Emotet Malware IoCs 2019/04/24

## Emotet Malware Document links/IOCs for 04/24/19 as of 04/24/19 23:59 EDT ##
*Notes and Credits now at the bottom* Follow us on twitter @cryptolaemus1 for more updates.


#### Epoch 1 Document/Downloader links seen for 04/24/19 ####
```

http://104.199.129.177/wordpress/jCpq-s0iZCPQx5xqnBlP_AEdeuGuTC-nI/
http://140.143.224.37/fb5sreu/rUyTV-Y7tp5XExAW8btJ_tnkVwCcZ-eCX/
http://3dconsulting.com.au/wp-admin/service/Nachprufung/2019-04/
http://affordableadv.com/wp-content/uTOxd-z1vfxjY4X73xgs_KuTXOWpDx-xY/
http://ansegiyim.ml/wp-admin/Fnfb-WeVViTmArmuja4d_YFblVAAsd-cFT/
http://aplaque.com/wp-content/legale/Frage/2019-04/
http://aqm.mx/wp-admin/QWqh-uqWtpmBaGpMcGa4_eTtBRDAFE-Asg/
http://arrowandheart.com.au/network/Warm-fTJ3q5rgxtTYjGd_GAALtMjvx-tK/
http://atelierap.cz/administrace/NnMOz-8unu6ziajLjbB1J_XTjdLyIb-gn/
http://atmosfera.questroom.ua/wp-admin/nLcmg-pkNIUC5dGrdtTYS_hLrwSNZe-Zxa/
http://auditores.pe/wordpress/cUGTV-Mv57WkQ3GM0CpaW_MVxDZUpCc-Ov/
http://baipopto.org/wp-content/jTwg-VK4IRgMjPa1F2zJ_lwaMmmBKk-IsX/
http://bayborn.com/wp-content/NCrX-7RRVpkX4pDk3Vm_cFgFnrChJ-B3/
http://bdgamz.dspace12.com/wp-admin/zsTm-wKaFSovkIaEhx7e_fMIWgyFRd-xwV/
http://beirut-online.net/portal/service/vertrauen/04-2019/
http://bergdale.co.za/wp-includes/tnmn-97rymQGC3tjn9t_aCLugIKMX-J7/
http://betmngr.com/wp-admin/vIyo-97FBZHy9q4FZJ3o_IqCQUyUZN-wd8/
http://bintec.pe/wp-admin/XCfP-6OmxbcE2meRSZb_yQjRoIGd-BX/
http://biomedmat.org/nKtd-08tW7GH4dnNfRf_MzFePcfQD-oww/legale/vertrauen/2019-04/
http://bluboxphotography.in/wp-admin/runz-kkdyfzmwwomhqc_lhcmlqyxk-j43/
http://breeze.cmsbased.net/ceekh/support/Frage/042019/
http://brendanstead.com/wp-admin/support/Nachprufung/042019/
http://brunocastanheira.com/wp-includes/legale/Frage/201904/
http://bsedilizia.it/wp-content/TMrMP-4P7XNrL2NO2cZF_MhhxfEfMw-tM/
http://butikkanaya.com/wp-snapshots/support/vertrauen/2019-04/
http://caimancafe.com/wp-includes/yqfF-z3DmAqlfc5gJXm3_edmDWMCpU-iGL/
http://cielecka.pl/ilum.pl/gDKg-jo4ezPa3ujsn7qG_jAQZcwJkA-6d/
http://cleverdecor.com.vn/wp-includes/vbFWW-2ZmpzS1K1wQU0tc_nxTjDAJO-xoR/
http://cocnguyetsanlincupsg.com/wp-admin/legale/sichern/2019-04/
http://computedge.com.ng/wp-content/legale/vertrauen/04-2019/
http://condotelphuquoc-grandworld.xyz/faqapig/buaXj-Ktm4EvGI07Ev7jh_EuuzLqBu-fId/
http://creativeplanningconnect.com/lttcjwb/legale/sichern/042019/
http://creditupper.com/cgi-bin/Jelb-X3SvvDzSyGhaak_BZLGuEQl-gL2/
http://curious-njp.com/afterglow/FRTZ-vwTo5aryiVdO2G_HwydbqhJ-Osv/
http://dailyprobio.com.my/wp-includes/orxe-IHud2uJtThOnHR_GVkQQqKU-0y/
http://datos.com.tw/logssite/WyoVX-966EGG3hWBRHpe_tTaULnSgr-H44/
http://djjermedia.com/cgi-bin/JdFP-a3aDTmqaGJrFTS_fhdzBxhpm-u5/
http://ebooksrus.store/wp-content/SlYke-xZnzJSaAo0KVJtm_ElUfurEmJ-KR/
http://edwardhanrahan.com/images/buKy-frDqYyHZwvdz5k1_LeldCrEFl-BW/
http://enseta.com/wp-admin/service/Nachprufung/2019-04/
http://espaciomarketing.com/cgi-bin/NpiLk-iE2k51g3RP6PYx9_YMibeEEWI-N5/
http://estetikelit.se/wp-includes/comQ-yqyXq87QwH63H5_wrIIUYppJ-y46/
http://etmerc.com/12-22-2015/legale/vertrauen/04-2019/
http://etov.com.pe/wp-admin/dOfAA-H2AX8weJCysMpw_AKaGaTWcT-TQ/
http://famille-sak.com/chouchane/azrc-o0NiCV6G9GoMq8_DFXSYhmMG-IcS/
http://fips.edu.vn/wp-includes/support/Nachprufung/201904/
http://fitness-outdoor.be/_notes/nachrichten/Frage/04-2019/
http://flamingonightstreet.xyz/wp-admin/nachrichten/sich/04-2019/
http://fse2020.com/wp-admin/nachrichten/sich/042019/
http://fstvlguide.com/wp-content./ggle-7b5Pwn0HhzlisL_KHnJhITz-qM7/
http://gabeclogston.com/wp-includes/kluQx-H117744StC68Gi7_YhDBwIZfQ-Pjk/
http://gamemechanics.com/twitch/VrPb-rtXO0pdlCXToWCP_PglRUDNjb-vSG/
http://gocnho.vn/public_html/nachrichten/Nachprufung/2019-04/
http://goldsilverplatinum.net/wp-admin/privacy/legal/ios/En_en/2019-04/
http://grosircelanaanak.net/wp-content/legale/sich/04-2019/
http://growa.seojohor.com/wp-admin/UQxc-CK3bJxkNNx0Yfi_vxPumIget-Xmd/
http://hanifiarslan.com/wp-admin/service/Frage/04-2019/
http://harthoenig.de/wp-content/ujZN-ftSlEpT6yiobf0_ziMJdMrCc-wCh/
http://herpesvirusfacts.com/wp-admin/legale/Frage/04-2019/
http://homeydanceschool.com/wp/support/sichern/042019/
http://hqsistemas.com.ar/img/Toczr-LU1xfWdPLVD6Dh_fXrSfYFBj-YO/
http://icantwaittomeetyou.com/code/uTTqN-8q1cjF8SVdBBe0_mhRdkpdS-VtW/
http://icontechsol.com/cgi-bin/VAPo-cbVVTwpJ8d5vVZ_OtdZDQyV-fAt/
http://ikumiyoshimatsu.com/cgi-bin/onxs-RLCrZ8oLCQB73sc_YJwbOkmyh-C9/
http://ilotsdefraicheur.com/wp-content/FZpnJ-IxdLuAWR0l7FrbA_CMyFGsbNu-Wj/
http://imranrehman.com/wp-includes/service/Frage/04-2019/
http://insurgentguy.com/conduct/vFjEB-Bbc6hFlyHx3UKjp_LfnyJHakR-iO/
http://janus.com.ve/bonaire/JRNd-pFL2NYvEtklJNi_lwLZGdQAF-pAt/
http://jpmtech.com/css/kFXa-ohdZZkjvr5kEFYs_dNUVaEiek-HSs/
http://jteldis.com/wp-includes/gOMlG-qxO5fZuPP2MYdV_MWuHvLXp-34/
http://kadapaliving.com/wp-includes/gfvH-bbSki7CBhXsN71b_xWYLNzWK-JgD/
http://karakhan.eu/wordpress/xCLy-kAAnIFs0hPO2Rr_wfuZFggT-DOB/
http://kbentley.com/wp-admin/xzdKg-eCwmVPlJsUiy7u_SiqqyCQCf-DdT/
http://kvclasses.com/wp-content/agid-OiWuoqa8AWTbqYK_PwbLatWEz-ABJ/
http://lacivert.net/cgi-bin/tVfNT-CPhdOGsY4bqTaK_KxQKTxEq-ln/
http://learnlaunch.org/conference2015/MXMEH-XVpoCo1rs3qmoU_fBhYUkZtX-5E/
http://limpiezaymantenimientoflores.com.mx/Castor1/uUep-1nxnpcGKbkvI2z_WILCdpFz-HU/
http://loalde.com/wp-snapshots/pmQc-Pgv2ARoYW8hKJW_HiZYABcb-F0d/
http://mattshortland.com/OLDSITE/service/Nachprufung/04-2019/
http://mindmatters.in/css/EfDw-jnp15vdhLcPzX7_GagwvXuku-JKk/
http://mipnovic.org/ima/OhTO-9v1x3XdqbXYScuE_LBTFvpDD-K1/
http://mktf.mx/ctg/zVoCV-GE3In23Mo9C3UhJ_rkbcNWRQn-Kpq/
http://momtomomdonation.com/dbau/gloGi-VIRBHHojkmch2Qm_ximyZwYR-AT/
http://musaiic.com/wp-admin/oRYz-82Bk8AMbIsJYlk_CvIbxJGh-Zv/
http://musicassam.in/pages/gWAKF-g9satqZnebHmdzL_raAWwWgQz-kP/
http://nathanmayor.com/wp-admin/legale/nachpr/042019/
http://nationwideconsumerreviews.org/jospj/support/Nachprufung/04-2019/
http://naum.cl/8mljmyk/rfCwh-lXqmhVw6CR7tdwf_miUcxvnAZ-GbH/
http://nealhunterhyde.com/HappyWellBe/nachrichten/sich/042019/
http://noticeu.development.vegas/wp-content/kJcH-JnBUIjEdH75Uh7_opPdSNFKW-XR/
http://nownowsales.com/wp-admin/Cuos-PBShUuwstgqaIX_IcatZyAKr-LQ/
http://ntad.vn/gm931mo/DUHP-LhC4EeRQRbivrL2_aaxoXoYt-rQ/
http://oblix.vn/wp-content/GHXu-GJn7fw5BDMkV3g_wFjHtWkf-n0/
http://onion-mobile.com.tw/wp-admin/naBPr-66Wb5OSFmGVPvno_PBvikyGs-uu/
http://opportunitiesontheweb.tk/g7ezsyi/lSPr-jktqleQMVffDCNU_zANLozpca-d7I/
http://pakistani.top/wp-admin/legale/sichern/2019-04/
http://patriclonghi.com/blog/vOyM-L9ISCN799ugxRS_vXxyEfhIw-KWN/
http://personalwatercraftindustry.com/wp-includes/support/Frage/042019/
http://poomcoop.kr/wp-includes/oGLNj-UhxsVE4iYZBynR7_lYvrSGRuO-OT8/
http://powerfishing.ro/pdf/cXIF-OZJg9sG8cS67aI_ZCJrTUtA-If/
http://provanedge.com/wp-includes/zhze-rZqOJxUBcs2wMlX_TECXwTzPM-yPe/
http://provio.nl/collector/nachrichten/Nachprufung/04-2019/
http://pureprotea.com/ynibgkd65jf/IjpU-jPXjRcx2PfQ9tT_NhYiukhD-ZP3/
http://pursuittech.com/css/LIkHk-N4GVEFBLPpQMLxu_fGTAYZua-nG/
http://qpondhk.com/testimonial/yGck-5TpYDA5KuRTfSW_WvwnoZou-QYB/
http://quirkyproductions.com/App_Data/bgYzb-05sill9EWwTFM2_QifrTbQzi-VI/
http://radsport-betschart.ch/sgqlzly/kUcy-snblvucCTnIblFB_VKWKRCjXA-yuG/
http://radwa.0mr.net/wp-content/LHjxl-tTmLIax7vyXDhU_bzDUazuW-ei/
http://ralozimper.com/cgi-bin/WLmNl-gJdgTrL4ga3IgWs_oyyNGIpE-UnO/
http://reckon.sk/e107_admin/service/Frage/2019-04/
http://rmi-vejr.dk/webfiles/xdHX-0wCMVEO6zpnViF3_VCGJEYnn-69/
http://rsnm.ac.ug/wp-content/legale/sichern/04-2019/
http://sampling-group.com/local-cgi/QpKeU-RaYLh0x3yPH5TAX_XQpqAwIAs-h3/
http://samsonlineservices.co.ke/wp-admin/legale/vertrauen/042019/
http://satcabello.es/tienda/Wxim-lioWfDgcwtkTzbZ_ThNJVwFuD-5T4/
http://sebastien-marot.fr/webmail/JnqxY-aZnaa5i8b1JixE_OJDGCHVrQ-K7/
http://seoclass.lidyr.com/wp-includes/JoQN-jIHX4ftPHaz2rE_WrCKIBOxF-oDk/
http://sercommunity.com/wp-content/adFX-qRdKHwPQvQJxJl7_ZdIdwhwNT-LO/
http://sftereza.ro/administrator/nQzt-rxMNu1ydQwUhY4_vfqtnqoA-CF/
http://sgbjj.com/wwvvv/rAQft-5ukvkUXZlfikY3m_lHnNcHeX-o7M/
http://shahrenarmafzar.com/wp-includes/PZNs-sN6QRSwmlGNpLKr_DHSwCkSCH-0Np/
http://signsdesigns.com.au/bairdbay/iRsA-NEJ5Q17DRSa1kk_DZWrMvIEQ-Y1z/
http://simplyresponsive.com/wp-admin/legale/sich/2019-04/
http://sistemahoteleiro.com/clients/OSnp-tyhWcLekgM4xa4t_GUpZfmye-sY/
http://slotjumbo.com/wp-includes/support/nachpr/04-2019/
http://soopllc.com/wp-content/NzxeD-y99E3nCIvKj9dK_KXJHUZFb-A85/
http://sowood.pl/wp-admin/legale/vertrauen/042019/
http://studiopryzmat.pl/cgi-bin/Fhei-qsgqotDjL1QwL1_hPMFhKnzf-0n/
http://taller2019.tk/wp-includes/LVsIz-Prll4Od5PtIJIL_vTmUePArW-e7/
http://taxibreda076.nl/wp-includes/nachrichten/nachpr/04-2019/
http://teamsofer.com/store/service/Nachprufung/04-2019/
http://terraoferta.club/wp-content/ASCGL-4niwmOutQoDBriX_DdhbAaOz-TfX/
http://thanhlapgiare.com/wp-admin/nachrichten/Frage/04-2019/
http://tierramilenaria.com/wp-content/legale/sich/2019-04/
http://timdudley.net/roadtrip/cOrI-hw4eRbcDzbngxd_jyshkOuP-bS/
http://tongdaigroup.com/bill/TRXZ-G0yMOIETH0t3NSS_OBoOmlIv-zs/
http://ukr-apteka.pp.ua/wp-content/legale/Nachprufung/04-2019/
http://uranum.pro/wp-admin/Wptk-UQ81aANhEYV5Ef8_BInuybTVP-Yq/
http://vatanpays.com/wp-content/Ravk-EYdJUFiQKmzCNtD_EniXfBQak-iGv/
http://vejovis.site/images/cGZG-V65jo7EtO7CPuq_pjbWAoNZ-nAq/
http://videcosv.com/backup/nachrichten/vertrauen/042019/
http://vision-4.com/business_growth/support/Frage/2019-04/
http://walworthbar.org/wp-content/yKiZk-JGLzLWCxQTFlLS_XnLBBejJF-9t/
http://waterplanet.com.br/eunoseua.com.br/uCjf-aDGuXcyXgcHH57E_bbbhNGJgX-SD/
http://webszillatechnologies.com/i9d2pu1/support/Nachprufung/2019-04/
http://winnersystems.pe/wp-content/legale/nachpr/2019-04/
http://www.178zb.com/avcupkl/NvcQ-rfnG475DC0RMEv_EkVYWFIk-Mf/
http://www.bnc24.in/ynibgkd65jf/pZRY-uhyr3zy6akKVt9V_EAviBvop-rdZ/
http://www.fadu.edu.uy/eduper/inscripciones/archivos/xFNqg-xbeQOB00Wb02DE_laUPxWDN-wz/
http://www.fse2020.com/wp-admin/nachrichten/sich/042019/
http://www.goentreprise.ca/sendy/oPrfS-BPtGksZe0Ubr9g_WXfSIzSE-g6/
http://www.iscrr.com.au/wp-content/zTDD-wW1qHNo9lE6GKtU_DSHnniEoV-Wx/
http://www.marcinmarciniec.pl/wp-content/CAZQg-XN0NIClPtVs6Rbj_LJyDVwGRN-ucg/
http://www.provio.nl/collector/nachrichten/Nachprufung/04-2019/
http://www.sinequanon.ch/displays/img/css/UoPQ-yR9VOVE77EexRS_gXrjaqwj-9n/
http://www.sriretail.com/api.Asia/TPDbe-JzyEWbB9Y9wIQ8_mghuAkVNE-vQ/
http://www.whomebuilders.com/wp-content/ldnyw-ZX8YNrtuaecqKfW_VqPocNGp-cR/
http://wyensolo.com/cgi-bin/eNvY-doscI9rpefkqKqF_KfbhypRxg-KPo/
http://xoangyduong.com.vn/wp-admin/nachrichten/nachpr/042019/
https://bostonblockchainassociation.com/wp-content/ryIMP-f4ZHLdFHUP7cIx6_PeVtPJhz-Muq/
https://breeze.cmsbased.net/ceekh/support/Frage/042019/
https://eaziit.com/wp-admin/oTleD-IjgkgZ18MyR4OkN_iTlhUzjCY-PJ/
https://etoiledumidi.de/wp-content/SYmYj-vUf81CaTTM0Q1UT_XOlTGJhBX-rs/
https://grosircelanaanak.net/wp-content/legale/sich/04-2019/
https://hotelpalermosuite.net/hotelpalermosuite/wp-admin/TfJaC-BqPCM0vPOz48Qb_BocxbhCzc-xrP/
https://layanjerepisod.ml/wp-content/kIoq-7iRrAJ1lyAUALW_dKWbdGXf-S68/
https://mahmud.shop/wp-content/service/Nachprufung/042019/
https://masholeh.web.id/wp-admin/nachrichten/Frage/042019/
https://nralegal.com/wp-content/cycgX-ryK6y8khrYk0Za_iTAFvDWIM-aTh/
https://privacydesignstudio.com/wp-content/vfBb-2m34DB9DqXBHT4_DLLrzUpn-KXr/
https://pureprotea.com/ynibgkd65jf/IjpU-jPXjRcx2PfQ9tT_NhYiukhD-ZP3/
https://samsonlineservices.co.ke/wp-admin/legale/vertrauen/042019/
https://sandygroundvacations.com/wesm1py/weKH-xFMLDEjkkgFspf_lpxgksuoa-y3/
https://shreeyantraindia.com/shreeyantra2/wp-admin/Tvll-yHJtjrVBYXw37a_VpAajxhb-ncm/
https://soopllc.com/wp-content/NzxeD-y99E3nCIvKj9dK_KXJHUZFb-A85/
https://sportingclubmonterosa.it/wp-includes/XTxto-DeDWeAb2OMycIL7_kljdShnJ-h9n/
https://stockarchi.com/wp-admin/jEhL-3wng83CY9PMUBBb_AgqLOVNTp-tN/
https://sulovshop.com/wp-admin/YgCO-w0Mr3uD8XLkWM9_pWtgeokGH-AF/
https://villeprudente.edithdigital.net/wp-includes/CvUEm-VnzYg59gtpVhstF_ZlfcDkfov-lA/
https://whalefinance.io/adminlogin/cKwCL-cYqtqWFOGRFyb2f_ApHcxTArF-ai8/
https://www.bossesgetlabeled.com/taewcau/ocdw-rLoi4zx3dQd9OC_euTuwNuQ-Ej/
https://www.glamoroushairextension.com/wp-content/OBoU-afyT3EHedEDMwlq_TmmXtVIk-tD/
https://www.goentreprise.ca/sendy/oPrfS-BPtGksZe0Ubr9g_WXfSIzSE-g6/
https://www.la-reparation-galaxy.fr/pctjrn/UTzZw-M0O22JoUSBUvl7x_brNQiYLez-h5/
https://www.lifeandworkinjapan.info/g843gh-nravlk-dhnes/EbvM-kOCuuwvA8uJ8iVm_EcreEcBH-qs/
https://www.virtuoushairline.org/8zqijve/Ahuif-ZxekSxDiH98LSO2_DjwvPBGx-GQ/

```
#### Epoch 2 Document/Downloader links seen for 04/24/19 ####
```

http://111.231.208.47/wp-content/4fsjac-9jrscns-vzalyq/
http://114.115.215.99/wp-includes/FILE/tqT1CIrJY6xF/
http://118.24.9.62:8081/wp-content/l01152m-n4a8k8m-fblo/
http://118.24.9.62:8081/wp-content/z0w21-ihuzt-bwsvjw/
http://118.89.215.166/wp-includes/LLC/XFOeTtrg02ii/
http://35.185.96.190/wordpress/9sca-qivlah-rhkyhf/
http://3dd.co.kr/wp-includes/y5tu9k4-olyse-dslain/
http://68.183.44.49/wp-includes/DOC/4DMwnXGd/
http://7uptheme.com/wordpress/DOC/8LSIltWlUxC/
http://adorale.cl/cgi-bin/py1zgzs-tycc8qp-kbbgq/
http://agenda.cdminternacional.com/wp-includes/INC/uyjohYxvrF/
http://agipasesores.com/Circulares_archivos/gvzsj-rub4y0-pltcc/
http://airmaxx.rs/nulvt-xbrcbp-yfcpetgo/Scan/TsOu8ccYMEKe/
http://al-othman.sa/wp-admin/LLC/QUVPR0M5lDKF/
http://alphaconsumer.net/css/Document/g97i7fWWoCVB/
http://animalclub.co/wp-content/INC/ma9oNRz8wQw/
http://anphoto.tw/wp-content/uploads/DOC/QyGn5EmGqKx/
http://apsblogs.com/wp-includes/2r09i5-4iapze3-qrbdwk/
http://aqua.dewinterlaura.be/wp-snapshots/FILE/YAgKZrSXz6O3/
http://ardali.eu/picture_library/Scan/6WL5AdIEx/
http://arts.directory/fscure/0iuw-ru073-qqapjsf/
http://atlasmuhendislik.net/wordpress/FILE/2Tydo8yC0XqZ/
http://atuntaqui.travel/wp-includes/LLC/FwCREXjzhO0s/
http://ayrislogic.com/wp-admin/DOC/YTiIvWyI/
http://battremark.nu/wp-admin/DOC/zp1ItAsYb/
http://bethrow.co.uk/GOYBWNH1797207/nbsddu-cjls3-vdayncw/
http://biomedmat.org/nKtd-08tW7GH4dnNfRf_MzFePcfQD-oww/FILE/wjq7bytlYd/
http://blomstertorget.omdtest.se/wp-admin/Document/CVUKNr2Y/
http://brightbulbideas.com/cgi-bin/62amtj-ac4ww5k-ecduhrw/
http://brightbulbideas.com/cgi-bin/tk72-ozym9-hqzmukc/
http://bryanwfields.com/image/DOC/nfhkRoTb2w2g/
http://burkebrotherscomics.com/wp-content/INC/4orW31nUs/
http://cafepyala.com/wp-admin/FILE/HxtAzurSY/
http://capaxinfiniti.ml/wp-includes/FILE/ALT8XVK1uM6/
http://cftrtest.agentiacreative.com/wp-includes/Document/XODmvThQGR/
http://chabadmarbella.es/wp-admin/FILE/RLqwMqNDo/
http://chigusa-yukiko.com/blog/Scan/KjfXQY3g6/
http://classicimagery.com/System/h2a1y-flypbs-wotucw/
http://cl-closeprotection.fr/wp-admin/LLC/mVMLFYH7gEj/
http://craftsvina.com/testgmail/INC/SUhOaKGe2i/
http://crystalclearimprint.com/cgi-bin/LLC/9SIQf2P01N62/
http://ctm-catalogo.it/cgi-bin/Scan/ZlZMNgfA/
http://datatechis.com/dis4/csaw-5qo8nds-uvrl/
http://diatisa.com/wp-includes/INC/xC65sdXU/
http://disbain.es/wp-includes/FILE/abTikdEl4LLH/
http://disuenacc.com/blog/Oiraf-ZTHYLHF3m3jI9fX_LmtIskllm-bF/
http://dobcast.uy/wp-admin/LLC/xAGsvCYB/
http://drwilsoncaicedo.com/wp-includes/FILE/E0vGepiG/
http://easymoneyfinance.co.uk/wp-admin/INC/CoU6QAFhXj/
http://elcampestre.cl/wp-admin/LLC/iuAX7AIf9/
http://elko.ge/elkt/wp-content/uploads/FILE/q29V0JkZil/
http://encoreapartments.com.au/wp-content/FILE/TMA0T5grR/
http://entrepinceladas.com/resources/9d98-ziodn-dbnohmg/
http://erp.helpbell.in/wp-admin/DOC/WUeEanHMa3P/
http://esdethio.org/images/LLC/AqzD2aTz/
http://estudioparallax.com/cgi-bin/Document/yDFzpY3g/
http://eventsbyamy.com/cgi-bin/FILE/mblXdsktxlE/
http://fanzi.vn/wp-includes/dhrb-zx009-teqy/
http://feryalalbastaki.com/kukuvno/i34ji-wrdmk-uthuz/
http://gged.nl/geocaches/Scan/iXSNbrLd/
http://heke.net/images/bbg1b-vs6ixrv-uaoajps/
http://i-genre.com/wp-admin/INC/UOx4oHA0/
http://impro.in/components/Scan/RZpKnOv4/
http://imranhabib.net/wp-content/Document/DtV3DRQ0/
http://inbeon.com/sites/LLC/kveTY3E5agl/
http://ione.sk/isotope/INC/36iO9PRRdX4/
http://janetjuullarsen.dk/ydcb7-9ftb6-beob/xgxq4s-kxsfq9h-mybfwns/
http://jobspatrika.com/property/Document/amH5RVYp3/
http://joytothefilm.com/wp-includes/Scan/Rx47SZjPyQuI/
http://jycingenieria.cl/images/FILE/LETTGgztM/
http://khrystyna-verkholiak.com/wp-includes/LLC/uraavPRH/
http://klex.com.my/landing/Document/IBWC41ZInpH/
http://knappe.pl/wordpress/onEoc-5mo0KLQHPDgaKCo_lodWkbXC-wK/
http://kodlacan.site/wp-includes/FILE/SAl08ftR/
http://kokenmetfilip.be/kok/Document/r9s1S6ItDe/
http://kool.lk/webalizer/DOC/MdeTljhd/
http://krisen.ca/US_us/images/fe9m3g2-c5qj9la-arfra/
http://lauraetguillaume.corsica/searchmatch/DOC/6FRXy1yZ/
http://lotussim.com/Scripts/LLC/9z2IjISvue/
http://madancpa.com/nlqog/FILE/d156kkAt3/
http://malanlouw.com/cftp/Document/kN8t32Ym2DH/
http://marketingstrategy.co.za/cgi-bin/5dpiaz-8vog5-tnma/
http://martinadesign.it/wp-includes/INC/B0kjZ0n4XJR/
http://maservisni.eu/includes/Document/gpv5yxm2o/
http://mavrelis.gr/file/mbvw8-edzyrmb-vmcvq/
http://mc-squared.biz/note2/fnrm-5rp5fd4-rrgob/
http://mehpriclagos.org/wp-content/INC/23XRpe1UWY8t/
http://mehpriclagos.org/wp-content/INC/76qDvjmA7yfl/
http://memorial.evoltdevelopment.com/wp-includes/DOC/vTCdyzCOc/
http://miasteniagravis.uy/wp-content/DOC/kpEncVkAjM/
http://mifinanciera.info/wp-includes/INC/S9nfAoVrg/
http://mindmatters.in/css/4chzc-is6fhy-ytdjey/
http://mmanmakeup.com/cgi-bin/o2u4a-na5zzch-odcp/
http://mumtaaz.co.uk/wp-content/LLC/5yww2imJJG/
http://municipalityofraqqa.com/add_post_auto/Document/HS7z4tGQZMPR/
http://mysprint.shop/wp-content/Scan/wPpd9j7U/
http://mywebnerd.com/moodle/FILE/PPFvPjw2MMO/
http://nealhunterhyde.com/HappyWellBe/qfdsg-hrr1t0-wzvm/
http://nehty-maki.cz/wp-content/LLC/A4LYwMGwFg/
http://odiseaintima.com/wp-content/sualnv-9pk89-nuangdj/
http://okberitaviral.com/wp-content/LLC/gK1FM3haEHz4/
http://omegaconsultoriacontabil.com.br/site/hzyeo-3zf1af-zdptehs/
http://omnieventos.com.br/INC/DOC/K9HhF1LZ6/
http://onestin.ro/wpThumbnails/Scan/BiKidQ60Zd34/
http://overtakenlives.org/wp-includes/Document/HsHURlvw0OLV/
http://ozkayalar.com/admin836cnxhpb/LLC/rm7o1nlYgBWP/
http://passelec.fr/translations/LLC/qRDToP0zp4bL/
http://passelec.fr/translations/m0pxg-3v1hm8-ljwe/
http://pcsafor.com/coches/qual-0o8ok-qslzcn/
http://pemasac.com/css/yulu1l-1iw2hch-lhwmpdz/
http://phileasfoggtours.com/wp-includes/Document/wggBiUQLsX/
http://pilgaardsvent.dk/images/DOC/VYeSYABk71u/
http://pilyclix.cl/wp-includes/Document/WS523Fhz/
http://pjbuys.co.za/EN_US/Document/a18kIBWyXuQo/
http://popmktg.com.py/wp-admin/Document/dDczM3ecB8/
http://powells.me/lisa/y53d-4uybe-ruqvzob/
http://pritsep56.ru/wp-admin/DOC/A2qlJhAUOxD/
http://privatekontakte.biz/wp-admin/Document/2S2lxu0vT/
http://profhamidronagh.site/wp-admin/INC/Fa5Sn0Ww8/
http://pufferfiz.net/spikyfishgames/Scan/iION9gxu/
http://purasana.si/wp-content/INC/KmdR3A9jV/
http://quercuscontracts.co.uk/wp-includes/INC/5ouIPICYLk4E/
http://raorizwan.com/mail.nexitsystems.com/Document/5PLisWZZNO/
http://rapidcreditrepair.ca/wp-includes/Document/TkVavoOq/
http://realhr.in/wp-content/DOC/T3V3WCkjMF9Y/
http://remocon.cl/wp-includes/DOC/6cSaiUiG/
http://rexpc.dk/wp-content/59co-x7y3sb-aiik/
http://rezontrend.hu/mail/Document/LNC16To5t/
http://rgrservicos.com.br/import/x1yot-7cu9k5-whciy/
http://ricardob.eti.br/cgi-bin/kv2c69-a7v7ch-xukd/
http://rigtools.net/wp-content/6fi1b-zt1wj-vobpvs/
http://rinconadarolandovera.com/calendar/Document/SoACKdI7e/
http://riskcare.com.br/view-report-invoice-00001951/j6ugg-p6zr5x-asypxg/
http://semassi.com/wp-admin/LLC/HqXIRuIWdq/
http://ses-c.dk/n_C/FILE/aSnft1Hwu2/
http://sevensites.es/D1J/Document/fnYAdd2PhnzM/
http://seyrbook.com/assets/Document/rHAQUeM7/
http://shopbikevault.com/wp-includes/hymu3o-9fy8o-dbmzu/
http://shopiqtoys.com/wp-includes/DOC/nzDyFUicw/
http://slvwindoor.in/images/Document/1nAohtzrtq4P/
http://smxaduana.ec/wp-content/INC/LV9mZinm9P/
http://snprecords.com/wp-includes/INC/BGTvIdzlHcaV/
http://social.nouass-dev.fr/wp-content/Scan/wyEE4EIpx7U/
http://sonargaonhs.edu.bd/cgi-bin/FILE/lTXDXOa54miw/
http://spalatoriehotel.ro/iow6whl/LLC/4433Gmklo44/
http://stillerdigitaldesign.com/wp-includes/FILE/chYJWyDM6zc8/
http://suksanhost.com/meeting/LLC/mv68l91x8No/
http://sumomotoanzu.xyz/eg13sxo/3fn1m8-o76od-dpir/
http://superglowreno.com/wp-content/Document/WJZUjNLtg/
http://svadebki.com/js/Scan/Poq9F9ZJLGq/
http://swandecorators.co.uk/journal/FILE/YPzIhLzz00nH/
http://swiat-ksiegowosci.pl/attachments/Document/5OPeWvisGPV/
http://takapi.info/ww4w/Scan/Rlp1F2m8zMzR/
http://taltus.co.uk/Scan/b0ffrHACxaDd/
http://techcityhobbies.com/cgi-bin/INC/QoQ9RqkG/
http://tedbrengel.com/enmemtech/Scan/hqQEbIHYD7/
http://terifischer.com/LLC/XIV61hHl/
http://terminalsystems.eu/css/Scan/4mj5ZciY/
http://thatavilellaoficial.com.br/spmuuhl/LLC/6RvzAezGPE/
http://thecoldfront.com/download/Scan/29pOkxBFdssb/
http://theothercentury.com/FILE/8WWR9Qet/
http://therundoctor.co.uk/dev/Scan/rjdkopyMgvkd/
http://tigerlilytech.com/INC/qVCXDxrgw0B/
http://tincafrica.com/wp-snapshots/Scan/oe3NoAD9/
http://tjr.dk/amsterdam/FILE/ft0F6LiwheI/
http://tklarchitect.com/Scan/MwrYUgca4/
http://toggwyler.ch/Dateien/FILE/GkBjSENn/
http://trident-design.net/agcrm/Document/hk54nKkIqVNn/
http://triton.fi/trust.myaccount.resourses.net/FILE/EsXUw0x2/
http://turisti.al/xh25ohq/INC/0k4ZIBvU/
http://upick.ec/wp-content/Document/OnbeiBId1Q/
http://victimsawareness.com/upload/Scan/oHc3Wj27EqyO/
http://wallbenordic.se/nyhetsbrev/file/l6pfd3yi5fv/
http://watelet.be/form_check/FILE/GxMXZRNYhrj/
http://webspinnermedia.com/journal/DOC/xPTqMtQUHipO/
http://weizmann.org.au/wp-content/Document/tD0wPvJKpcnY/
http://whistledownfarm.com/dev/Scan/VqWVdIgBnFLO/
http://wp.clip.mx/wordpress/LLC/gByL2rLK/
http://www.bnc24.in/ynibgkd65jf/Document/hn9sojMa89au/
http://www.completedementiacare.com.au/wp-admin/kk3nxjl-id2whjq-gfct/
http://www.michelebiancucci.it/ynibgkd65jf/LLC/8wYja8oo9sm/
http://www.ostrichkitchens.com/zohoverify/FILE/WQyQYjnck/
http://www.schoolw3c.com/wp-admin/INC/HZyoozieuRO1/
http://www.versatilehairshop.com/m8gzo1y/vgrhvk6-ik615-gohar/
http://xinhkorea.com/wordpress/v6qp-14la8a-siubg/
http://youngsichoi90.com/cgi-bin/Scan/mZd3DSGLX3sm/
http://yoyoplease.com/ebay/FILE/8NUrTGbHy/
https://catba.goodtour.vn/wp-content/plugins/adventure-tours-data-types/assets/fonts/sdpa-bnho3jd-pgqqiuq/
https://codeproof.com/blog/wp-content/Scan/P6Ub1lpPgM/
https://computerschoolhost.com/wp-admin/LLC/3t7fsAGGp/
https://dekbeddenwinkel.eu/css/DOC/Dz9OQ5fRl4/
https://encuentraloshop.com/wp-admin/itjqjo4-tvzej3e-ahzs/
https://fastrxtransfer.com/cgi-bin/Document/BWEX8Ci6QH/
https://jillysteaparty.com/wp-includes/DOC/ADfgCIQjz/
https://madinascreen.com/backup-1513853205-wp-admin/LLC/DnvMScDY9CMG/
https://maxfiro.net/wp-content/Document/jGqdP9IiGDL/
https://mybigoilyfamily.com/vrjq0aa/FILE/R9HmTHv9U/
https://placemats.com/shopimages/DOC/nzHb3osfHVP/
https://sblegalpartners.com/wp-includes/Document/48MOBvTnTEO/
https://sulovshop.com/wp-admin/INC/kVhF9AlSSx/
https://tempatkebaikan.org/wp-content/hkdyi-ejgvuud-xuoon/
https://vastralaya.shop/ynibgkd65jf/Scan/ToKGN8vSc/
https://wallbenordic.se/nyhetsbrev/FILE/L6pFd3yI5fV/
https://www.completedementiacare.com.au/wp-admin/kk3nxjl-id2whjq-gfct/
https://www.onechampionship.cn/p/83fomio-a0ucst4-vtdh/83fomio-a0ucst4-vtdh/
https://www.veryplushhair.com/wp-content/FILE/RMkSgxCpCNbn/
https://xn--bobleslring-g9a.dk/wp-admin/DOC/TkeLjc2N/

```
#### Epoch 1 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-04-24 17:00 (JS Based - Fake Error)
SHA256:
b7fd23feb71f19a87e0130334f8dcbc28479db18fbd6ba0a89e9a64dc525c919

http://al-awalcentre.com/wp-content/Q2sF/
http://thetechbycaseyard.com/wp-content/fGNyT/
http://ichikawa.net/wvvccw/CtwFb0/
http://naasgroup.com/cgi-bin/Zqoy/
http://paulklosterimages.com/cgi-bin/JKJJ/

Creation Time	2019-04-24 17:00 (JS Based - Fake Error)
SHA256:
fefeae81b80a964d3c5ea9071faa2c207766e7b929a15049a4aa2087e56684da

http://yoursonosbeam.com/wp-content/QJLA/
https://atmetzger.com/wordpress/bKS5b7/
http://rahsiabisnesaiskrim.com/wp-includes/QjzB8/
http://rostwa-engineers.com/wp-content/Wou1/
http://okna.landok.pro/wp-content/EiJeIH/

Creation Time	2019-04-24 10:10 (JS Based - Fake Error)
SHA256:
f9a3d8d2568059bff0da6d27fe8d474fa8dc1c0f97c24433f2fd9caed3594b0f

http://proxectomascaras.com/wp-admin/ckTXbb/
http://chinamyart.com/wp-content/Xd/
http://ulco.tv/1v7wu20/0OoR/
http://mktfan.com/admin/Qq0b/
http://psselection.com/YGLhPE/

Creation Time	2019-04-24 09:15 (JS Based - Fake Error)
SHA256:
da2d68c98cb3e9214a1e0bb58fc5fcd77c1435e63282c0602f085f56f6aa3e29

http://proxectomascaras.com/wp-admin/ckTXbb/
http://chinamyart.com/wp-content/Xd/
http://ulco.tv/1v7wu20/0OoR/
http://mktfan.com/admin/Qq0b/
http://psselection.com/YGLhPE/

Creation Time	2019-04-24 06:30:00 (DOC Based - ENG - Upgrade Blue Box)
SHA256:
31f99b50ecc49f8fdfb2225956fe186284134f056f522e55abeb52ca8b05540e
9232b0e010c1cedde8ff734bec0c473c1a5ba9d0836be731d58f64114d485a97
dd4acccee0f9d16e7be57551999e0460bb956c1f9f714a16c3f109f6fc95eecf
96bc6ce2069d2d01140d9b84432a2c04fe2d876e6bc6b2ffb355e1f80fa7edf8
23988dc5258042cfb2919c1647fc977789aab07461db0b244fe5efbde82885e0
aef4fa94ec2674fb4e875b28b735b36451a53f61a92cf81264a0170e5b1a7e7e
c42bd3cca2a7117891a81dea46419a8dabd8e283c6e15766c02fc7e1afba2a5f
ef118dea5d65c66dc62270b0c2dac34416c4115d8cc91a7ddf8861c10ad7a44b
0450bfede94b319cea0c9c2f42fee0dd63677fc3b04491bf348bf14fd7df87ab
15b76f000b9a6bdc9237b8b67e2c3e63b5bf72a09b746bdc531de99c14362fd1
dcdcd740a370f31b590b6e9ede9e414b20c3406c8aeb6022d3124072467c1433
b8863d1bb6f3091b275feb6424511286678da11a656c283f9585ce8f4d4050cf
c73c9d8340438ecfcad1f82d3b1a2726858de091df6946cf3c62990d8dbfc469
c89c4a93830f003dfc0192b8b45c334872b98ec57f081fcfed7976ca4fb344c1
9a20aec7e3d27e1f88cebf6f4bcdf8a8341c61ce4adc733eb0ce049396e586ac
ce9a9f8bf2b7042befa0fca4a99e8ec872a93ff80f66c650292b8c8a867ee516
bfc6f5780109d9395f042d83bf54f5bd0b45a0f4a511181e0f0b7f65e6768442
f2ca1be6fadcbd642359443791267c1b558470906bf14b3acf729a7cb4f5c6ad
175760d1dcd979c2788445a77c9e9c52d422f77e8412c6f9acaabdbd65fe7c84
8f2002168bbdff63ed1e3e257d470ac5f3579a68a2412543f937cbe0e3e7d43e
5d7e5147091fb427b5b8859e9ce0a6ed4c30f753dae6ee3ccbf102e8fa1a4160
a47517f38b6f8c05c447096e6d386052c2518867e3fb2853682b575b7eb011d3
4340cd8411620a8f67f36170a35394617ee0f1af6c7f9e2901b57990e5118e82

http://urogyn-workshops.com/wp-admin/P5pe/
http://adsez.phatphan.com/wp-includes/Vzj/
http://dkw-engineering.net/menu_2018/v13XL/
http://jaspinformatica.com/boxcloud/Joyjk/
http://judygs.com/there/IUGE/

Creation Time	2019-04-23 16:25 (JS Based - Fake Error)
SHA256:
8870927b7fcb804322779608fabf59e1c019245df08aaaf5f9202d131e92efda

https://sundarbonit.com/xd/A9N4/
http://potterspots.com/cgi-bin/8MnY/
http://sandovalgraphics.com/webalizer/Xfje/
http://nexusinfor.com/img/pjVK/
http://recepsahin.net/assets/F2f/

```
#### SHA256s for Epoch 1 Payload EXEs seen on 04/24/19 ####
```

358685bd63f4e40864316f226a77e67fa99da1329feba49a6e2d99dd7b6a7a63
323154c4cb75b02983bc4e076be06997644eb8852384aa8d92b48131bc085f00
e3510a49bb8cd2e94b61be3aa5e2c02410895fed2f3ddeca1fbbb9c632ffc2aa
92a51def229afa5157283ef666cbc34d2fc88201993de7134c4878176bce2e47
dc5a6cfe386d2b08c9de89553f87933df423796c4860789f8f57055df2bd54f5
fbc18ccb452277f9a80218f3a88846cebc41f5bbcecd22297df0fbd5e20e5f8a
7ba3e12abfb6f04c4d37808543ba56afc33b46fed724d47a98efaea85ba12112
d424357f24c29c8759db839bb6facf0beb642b62e01802b0f9bd3ecb81c944d8
00961e243832bc71a6367e29205d7d617a939850a603c3cee7703e4f91128c70
feb37138151dfe1245942002f507878b16bbcaacc62612fdd5188de6f27ac3fb
323154c4cb75b02983bc4e076be06997644eb8852384aa8d92b48131bc085f00
e350efd69893b28033dfa6ba293f402c04281453c766022a266ae6be6fbe31aa
d192e212101c718c80a36a991d3e967f0e9934a6844ce4907b8b5846693e015a
a2aeb5f507d5a5ca62ffc73fa34c825890d9bccd686079a283e37a3d21a0c50e

```
#### Epoch 2 Payloads by Document SHA256 - All Times UTC ####
```

Creation Time	2019-04-24 20:45 (From ZIP - JS Based - Fake Error)
SHA256:
6f785ecc79f5ca6ac6410eed4fa59bbe13ca49cc2e1f3e2bee9412811a6e3036

http://jieyilashedu.com/cgi-bin/ul_H/
http://www.whwzyy.cn/wp-includes/KV_R4/
http://kathiacam.com/sitemaps/x_F/
http://immigrant.ca/wp-content/D_em/
http://elmedicodeldeportista.com/wp-includes/qY_3C/

Creation Time	2019-04-24 13:35 (From ZIP - JS Based - Fake Error)
SHA256:
2bfb1f20958ae98ece5d9625ebf66dd9733d95ec9529bc1cd111ec3e39707d39

http://lisasdoggydaycare.com/wp-includes/zq_e/
https://continentalleap.com/wp-admin/network/B_8/
http://rubricontrol.com/cgi-bin/5_E/
http://duniatoner.com/wordpress/mH_Us/
http://jamessilva.com.br/wp-includes/d_KQ/

Creation Time	2019-04-24 06:05 (From ZIP - JS Based - Fake Error)
SHA256:
a9066aec7f28a0064831b414f765fc536b4643884a73dab06523ffd2d9cb8f4f

http://3546.com.tw/images/I_7C/
http://llona.net/wp-admin/9_UH/
http://riponnet.com/analyticsaeekck/ep_1J/
http://repuestoscall.cl/7_W/
http://renatocoto.com/wp-admin/wL_fW/

Creation Time	2019-04-23 21:05 (From ZIP - JS Based - Fake Error)
SHA256:
a89d55ff31f6d08a85a5d289901fc98d4bfcf5a856ced841496b1bfb951744cd

http://robertwatton.co.uk/uo_LL/
http://sapporo.com.pe/cH_2/
http://search4.ie/includes/O_gK/
http://shot.co.kr/yupdduk717/Zd_R/
http://shawktech.com/shawktech.com/5_nW/

```
#### SHA256s for Epoch 2 Payload EXEs seen on 04/24/19 ####
```

26d3b33686b7a4440a986d56200d53d680a2d2643adf30dfce629f6f5fd24af1
95d709d21907afca6c95b2e6599ebecc75cac82916b9a82ce89d811b948e3180
e16c3e12303df2728d49fa06afa3f922f43baf2f1252075cf34d08635429de5a
0868d9f7d0c81b89ca793d653b778288b9daaba3bb474112aa3c2420fa36a10e
085e6a56fdb7daef2203942cab25721e40c92fc74846a1ba1278afc2c1601a4b
d6acab4d99fff09f3d71b955a0219c2b311687443ec858f61ab1674ce7a3b073
9dc6c539b96a7f7c02a65a995c2cad4ff7a5ccf6f27b849a4bb8748068df797e
f4a9cbef463e4a413bd12fd242753cf5e11c978078e2633c296b30284abbaf20
3de3f82ba6763b3d6b09dea9b7b1badc7d6fb8af4a90eea4689055911f3267dd
b191c5294afff77af89c706c6f77df3da32d1cae0bc19cec49cc17a09b0c15b9
a9f333b29971aff0de5b070be765e3e81135f6477f02afba879bd2638183d563
6d54d5e52aecdd7abca8d6c5ac9fda1464595b96df9bd6b629604bc289cf6ffe
b73d0d387e795267c39d299027c57ab4e610b0e02d79c3b6aac0273e601eedc2
be3e02e26379369f8058b166e51cd05ece579a90889f938cc5f8da2a29b6cea1

```
#### Epoch 1 C2s ####
```

103.201.150.209:80
103.213.212.42:443
107.159.94.183:8080
109.104.79.48:8080
109.73.52.242:8080
139.59.19.157:80
144.76.117.247:8080
165.227.213.173:8080
175.107.200.27:443
176.58.93.123:8080
177.225.175.199:80
181.142.29.90:80
181.199.151.19:80
181.29.101.13:80
181.29.186.65:80
181.30.126.66:80
181.37.126.2:80
185.86.148.222:8080
185.94.252.249:443
185.94.252.27:443
186.139.160.193:8080
187.188.166.192:80
189.205.185.71:465
190.117.206.153:443
190.147.116.32:21
190.171.230.41:80
192.155.90.90:7080
192.163.199.254:8080
196.6.112.70:443
197.248.67.226:8080
197.91.152.93:80
200.107.105.16:465
200.114.142.40:8080
200.28.131.215:443
210.2.86.72:8080
213.172.88.13:80
219.94.254.93:8080
23.254.203.51:8080
24.150.44.53:80
37.59.1.74:8080
43.229.62.186:8080
45.118.216.70:80
45.33.35.103:8080
5.9.128.163:8080
51.255.50.164:8080
62.75.143.100:7080
66.209.69.165:443
66.228.45.129:8080
69.163.33.82:8080
72.47.248.48:8080
77.82.85.35:8080
81.3.6.78:7080
82.226.163.9:80
85.132.96.242:80
88.215.2.29:80
89.135.138.149:80
91.205.215.57:7080

```
#### Epoch 1 - Spam/Stealer C2s ####
```

31.172.86.183:8080
104.236.185.25:8080
50.116.63.9:7080

```
#### Current Epoch 1 RSA Public Key ####
```


MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL9KRKWqcld40xbUZ6hRh+fPNkgJe7K+ 0y1rR0UFqc2SBmnyoR/2Ctd+8MRvU8zri2eNVkVBxCUH1Cthf3AEgRqY2kGva8gJ Wcqls3j7RztZzqFoL+wM9DNnz/OWuiyPAQIDAQAB

```
#### Epoch 2 C2s ####
```

106.51.37.192:80
119.155.153.14:21
119.93.243.2:50000
124.123.42.93:80
133.242.156.30:7080
136.243.117.85:8080
138.201.140.110:8080
139.216.191.234:20
144.202.9.18:8080
147.135.210.39:8080
149.255.56.242:8080
162.243.125.212:8080
167.114.210.191:8080
173.255.196.209:8080
173.255.250.241:443
174.93.130.148:8443
175.100.138.82:22
177.230.108.144:22
177.231.157.189:53
177.242.214.30:80
178.62.37.188:443
178.79.161.166:443
180.150.87.75:22
181.39.51.243:993
186.4.234.27:443
187.189.195.208:8443
190.112.228.47:443
195.99.230.208:80
2.50.52.255:20
201.220.152.101:80
208.78.100.202:8080
211.63.71.72:8080
212.22.215.140:80
213.14.166.152:990
216.98.148.156:8080
217.13.106.160:7080
31.163.99.231:80
45.123.3.54:443
45.249.156.10:8090
45.33.49.124:443
5.230.147.179:8080
50.101.180.172:7080
50.31.0.160:8080
58.65.211.99:50000
58.9.168.7:990
62.75.187.192:8080
64.13.225.150:8080
67.205.149.117:8080
68.229.130.39:80
69.198.17.7:8080
69.45.19.145:8080
70.116.68.186:80
71.78.158.190:80
77.56.253.112:80
78.100.187.118:80
78.149.210.116:22
78.186.5.109:443
82.0.19.40:80
83.110.155.238:8090
84.241.10.111:53
85.104.59.244:20
86.136.28.152:8080
87.106.139.101:8080
91.205.215.66:8080
94.130.35.140:443
94.76.200.114:8080
95.128.43.213:8080

```
#### Epoch 2 - Spam/Stealer C2s ####
```

198.58.114.91:4143
213.136.86.219:7080
91.205.215.10:7080

```
#### Current Epoch 2 RSA Public Key ####
```

MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB

```
#### Credits and Notes Section ####
```

WARNING - Some links may have been taken down shortly after I reported them to URLHaus.ch because they rock and report everything to ISPs as it
is confirmed to be malware. Additionally, this list MAY include doc DL URLS from previous days, see the previous days here to get the full picture:
https://pastebin.com/u/jroosen

NOTE: The doc DL URLS are in alphabetical order now. The community lists below may contain content I do not have in my list.
I am providing them for your benefit in case you want to parse them to be sure.

```
#### What is Epoch 1 and Epoch 2? ####
```

What is Epoch 1 and Epoch 2? (updated 03/07/2019)

I have been tracking Epoch 1 and Epoch 2 since May of 2018. I called them Epoch 1 and Epoch 2 because they followed a different timescale of
payload updates and history. In short, Epoch 1 and 2 are two botnets with distinct C2 infrastructures with separate RSA keys for communications.
Epoch 1 is currently the larger of the two botnets(MAR 2019) and I think it is the main push of Emotet currently. Epoch 1 WAS a smaller more
rapidly changing version of Emotet at one point in the last half of 2018. Now Epoch 2 seems to be the smaller of the two since this time period.
This seems to change back and forth over a 6 month period. Despite having unique unshared C2 infrastructures, these two botnets have been seen
to move bots from one to the other and show similar behaviors seemingly controlled by a single entity/group. E.g. going on breaks at the same
time period.
Here are some observations I have noted since I have been watching these botnets:

- Checking a document download site from Epoch 1 will deliver a document that is different than what is being delivered at the same time on an
Epoch 2 document download site. Specifically, Maldocs on Epoch 1 will have a different document creation times and payload quintets than those
being delivered in maldocs on Epoch 2 at any one time.
- Document hashes change very 10 minutes on both Epochs while distribution/spamming are active.
- Document download and payload URLs tend to become orphaned as templates are changed out and they age. By 72 hours most are no longer updating.
- On Monday's of every week a new set of document download sites and usually templates to accompany them are generated early on
Monday morning/Sunday night.
- Both Epoch's may share a host for binaries or documents but NEVER the same directory. Eg. Epoch 1 may have an EXE in directory host.tld/A and
Epoch 2 may have a document hosted on host.tld/B.
- The RSA keys will change every few months so for C2 communications on each Epoch/Botnet.
- Binaries for Epoch 1 payload sites are different than the binaries for Epoch 2 payload sites.
*- Binaries used to change hashes every 15 minutes to 2 hours but now (3/6/19) are changing every 5 minutes on distro.
- Each binary has a hard coded list of C2 sites unique to the Epoch it was derived from.
- C2s are never shared between Epochs/Botnets.
- Both Epoch 1 and 2 seem to go into "break" periods at the same time for several weeks. During this time binaries are updated every 2-4 hours
via C2 to stay ahead of AV defs.
- Spamming activity seems to cease on each botnet at around 00:00UTC each day. It usually starts back up around 07:00-08:00UTC each day.
- Spamming usually does not occur on weekends and the Emotet team seems to take weekends off.
- The easiest way to tell what botnet a sample is from, is to find the payload and then check the C2s/RSA Key. HINT - CAPE Sandbox makes this
easy now, use it! Thanks to Kevin @CapeSandbox and @pollo290987!
- Changes in behavior are often deployed to one botnet and then to the other as if the first was a test. This has been observed for obfuscation,
spam template, word template, document type and even payload.

If I think of anything else to add or if anyone else has any suggestions, I will add them here.

```
#### Community Lists ####
```

https://pastebin.com/Zx7Z845r - @executemalware
https://pastebin.com/M2GiYUUy - @ps66uk
https://pastebin.com/LMGJAK10 - @pollo290987
https://pastebin.com/3p98x9Cb - @lazyactivist192
https://twitter.com/noottrak/status/1121104719190032394?s=20 - @noottrak

```
#### Credits ####
```
(OC from @JRoosen and/or combination work of the following)

Doc DL URLs - @James_inthe_box, @unixronin, @abuse_ch, @JayTHL @dms1899, @avman1995, @pancak3lullz, @pollo290987, @malware_traffic,
@0xtadavie, @Bitterman59, @devnullnoop, @Bauldini, @baberpervez2, @executemalware, @jcarndt, @gorimpthon, @Racco42, @papa_anniekey,
@Jan0fficial, @shotgunner101, @HerbieZimmerman, @Outkast_TI, @ps66uk

C2 info/RSA Keys - @unixronin, @CapeSandbox, @sysopfb, @pollo290987, @MalwareTechBlog, @ps66uk, @JayTHL, @malware_traffic, @0xtadavie,
@devnullnoop, @gorimpthon, @Racco42, @Jan0fficial

Payloads - @bigmacjpg, @decalage2, @James_inthe_box, @MalwareTechBlog, @ps66uk, @dms1899, @avman1995, @unixronin, @pancak3lullz,
@pollo290987, @malware_traffic, @JayTHL, @Bitterman59, @devnullnoop, @executemalware, @Bauldini, @jcarndt, @gorimpthon, @Racco42,
@papa_anniekey, @Jan0fficial, @OguzhanTopgul, @HerbieZimmerman

Spam Templates - @0xtadavie, @SaurabhSha15, @devnullnoop, @raashidbhatt

Special thanks to @devnullnoop, @2sec4u, @unixronin, @pollo290987, @ps66uk for creating scripts/servers/infrastructure and
helping out with this!

Very special thanks to @capesandbox, @bigmacjpg and @decalage2 of the ViperMonkey Project https://github.com/decalage2/ViperMonkey ,
@digitalocean, @mploessel, @anyrun_app, @MalwareTechBlog, @unixronin, @hurricanelabs, @KryptosLogic, @abuse_ch/urlhaus.abuse.ch,
@urlscanio and @Virustotal for providing services/software no charge to this cause!

```
#### Daily Log 04-24-19 ####
```

General News:

Today the Ivan and the Emotet gang decided to go with more attachments in the morning. I did receive a reply chain template also
that had a DOC file attachments. Only about a dozen malspams today. Also the screwing around with distro and C2 binary updates
continues. I will explain more in the Payload section below.

In other news:

Brad at @malware_traffic got a reply malspam today that was based on a message in his lab account from Dec 2018. He posted this
and the content of the message here:
https://twitter.com/malware_traffic/status/1121069844567404546

Karttoon/@Noottrak - posted an updated list of PCREs for Emotet URLs here:
https://twitter.com/noottrak/status/1121104719190032394

James Quinn/@lazyactivist192 - posted the latest Emotet loader types with rebuilt import tables. He also noted that it was some of
the samples were requiring a Windows runtime environment. Here is his post:
https://twitter.com/lazyactivist192/status/1121248924717715457


Email Template Report:

I received 12 in total and the majority of it was link based from E1. I did get a reply chain malspam from E1
with an attachment this morning. It looked like the following:
______________________
<html>
<body>
=0DYou have a new message regarding your mail.
<br>A printer friendly attachment is now included with each email.<br>Click=
 on the attachment to open or save the printer friendly version of your rep=
ort.
<br>
<br>
<br>
<br>
<br>
Compromised Person Full Name
Compromised@realdomain.tld
<br>
<br>
<br>
<br>
----Original Message-----<br><br>
<pre>
Hello Compromised Person,
_____________________

I added the new strings below in the Review section for threaded templates/reply chain denoted with *'s.

The other malspams were generic Invoice messages like we have been seeing lately with links.

Review:
What we know about the threaded templates/reply chain:(changes are marked with *)

- Emails are sourced from once (or still) compromised users all over the world.
- Emotet injects a reply into a real email conversation thread between the compromised party and another party that replied
to the compromised party on or before Nov 2018 until at least January 2019. (may be up to present) Also have seen emails going
back as far as June 2018.
- Now on E1 and E2.
- Now seeing German based templates that are essentially the same thing but in German.
*- The injected reply is usually prefaced with the following:
"Attached is your confidential docs."
"Attached please find the wire transfer form."
"Thank you for your help. Please see the attached."
*"Load instructions attached"
*"A printer friendly attachment is now included with each email."
*"Click on the attachment to open or save the printer friendly version of your report."
- Both attached and link based delivery of the maldocs/ZIP/JS have been observed.
- Attachments seem to be in the filename format of *_April_DD_YYYY.doc/js so far.
- The link is customized for the display text of the link to show the real domain of the spoofed organization.
- These templates are pretty limited in run and not very numerous.

Link Regex Report:

Regex directory patterns - The following patterns were seen active still today just like yesterday.

E1
\/(Frage|Nachprufung|nachpr|sich|sichern|vertrauen|([DdeEnN_]{2,5}))\/([0-49\-]){6,7}\/
https?:\/\/.+?\/([A-Za-z0-9]{4,5})-([A-Za-z0-9]{14,16})_([A-Za-z0-9]{8,9})-([A-Za-z0-9]{2,3})\/

E2
https?:\/\/.+?\/([a-z0-9]{4,7})-([a-z0-9]{5,7})-([a-z0-9]{4,7})\/
https?:\/\/.+?\/(Document|DOC|FILE|INC|LLC|Scan)\/([a-zA-Z0-9]{8,12})\/

Payloads Report:

E1 had 4 quintets today with a repeat of the same JS file after about 60 minutes.(So it was really 5 but there was virtually
no difference between 9:15 and 10:10s JS files.) E1 did one round of DOCs this morning and then moved on to doing a mix of ZIP/JS
and direct JS.
It seemed liked some of the German based URLs \/(Frage|Nachprufung|nachpr|sich|sichern|vertrauen|([DdeEnN_]{2,5}))\/([0-49\-]){6,7}\/
were the ones doing the direct JS and the other E1 format was doing the ZIP/JS files.
I saw both Link based and direct DOC attachment stage 2.

E1 binaries have been interesting lately and there is clearly active work being done. Slow updates were seen in Distro all night and
morning with spacing at a pace of about 10 hours. The new heavily obfuscated/sometimes Heaven's Gate using new EXEs were seen until
about 17:30 UTC. At that point a flurry of 8 rapid updating old loader type EXEs were seen with about 10 minute intervals. Then at about
19:10, all directories started using the previously deployed 104KB size binary that is heavily obfuscated. Near the time the 8 old loaders
appeared on distro. The 104KB  heavily obfuscated loader 323154c4cb75b02983bc4e076be06997644eb8852384aa8d92b48131bc085f00 reappeared on
C2. Since 19:10 though both C2 and Distro are carrying the same EXEs now of the 104KB or 79KB variety. For more info on these,
see James Quinn's post today:
https://pastebin.com/3p98x9Cb

E2 had 4 quintets today which is a normal count. E2 remained doing hash busted ZIP/JS files all day with link based stage 2 downloads.

E2 binaries exhibited the same behavior that was observed for E1 above. Specifically, we started the day with the heavily obfuscated
and Heaven's Gate using 79KB/104KB binaries. The updates were slow and about 10 hours apart for hash busting. At approximately a
similar flurry of 8+ old loader type EXEs were seen. Then just as it had on E1, E2 switched to heavily obfuscated EXEs at ~1910.
Currently distro and C2 are in sync delivering the same hashes here too.

C2 Report:

C2s did NOT change for E1 and remained at 57 combos in total. - recorded above
C2s did NOT change for E2 and remained at 67 combos in total. - recorded above

Closing:

Ivan is up to something with all of these EXE loader changes but I am not sure what yet. I am sure we will see soon.

```
#### Sandbox 04/24/19 ####
(all with fakenet and MITM unless spam/secondary infection)
```

Epoch 1 C2 run on 2019-04-25 at 01:30 UTC - https://cape.contextis.com/analysis/69258/

```

```

Epoch 2 C2 run on 2019-04-24 at 01:30 UTC - https://cape.contextis.com/analysis/69259/

```