1595814c95663245aba633bc0ef6a3e7e8
  714. 74bf109ecf1d57de7f4e781647b55fe926ae8f96a0abd347f4a731560a2d3c55
  715. c484587a916af57ce6a6da6c3ce5aa4ff605a78d2a579676bbd51a54075d7ed1
  716. bf438fecf2fa2050704b8e71c60f0ca628b5b6d23c09f9218261fe300e3b6a1d
  717. face14a98b05edac3043f2d5f1bf7965e0764f585eaddb0a374146d843112a77
  718.  
  719. http://zteandroid.com/wp-content/uploads/vci-aswjj-84/
  720. http://xe-logistics.com/wp-admin/glrvk-qbo0xt21sk-1175457254/
  721. https://boyfotos.nl/wp-admin/qlXAWmOK/
  722. https://flipkrt.club/load/hgy-wvm-2921/
  723. https://takifuarietnik.com/wp-content/d3xg6rplzg-xeamnao4dl-31753/
  724. ```
  725. #### SHA256s for Epoch 3 Payload EXEs ####
  726. ```
  727. 82d705567364806132a612a17590d2364cbe3f51c7fea882e49b62607b1c4d4b
  728. b6d275793d026566866312f9173511079df8a33737bf3d9a78301e749f1b24fe
  729. decfa1d2cd5e26edb5d9bb96ed0ba30cb8aae3eddb1c8a404b2b8ba54be2129e
  730. 627bb83e7272ba678c2dc9313cada61d849f9308e7e3494c46d0201fcef4120c
  731. 983c90b57abbb650c1463fd5d61518d5424e0bfa380a59bce0fb6ecc537bf2cf
  732. 93e39c8855adbeac4d99bdd178513d83ddcc3bd7b1713048b238ba9a6cbbfb82
  733. 29a5c4c5fbe1ec29605c44c34245088e663b3ccf26e29e9495727c1ffe209e1f
  734. d5a326725d70ac5f9d36ac3028dcfb06c4310dd8129eaa111c260721ea614ca7
  735. d75f362c1dc0c701055815bd4c8cfe30409334bec2ef1cb1e84ee80ba78b4ce0
  736. 2a20df798b9a1f7b2755a224c9f87f8c4dcde30fe6c22e434f9e4801072225f8
  737. 561cba23f69c1b3ef7f1b9223a62ca4463969888a197f68ee99976f938b5fd0e
  738. 5a181fc814adbad39d1b257d91ea5f4a70b10a028d9923ba42c3d88e715a315f
  739. 25809fe4becfe9cf96e454bd5c5f6930ab44a080ab3f9fb76ef731741b570e85
  740. 0e43cc9ff98a777dac50f23ef5aa9b567bc82803e644750ae7a0555c9b1244ca
  741. bd030f2be209884fbe1568271746d7e610d83611544551993db4984e1e32bcb5
  742. f1a17fa7e5c9b5eba616ccada77b947a98e523f1da37221493b5d0c21a2fe4d7
  743. 0ba7989c7bf0b612e9d9b28f26ca9b56d28f372eaea0a66ad064051b800888c2
  744. 77275f6a4bbe63188cacc8fe64f36425b65f01bcc9f997e660d5124758b76ba2
  745. f1ba5273cbe3464698b1f259e7120b6056d49529e585d17065881fab6b64db0e
  746. 721471ce9d2dd4887a7277e130078ecee2ef56fe56a8012947ea5a31205f7012
  747. 5e1fe51444ceb489c7061ab6ef7e736bc525d416ae8d7a134d000fe1b0db3678
  748. 9bea6e55abf698ebc6d12ee28bbd6124b4fa672ab930fbac9ed8e3b9bc3354df
  749. df188210e338653c105ad98cf17ae09d034d4d253a4a3038c7bc2f1581fb0823
  750. 93e491a92a3f4d11fa4cdb4b7ad5745debf4bcfbf77383d4880a7b5b359c1daa
  751. 75ae3b94640c683e15bfc04fd1da0e7443834f69f048ef9cd3799d504a8ae41f
  752. 2fc746f8c3c0cbb060ed70ded01dadef3fac478343710996744ad46f77fba4a6
  753. 7f776f133e79981c0700cec3cde6972adc75dbc07749c46cddb9f8cde892cc10
  754. 19b4a68763fa612f9d28406c2d7cee950f6a709c30d96d3d4d846ca248e64647
  755. 052a8550b185dc1cf0ddc07efa605d9bc7a75dfbeb5d1106fbb198331cfcf6a8
  756. 7ae05ae1633a1c077459abcf8a4f8b2ea763478000cd5d7cc711b132eb4635a3
  757. b24630b3826491f0f294e9f231945af27a067ceb2642ac8d7dbd41a9f272d7a8
  758. c0b38feda0c97b59dfc42421abe030427b0b9104479e3eacfc559a0e694562b9
  759. 4c48e610c1135b43101b0abbbfffff227e2ba62b9707eeab62693a39a1fbebe3
  760. c055a047875457aa1b368c9548aad9d124fa94d2b7b8fe9a1d77dd5c79bca8c2
  761. bdffe47008039f9eca18b0f6f070f1f68697366dd940c72b50b2d32d77cbb596
  762. 5802aab75e85c178cf422755a3e013dfecdb70cfa7406c33f5b08a29ff40fd3a
  763. 9246b539f22cb93d134552ba0672cef37ad32f3b27dbc65dc5cdf23d561dfc1e
  764. 0e0b7c9ceca1a3df4924bea56446181d47766427d7c4b3272e68218f68f1ddfa
  765. c8e1b24b2ea2535516543a85771ac1f30726093133f7957b8131ec5c4e15b36c
  766. c10bd144f3b53410c0e1a5d441931ce42fc67e51936e078cf37f6df7ec687bb3
  767. e2e53f60f157ea51336479f1ab00d2aa7333e1d541d372ec06d99f4d8eceb078
  768. 13d6f37672d3e4591c50fc98961c12b019710c1f2a74cd98cc068d1a62db5285
  769. 16e958cb408a848ba86689b8c860cb412e4356de4ed304dfbd22e5ec0cc7d941
  770. 78b57031c0a21ca5b9ed1c917e8c91a72355e0e9eb5f1877d593e0886e74d5be
  771. 7b853bceda30958f76af41da7c0a9687a1e3e6da4194533f8e13dbf2c6cd8a2e
  772. 746f76d9986a3ec62c6ada1b1d982f40672dcd6c630973df5445f5939bb8d933
  773. def8c4139ebaa6b48d78bd3380a5e5442fee175d0b3fe14a7ed27c8393ece711
  774. 6875553df5c416e269262961a0c8527a2dfbe67dddd405d1b2fa5e3df39da465
  775. f8c15d2921eb79d83419418511b1f7cb916c25a1e86d89b5d6b0d0b771943991
  776. e60bbf33925f01a24c5122fc54587d35033885964227b5477b80a09daaf6f067
  777. d01e96b6fa88bcd65b50b8e524064d4148b9a5c4e030679a0287b7d291f5d2dd
  778. 0eb8f10c344e74d81d391fd221338f775857efb3093e1924b1a6d9f4ab30821b
  779. 866c63dfc1cf0c09c14aca9f43169389c754b403b908fe89eacebfe93b14ce17
  780. b847aa3c250682279d27641279b958660957f518c2a108a35adbde7e78f5edb5
  781. f3c59e980a8aea7333a7924d5ad1a348d75816138f6b67c0c68d2b2e90b9d442
  782. 4b1bd95c9b37f5c2c7ab8d61ad1f3a157479f105eba8af57b4cf1f9249978756
  783. 8321f0655a6216646faee36ec1832158b08ae3b041c6583dc324eea1e6c8af88
  784. 846699ceccfcd196c9c28ac3a52f662d7356dd550b476bbed44fa622eedbc027
  785. 8fbc5f377331ec434f6a6035efbd226f567d8e9dc426323bab9312ad12c587dc
  786. 35611fe4eac12cda424fe9ce92a76bec0928593b2283489345788fa3878100da
  787. 30b51fe483d3c2f6ec52b0ce1c5010d0225a4a3be17168fceaea6792e5d490ec
  788. a8487ad88fbf8c0d513a10d5134d41f3bdd1ff80bdd424c403703b5aab0080b3
  789. 9160ddf3b2f7946681217a62a2aa5ed22a7f1ea7c38ad5191bb354d0d8f5b407
  790. 8e6661fbe26a076a198da5a08724154f8147a8d140bae469345eca71447be13a
  791. 5d42ff527186a9308d0441240ee636ac5650dba790f721efd27ae9f638f4a2d3
  792. f2c9d1098e6bfdb7ba0533521014f5fc8bf998a9f4dc4fd187e40573d6263dfd
  793. 0c2f7e073be6c80e7912e19817cd382adfb3ce90951f8c5d2c832dfe5c0a8a7a
  794. da8a863e69cfd12af557cd2138de913fbf792d743f6885af6231f69af40b989a
  795. 9a3f47a5bd9ae94780e56d91c0e7b02a3b9706dfdbea2bdac317ebdb89bc9c3b
  796. 20f6ba8efce8cb3691574460f504fe478c5d90dfccbc29a0369a154cf5400772
  797. 78bbbe8e862e17296d85d01da92efe434a430c2157ed3715a1baa40693dceb57
  798. c9cf76ce00e304ef20073c3d7fb5c11956499a1239154b8d9c60a299aaae0129
  799. 2962c2fa1ea108ebb1c5a657aac5252166b7c8f363f0f83f961bd7ed19b31876
  800. aaef1fc5c832c1d3ce810e00c0c82ce246fb0638dbedbbd5bd61364ab808ee25
  801. 3f7cf52dc8758f5d798d106bdabd956c0309051ddde40c7c1069ea614bd0974d
  802. 0672d85151b412f29dc65929fe7a20916585291d5177fdaedac1e87041e9b1b7
  803. 3408845ddfb5b832e40167a1d0ad9298fd1cb1ab82d27edfabec68c815121ac2
  804. 25f8e44252a4b1533589d074fb2c80b9cbe2817f756afbdc8e7737fdf2d8ee2f
  805. 3bde43b006cb55359a6bfd5ebc0e884cbe172d253e1afcab956ee922b4960daf
  806. 4af6f092383e9e2600bd6407760931a177cad61686383216aad8a4f682d31d91
  807. 273770d2bcda14bd2664e0688f9a85bba67cc7da28e170d14b99c545675f0b51
  808. d8a972908785a035b9dc1e7568153c04184b54e8c91cc73c2bb769778432bbdc
  809. fff5e3cf659d9299f012d8c41c45e0b9bfe1300c092d76744e78e9bf770ca78e
  810. 3d2f761635f02754ced6e8b52f8efd254ea684a54d7115ab2ce7dfd825581fa5
  811. 77fc15b0681cec2cb947c0bd2c28b97e415b208bcc2ebf4f63bae3b96a2cbbf8
  812. bad875582028c42a34d30ae636d1ca1812fa038e6a970f239f4ab2d27e6d5800
  813. 0e41d73430eb12ee0d90320d6ca72c5860c264bff835d9900294341d32feeb9e
  814. c11a37e17c0592d1ff91963953bbd72a9c48c69732d62b426369e03a806fcc86
  815. ce0cdaf3485e85c2dc09deae84e79a19de7ba2c138ace6582dbee9c473d6ad72
  816. b0fd38a6792a38c00e7f86406a77cb35effb92faf0c5a7062b0404d835abb174
  817. c4b97f147313f490bc5cc796ed62294add83f20da3483a3a8e39d66b4c1ec836
  818. 6e0af963240c1ef0e3c2ff02e85f82e232b1f22a5d945f34f5c9d60c34298b05
  819. a3a8866fffba7ca44e0fc91a39ec49f85e4caf4ae370aa40aa3a116d3ffa92e8
  820. f968f258ea2750756c345115dfb782d3d3254315a7e3d8aa690e939320bc5bfa
  821. 9b5ab43f7ea0eaae247486f620d63b744b3faebccae289977e4a744f9372a9f5
  822. 1f53000ccd79f8bd511a202efb6d4447052257a4c473fc67b0ead1cd21a532fd
  823. 39b871ccde0f63b0ec591855bf13dc278bc8d79fe92815dcdb99f625712fd702
  824. 47674118bbdd9f3df1262aecdbd4b19e92b450159bc5f040a326deb97501f826
  825. cd736003de5c4fe2e6aa29e50a7bcd251e7b5bec93d90d3186cec070028e9375
  826. 82d18752d5ad821e63e80277827a7211cd928a56325216adc3a14b8268dffda7
  827. 8fb7280479cc64e0e0bd21849ca874190abf7f961c8e271142455e48314ddc77
  828. 2f1bcf4c223c622871ea0a4db60736e90640aa14543aa2dec687edb0876cc228
  829. 615284cba7f7d19c9a0cdc03fa98a761eade7bcd67602b2f2799a2ad39aa4e23
  830. ddaaf8f95a0072d3c1fe626f42a518a97fa3e2b2d5acecae69d13684145410cc
  831. ac01f9564de06a8bc3d555e6a2e0258379f1ca0bf96aa42758a3cbeff6cb84f1
  832. 892e5640be8e608fc74b33309e527e7665d997f2ae91a31c8e22ed481eec8c3a
  833. 14dcbed4c82f2a6c9c8d129ce83c74a9032f0d7e325e35f04c6717901b340da5
  834. 113c06882ac63347b3e3979a58da3daf9401254bd4b47fb65a2c9d7ddd5a57f4
  835. 505a929ed32bd28e956e884dee0b4ad0d3f7f3ffdde3b2cee861f1c992102a28
  836. aa170c0a9a2598cadcb16686073252580e743843caf87454a80f95ff19ad93b8
  837. c7568d4d30b4131e398977075dfcb7f6d2c9e1c5a260f89109781dbe4f50340f
  838. adca4542fab5bc97c5b92b4f1561cdd8239a69c7545cf53962c2cc12e80962c5
  839. 3f388d21e3281936b861660b6ff09a82e957cbd4d7f68b0d2b397d3851e467d3
  840. 3a3e34b0d3a8580de3e7c46438d70bd8b53e5ff7d43016bb7b125a760c62fe7b
  841. e65ecef1e40f81b999f39f86d1aaa8ed4ef917502342974192a9885bf667c2a1
  842. 380684bea172a58ef8c7e0b1bf6ff170320f7a54ee99578be98a03b10f20364a
  843. d74138313713f4e4a49d589fa65b58ecdf974d23e6c0050cda2dbefb989ffd9c
  844. 5aef4cdd04116f84fb4fe2aa0a06089b1156714d3ea9a5b0733a5c7840b9f331
  845. 5be4454765e074cf7d0b0271830bb72313789bb0864eb7bad8524e84ac36052b
  846. 2b7e8784062bb5a21fb68fad4dfbe24e03f0a52d5836d2bee918cb9cfb1d98cf
  847. 9c873968eb3e8bc22ad5dd58fb60d36dfb16005c286fc83bee99a0a9714e2584
  848. 9303e84b065c4e32c5474c8711f5850fcaadd416728822b7c15201de8ab96ac5
  849. 524612fc756523c8a5bc4dc713ac5682ff2c05dd01fb363fb9f8597f1df0952e
  850. 3b5588fd6181ead229c653f99c0ac0b96da7679d56192eb185e1259a29645ae8
  851. cc55da274bda949c52ff508242d7ec633f3a13214f46c640e21406acb3f6102d
  852. 7eb9838498139d9dce9c16a7df6288cfce90fdd91c39d6af099317d984dc3e59
  853. a7224d9be76656af7a4d2603f06131262965df2d3c693cca81d80fce12d195c0
  854. f49146b639a7720b08c468c6f34dce19ff66ffc20e752e8473b70d82e5f4de4a
  855. 2d0eab89ddff17f8bd00ca326788a1195f6c1632831100c48a1b96e1c5114ba4
  856. aa81c8a453c15e9517da6fc829ad5b9f09364ad0dac1c39b7e10821c9aca2a3e
  857. 1233872c4cf58752988cbb3ca5fd6e62dc2a3266a3743ab3fcd6705a8d19ad2b
  858. 3c6cbc15d1700093478bad2d933a13f1aae11ef192a9b31e39544f973ba29c4f
  859. 7efaaa44e2545408895ab9433fd3ff4872bbd4665476c4e4e302b581a91fa3a8
  860. 771982fb4d6beff11621b4771e6ceabc5b501a948c92d42ef0878780069c9baf
  861. 5be78097feff746bd0ada9d955bad3eecd47a24f355be1e56ccf805a6b6f782d
  862. a7a1fff3282aa8a9a35020971567b06cb573706730bafd89839a3e74c561ea84
  863. 85de5f3a23add503955dfb864f4f99ad85c98b3482a11a71f95087787f49225d
  864. f63427ff25657f8ea74080f63c52b06f519a54c9b1d368ac3389757f256bc2f0
  865. 042d55b3ec05007086fc938797f706b431704964171f84f9f907ce17e464da7c
  866. f1b9a551c07da643ea3badbc75b2633e890adfeefcaf679d8933e112d8a574dc
  867. 3a6ffa34e45672992cd6aab27b26da7f4e9c3664f40379e8db6c252c27179fea
  868. 7367b72dd6f0248b28451e442f0ac121768acbce785f020c266a81a1a2ae5697
  869. 4428d9962498884fce9414dd3a341fcb1145f0abc9552ca1e2f57c119244eb5b
  870. 1d87e313dc2ac37a7f618221614cd21616bf368cc450bdec07fc00f5ba99af75
  871.  
  872. ```
  873. ### C2's Per Epoch ###
  874.  
  875. #### Epoch 1 C2s ####
  876. ```
  877. 104.131.58.132:8080
  878. 109.104.79.48:8080
  879. 109.169.86.13:8080
  880. 110.36.234.146:80
  881. 114.79.134.129:443
  882. 119.159.150.176:443
  883. 119.59.124.163:8080
  884. 119.92.51.40:8080
  885. 123.168.4.66:22
  886. 125.99.61.162:7080
  887. 138.68.106.4:7080
  888. 139.5.237.27:443
  889. 14.160.93.230:80
  890. 142.93.82.57:8080
  891. 149.62.173.247:8080
  892. 151.80.142.33:80
  893. 159.203.204.126:8080
  894. 170.84.133.72:7080
  895. 170.84.133.72:8443
  896. 178.249.187.151:8080
  897. 178.79.163.131:8080
  898. 181.135.153.203:443
  899. 181.143.101.18:8080
  900. 181.188.149.134:80
  901. 181.29.101.13:8080
  902. 181.36.42.205:443
  903. 181.44.166.242:80
  904. 181.51.251.236:443
  905. 181.59.253.20:21
  906. 183.82.97.25:80
  907. 184.69.214.94:20
  908. 185.187.198.10:8080
  909. 185.86.148.222:8080
  910. 186.0.95.172:80
  911. 186.1.41.111:443
  912. 186.90.29.228:443
  913. 187.188.166.192:80
  914. 189.166.68.89:443
  915. 190.1.37.125:443
  916. 190.10.194.42:8080
  917. 190.104.253.234:990
  918. 190.230.60.129:80
  919. 190.230.60.129:8080
  920. 190.38.14.52:80
  921. 190.85.152.186:8080
  922. 190.97.30.167:990
  923. 200.51.94.251:143
  924. 200.57.102.71:8443
  925. 200.58.171.51:80
  926. 201.163.74.202:443
  927. 201.199.93.30:443
  928. 203.25.159.3:8080
  929. 212.71.237.140:8080
  930. 217.199.160.224:8080
  931. 46.101.212.195:8080
  932. 46.163.144.228:80
  933. 46.28.111.142:7080
  934. 46.29.183.211:8080
  935. 46.41.151.103:8080
  936. 5.1.86.195:8080
  937. 5.196.35.138:7080
  938. 50.28.51.143:8080
  939. 51.15.8.192:8080
  940. 62.75.143.100:7080
  941. 62.75.160.178:8080
  942. 68.183.170.114:8080
  943. 68.183.190.199:8080
  944. 71.244.60.230:7080
  945. 71.244.60.231:7080
  946. 74.208.68.48:8080
  947. 76.69.29.42:80
  948. 77.245.101.134:8080
  949. 77.55.211.77:8080
  950. 79.129.0.173:8080
  951. 79.143.182.254:8080
  952. 80.85.87.122:8080
  953. 81.169.140.14:443
  954. 82.196.15.205:8080
  955. 86.42.166.147:80
  956. 87.106.77.40:7080
  957. 88.250.223.190:8080
  958. 89.188.124.145:443
  959. 91.205.215.57:7080
  960. 91.83.93.124:7080
  961. 94.183.71.206:7080
  962. ```
  963. #### Epoch 1 - Spam C2s ####
  964. ```
  965. 37.187.5.82:8080
  966. 45.55.82.2:8080
  967. 185.94.252.27:8080
  968. ```
  969. #### Epoch 1 - Stealer C2s ####
  970. ```
  971. 190.115.18.139:8080
  972. 75.127.72.18:8080
  973. 173.214.174.107:443
  974. ```
  975. #### Current Epoch 1 RSA Public Key ####
  976. ```
  977. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOzoTryw1r9RxRJPFKalO4+q7JaDZWSB
  978. KZlEc22H6ITuE06tvJspue42TF1yk8xN+1bqW++QeV6Clm1uRswA/qoao/6p4eN0
  979. h4zIO8PEaJ0C/9EO4cx9yfRLlVpjdEkP0QIDAQAB
  980. ```
  981. #### Epoch 2 C2s ####
  982. ```
  983. 101.187.237.217:20
  984. 104.131.11.150:8080
  985. 104.131.44.150:8080
  986. 104.236.246.93:8080
  987. 115.78.95.230:443
  988. 124.240.198.66:80
  989. 133.167.80.63:7080
  990. 136.243.177.26:8080
  991. 138.201.140.110:8080
  992. 144.139.247.220:80
  993. 149.202.153.252:8080
  994. 152.89.236.214:8080
  995. 159.65.25.128:8080
  996. 162.241.208.52:8080
  997. 167.71.10.37:8080
  998. 169.239.182.217:8080
  999. 173.212.203.26:8080
  1000. 178.79.161.166:443
  1001. 181.143.194.138:443
  1002. 181.143.53.227:21
  1003. 181.31.213.158:8080
  1004. 182.176.106.43:995
  1005. 182.176.132.213:8090
  1006. 182.76.6.2:8080
  1007. 185.187.198.15:80
  1008. 185.94.252.13:443
  1009. 186.176.138.171:7080
  1010. 186.4.172.5:20
  1011. 186.4.172.5:443
  1012. 186.4.172.5:8080
  1013. 186.75.241.230:80
  1014. 187.144.61.73:443
  1015. 189.209.217.49:80
  1016. 190.106.97.230:443
  1017. 190.145.67.134:8090
  1018. 190.211.207.11:443
  1019. 190.226.44.20:21
  1020. 190.228.72.244:53
  1021. 190.53.135.159:21
  1022. 192.81.213.192:8080
  1023. 198.199.114.69:8080
  1024. 199.255.156.210:8080
  1025. 200.113.106.18:21
  1026. 200.113.106.18:465
  1027. 200.51.94.251:80
  1028. 200.71.148.138:8080
  1029. 201.184.105.242:443
  1030. 201.251.43.69:8080
  1031. 206.189.98.125:8080
  1032. 211.63.71.72:8080
  1033. 212.71.234.16:8080
  1034. 217.160.182.191:8080
  1035. 222.214.218.192:8080
  1036. 24.45.195.162:7080
  1037. 24.45.195.162:8443
  1038. 27.147.163.188:8080
  1039. 27.4.80.183:443
  1040. 31.12.67.62:7080
  1041. 31.172.240.91:8080
  1042. 37.157.194.134:443
  1043. 45.33.49.124:443
  1044. 46.105.131.87:80
  1045. 47.41.213.2:22
  1046. 5.196.74.210:8080
  1047. 59.103.164.174:80
  1048. 62.75.187.192:8080
  1049. 67.225.229.55:8080
  1050. 69.164.201.54:8080
  1051. 78.24.219.147:8080
  1052. 80.11.163.139:21
  1053. 80.11.163.139:443
  1054. 85.104.59.244:20
  1055. 85.54.169.141:8080
  1056. 86.22.221.170:80
  1057. 86.98.25.30:53
  1058. 87.106.136.232:8080
  1059. 87.106.139.101:8080
  1060. 87.230.19.21:8080
  1061. 91.205.215.66:8080
  1062. 92.222.216.44:8080
  1063. 92.233.128.13:143
  1064. 94.192.225.46:80
  1065. 94.205.247.10:80
  1066. 95.128.43.213:8080
  1067. ```
  1068. #### Epoch 2 - Spam C2s ####
  1069. ```
  1070. 23.253.207.142:8080
  1071. 185.187.198.4:8080
  1072. 46.228.205.245:4143
  1073. ```
  1074. #### Epoch 2 - Stealer C2s ####
  1075. ```
  1076. 185.42.221.78:443
  1077. 198.58.112.7:443
  1078. 46.29.183.210:8080
  1079. 209.141.41.136:8080
  1080. ```
  1081. #### Current Epoch 2 RSA Public Key ####
  1082. ```
  1083. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhALk+KlHgOKXm9eDkWu2yN9lanjwOm6W2
  1084. PV0tgr4msNVby2pOJ6S1MZQnQwxl7y6WWzT4kveAQhLmW8JB2M2PDOxZOgVMJH2C
  1085. AtkVW1p/P9jNJWVvjK9SmrbLdIeiKNtRfQIDAQAB
  1086. ```
  1087. #### Epoch 3 C2s ####
  1088. ```
  1089. 113.52.135.33:7080
  1090. 138.197.140.163:8080
  1091. 143.95.101.72:8080
  1092. 144.76.62.10:8080
  1093. 154.120.227.206:8080
  1094. 157.7.164.178:8081
  1095. 176.58.93.123:80
  1096. 178.249.187.150:7080
  1097. 181.113.229.139:990
  1098. 181.47.235.26:993
  1099. 181.61.143.177:80
  1100. 181.99.223.250:8080
  1101. 186.10.16.244:53
  1102. 186.146.110.108:8080
  1103. 190.117.206.153:443
  1104. 190.13.146.47:443
  1105. 192.241.220.183:8080
  1106. 200.55.168.82:20
  1107. 201.196.15.79:990
  1108. 203.99.182.135:443
  1109. 203.99.187.137:443
  1110. 203.99.188.203:990
  1111. 212.112.113.235:80
  1112. 216.70.88.55:8080
  1113. 216.75.37.196:8080
  1114. 5.189.148.98:8080
  1115. 51.38.134.203:8080
  1116. 70.32.94.58:8080
  1117. 75.154.163.1:8090
  1118. 83.169.33.157:8080
  1119. 91.109.5.28:8080
  1120. 94.177.253.126:80
  1121. 95.216.207.86:7080
  1122.  
  1123. ```
  1124. #### Epoch 3 - Spam C2s ####
  1125. ```
  1126. 192.241.241.221:443
  1127. 185.187.198.5:8080
  1128. 41.185.29.128:8080
  1129. ```
  1130. #### Epoch 3 - Stealer C2s ####
  1131. ```
  1132. 178.32.255.133:443
  1133. 198.46.150.196:7080
  1134. ```
  1135. #### Current Epoch 3 RSA Public Key ####
  1136. ```
  1137. MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM426uN11n2LZDk/JiS93WIWG7fGCQmP
  1138. 4h5yIJUxJwrjwtGVexCelD2WKrDw9sa/xKwmQKk3b2fUhwnHXjoSpR7pLaDo7pEc
  1139. iJB5y6hjbPyrSfL3Fxu74M2SAS0Arj3uAQIDAQAB
  1140. ```
  1141. #### Credits and Notes Section ####
  1142. ```
  1143.  
  1144. WARNING - Some links may have been taken down shortly after I reported them to URLHaus.abuse.ch
  1145. because they rock and report everything to ISPs as it is confirmed to be malware. Additionally,
  1146. this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
  1147. https://pastebin.com/u/jroosen
  1148.  
  1149. NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
  1150. I am providing them for your benefit in case you want to parse them to be sure.
  1151.  
  1152. ```
  1153. #### What is Epoch 1, Epoch 2 and Epoch 3? ####
  1154. ```
  1155.  
  1156. (09/17/19)
  1157. With the find of Epoch 3 that split from Epoch 1, this section will be rewritten to reflect these changes in time.
  1158.  
  1159. ```
  1160. #### Community Lists/Samples ####
  1161. ```
  1162. https://pastebin.com/rLAxsS1J - @Paladin3161
  1163. https://pastebin.com/6rsXwBrn - @Paladin3161
  1164. https://pastebin.com/Y7Evt8Wr - @Paladin3161
  1165.  
  1166. https://pastebin.com/uerfWhAU - @executemalware
  1167.  
  1168. https://pastebin.com/BYGWgkkc - @reecdeep
  1169.  
  1170. https://twitter.com/b4rtik/status/1184499784754847748 - @B4rtik
  1171. https://pastebin.com/Yi4uPRM6 - @B4rtik
  1172.  
  1173. (sorry if we miss anybody, make sure to send it to @cryptolaemus1 in your tweet and we will try to include it!)
  1174. ```
  1175. #### Credits ####
  1176. ```
  1177. Combination work of the Cryptolaemus Team - https://paste.cryptolaemus.com/about/ and/or specifically the following:
  1178.  
  1179. Doc DL URLs - @devnullnoop, @p5yb34m, @malware_traffic, @dms1899, @Paladin3161
  1180.  
  1181. C2 info/RSA Keys - @CapeSandbox, @devnullnoop, @MalwareTechBlog, @lazyactivist192, @VK_Intel, @Paladin3161
  1182.  
  1183. Payloads - @devnullnoop, @MalwareTechBlog, @lazyactivist192, @TheHack3r4chan, @p5yb34m, @malware_traffic, @Paladin3161, @ps66uk,
  1184. @bomccss, @reecdeep, Anonymous :)
  1185.  
  1186. Spam Templates - @devnullnoop, @lazyactivist192
  1187.  
  1188. Special thanks to @lazyactivist192, @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/
  1189. infrastructure and helping out with this!
  1190.  
  1191. Very special thanks to @Binary_Defense, @lazyactivist192, @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project
  1192. https://github.com/decalage2/ViperMonkey, @digitalocean, @mploessel, @anyrun_app, @unixronin, @hurricanelabs, @MalwareTechBlog,
  1193. @KryptosLogic, @0xtadavie, @MsftSecIntel, @abuse_ch/urlhaus.abuse.ch, @urlscanio, @BlackLotusLabs, @TrendMicro and @Virustotal
  1194. for providing services/software at no charge to this cause!
  1195.  
  1196. ```
  1197. ### Daily Log 10/16/19 ###
  1198. ```
  1199. @ps66uk and @jroosen worked on assembling this report.
  1200.  
  1201. @jroosen here, short on time and trying to pull together what I can. Ivan decided to crank up the hash busting on binaries and
  1202. commented URL injection in the macros to throw off extraction. Today seemed like a lighter day in spam volumes though for me at least.
  1203.  
  1204. ```
  1205. #### General News ####
  1206. ```
  1207.  
  1208. @SethKingHi updated Tracecorn_tina to detect IoCs off of the latest Emotet samples.
  1209. https://twitter.com/SethKingHi/status/1184384668889571329
  1210. https://github.com/seth1002/tracecorn_tina
  1211.  
  1212. @Secu0133 published some data on how Emotet infects Wordpress sites:
  1213. https://github.com/NavyTitanium/Misc-Malwares/tree/master/Emotet
  1214.  
  1215.  
  1216. ```
  1217. #### Drops Report ####
  1218. ```
  1219.  
  1220. @D00RT_RM Observed Trickbot being dropped again but this time in Spain:
  1221. https://twitter.com/D00RT_RM/status/1184457330345369606
  1222.  
  1223. We see daily Trickbot gtag mor* increments lately and I think we are on mor23 today.
  1224.  
  1225. ```
  1226. #### Email Template Report ####
  1227. ```
  1228.  
  1229. I saw a decrease in received spam today with only a dozen or so generics received. I also heard repots of reply chain spam that did not have
  1230. a payload attached. The reply chain would reference an attachment but none existed, also no malicious links were observed either.
  1231.  
  1232. Interesting example of an Italian langauge based malspam from @D3LabIT which seems to spoof @EnelGroup:
  1233. https://twitter.com/D3LabIT/status/1184449846897459206
  1234.  
  1235. ```
  1236. #### Link Regex Report ####
  1237. ```
  1238. (These are experimental, use at your own risk.)
  1239.  
  1240. Looks like only E2 is doing links now and it seems to be some of the old Regex. Here is what works lately:
  1241.  
  1242. These were revived/updated:
  1243.  
  1244.  
  1245. These were not:
  1246. https?:\/\/.+?\/(AMAZON|Amazon)\/.+?\/([0-9\-_]{5,7})\/
  1247. https?:\/\/.+?\/(administrator|academy|alphabet|App_Data|assets|backup|beta|blogs|cache|cgi-bin|checkformats|cfm|consultation|core|css|DANE|Dane|demo|discuss_lib|direc|Document|DOC|Dok|DOK|esp|FILE|function.cheese|gallery|GoogleSpeech|hino|homepage|images|INC|Inf|INF|js|lib|LLC|lm|menusa|paclm|Pages|parts_service|phpmyadmin|Plik|popup_index|public|Scan|sites|sitemap|sox62c|SOUBORY|test|trademark|themes|tmp|uploads|wc-logs|webalizer|wordpress|WP2|wp-admin|wp-content|wp-Enfold|wp-includes)\/([A-Za-z0-9|]{7,36})\/(\"|\n)
  1248. https?:\/\/.+?\/([0-9a-z\-_]{3,11})\/([A-Z0-9\/]{7,32})?([A-Za-z]{7,32})\/(\"|\n)
  1249. https?:\/\/.+?\/([A-Za-z0-9]{8,30})_([a-z0-9]{5,10})-([0-9]{8,15})\/
  1250. https?:\/\/.+?\/(Document|DOC|FILE|INC|LLC|Scan)\/([a-zA-Z0-9]{4,30})\/
  1251.  
  1252. Also keep in mind, your filter needs to look inside PDF files to find the URI to test against these above. Otherwise
  1253. this does not help.
  1254.  
  1255. ```
  1256. #### Payloads Report ####
  1257. ```
  1258.  
  1259. Hash busting is kinda going nuts right now on the EXEs and we are seeing hash busting on distro on the order of 1 every 4 minutes.
  1260. This is one of the fastest paces I have seen them do distro updates for EXEs. Binary payloads on C2 were hash busting at a much
  1261. slower pace of 1 every hour or so.
  1262.  
  1263. Doc payload report:
  1264. E1
  1265. E2 ModifyDate: 2019:10:15 16:36:00 CreateDate: 2019:10:15 16:36:00 staging.smsmagica.com wizard
  1266. E3
  1267.  
  1268. E1 ModifyDate: 2019:10:16 06:33:00 CreateDate: 2019:10:16 06:33:00 complaintboardonline.com product notice
  1269. E2 ModifyDate: 2019:10:16 07:04:00 CreateDate: 2019:10:16 07:04:00 diverzeent.com wizard
  1270. E3 ModifyDate: 2019:10:16 06:15:00 CreateDate: 2019:10:16 06:15:00 zteandroid.com wizard
  1271.  
  1272. E1 ModifyDate: 2019:10:16 07:22:00 CreateDate: 2019:10:16 07:22:00 timurjayaindosteel.com office365
  1273. E2 ModifyDate: 2019:10:16 10:44:00 CreateDate: 2019:10:16 10:44:00 chaudoantown.com wizard
  1274. E3 ModifyDate: 2019:10:16 12:08:00 CreateDate: 2019:10:16 12:08:00 litlyfe.net product notice
  1275.  
  1276. E1 ModifyDate: 2019:10:16 17:20:00 CreateDate: 2019:10:16 17:20:00 pharm-aidrx.com wizard
  1277. E2 ModifyDate: 2019:10:16 14:25:00 CreateDate: 2019:10:16 14:25:00 anthonyconsiglio.com wizard
  1278. E3 ModifyDate: 2019:10:16 17:01:00 CreateDate: 2019:10:16 17:01:00 hirame48blog.biz wizard
  1279.  
  1280. E1 ModifyDate: 2019:10:16 19:27:00 CreateDate: 2019:10:16 19:27:00 barirahb.com wizard
  1281. E2 ModifyDate: 2019:10:16 19:01:00 CreateDate: 2019:10:16 19:01:00 www.ioe-learning.com wizard
  1282. E3 ModifyDate: 2019:10:16 19:14:00 CreateDate: 2019:10:16 19:14:00 zevarcreation.co.uk wizard
  1283.  
  1284. E1
  1285. E2 ModifyDate: 2019:10:16 22:57:00 CreateDate 2019:10:16 22:57:00 keeppcsafety.com/ wizard
  1286. E3
  1287.  
  1288. ```
  1289. #### C2 Report ####
  1290. ```
  1291.  
  1292. 10/16 15:00 UTC only 2 EXE drops for each epoch so far
  1293. E1/E3 C2 have not changed all day, not even order
  1294. E2 C2 have reordered but no IP changes
  1295.  
  1296. all epochs appear to be same C2 list as last EXE from 10/15….
  1297.  
  1298. 10/16 17:45 UTC
  1299. E1 started hasbusting every 3-4 minutes at 16:00 UTC - C2 changed
  1300. E2 started hasbusting every 3-4 minutes at 14:50 UTC - C2 changed
  1301. E3 started hahbusting every 3-4 minutes at 16:45 UTC - C2 changed
  1302.  
  1303. E1 85
  1304. E2 84
  1305. E3 33
  1306.  
  1307. ```
  1308.  
  1309. #### Closing ####
  1310.  
  1311. ```
  1312.  
  1313. Out of time today but home to have more info tomorrow.
  1314.  
  1315. Be on the lookout!
  1316.  
  1317. TT
  1318.  
  1319. ```
  1320. #### Sandbox 10/16/19 ####
  1321.  
  1322. ```
  1323.  
  1324. E1
  1325. https://capesandbox.com/analysis/3365/
  1326.  
  1327.  
  1328. E2
  1329. https://capesandbox.com/analysis/3343/
  1330.  
  1331.  
  1332. E3
  1333. https://capesandbox.com/analysis/3349/
  1334.  
  1335. ```
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!