2020-07-29 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
bothwellk@blueribbon[.]co[.]zw
fo@cornerinn[.]ge
izedeen@amsco-ma[.]com[.]sa
kubota@ym-k[.]co[.]jp
liz[.]patrick@serviceroundtable[.]com
m[.]hayashi@ksc-mt[.]co[.]jp
mano@hageten[.]com
matelsa@matelsa[.]com
mori@aishinfoods[.]co[.]jp
pmchennai@forbesfacility[.]com
taller@simsamex[.]com

MALDOC DISTRIBUTION URLS
hxxp://aci[.]serabd[.]com/aci/Document/dqg717m1/
hxxp://agtrade[.]hu/images/FILE/guiex92647391090439xam98iglqqhui/
hxxp://altimira[.]es/img/32-d6uvn-66/
hxxp://aperfectimage[.]pl/arcreative_2/swift/
hxxp://arcapps[.]org/exceledu/parts_service/
hxxp://asomevenar[.]org/cgi-bin/Overview/
hxxp://beenakker[.]eu/cgi-bin/i0zrp8-g44d-2191/
hxxp://botamotocross[.]site/wp-content/lJs/
hxxp://c0140529[.]ferozo[.]com/assets/payment/y3fc6ub1w6/z652607lc2kxgxxjkuq5/
hxxp://campdevanol[.]com/sites/pages/k4dx2-umn95-834/
hxxp://clubyourlife[.]ca/admin/ly6as-ulzn-021/
hxxp://codeconnect[.]com[.]au/wp-admin/closed_resource/verifiable_forum/7UuocHb5B_z7Gpehzc6/
hxxp://coulsongraphics[.]com/js/p9bvk6ns/
hxxp://cryptosistem[.]hr/cgi-bin/report/kfc8w7hl1x/28s9x127186939rchimo8zpwg/
hxxp://cushionsandumbrellas[.]com/sliders/px7-t6-797/
hxxp://cybertech-it[.]co[.]za/wp-includes/browse/1cn9be1r/
hxxp://databeuro[.]com/wp-content/75wc2i7j9y8/ey479017994f8v3ao8x25gnyu/
hxxp://devaux[.]ch/picture_library/Documentation/c2888953404626u50nzzeqecfagwml2jrlf7/
hxxp://digitalmind[.]pl/css/private-array/932466-WoBdUp-forum/55871962983-SMAaZd83LAPt7bh/
hxxp://elementalburn[.]com/7107012102381-23SZF9DZczYzLB-module/verifiable-lxb4xqxarsdu24p-gjvbk/421263-tnzzz/
hxxp://emena[.]org/emena2019/multifunctional_sector/verifiable_forum/0uk_41375sx0w3vu1/
hxxp://empoderacomunicacion[.]pe/empodera/JoPyadDHa/
hxxp://engeserv[.]com[.]br/suporte/common-disk/k0kdeg9jpww-3wrs0h-cloud/942514013204-O1OxYouccIL1LQD/
hxxp://essand[.]com/test/LLC/
hxxp://ewingconsulting[.]com/drupal/waw5mv82-6hatb-28925/
hxxp://extremcopy[.]hu/_megrendeles/xaujy78-5ywj-121283/
hxxp://fizion[.]nl/wp-content/paclm/5hns2k4tmi/
hxxp://forexshifu[.]com/cgi-bin/KG/
hxxp://frontlyeadinternationalschools[.]com/wp-includes/LLC/
hxxp://goldenstatetow[.]com/peradice[.]com/private-array/Zv46IzHvNN-c6akEEjELac-ch6h0za-zz9/g910mxo4e7jl1-569s806x8/
hxxp://gorestruly[.]com/staging/7muem-163-8821/
hxxp://groovability[.]nl/2016/oLJ/
hxxp://gunesulkesi[.]com/wp-includes/paclm/ra45eplxwoef/
hxxp://gvits[.]co[.]uk/img/parts_service/mqb4765620800764364dlcxfteuixyn79d9m43d/
hxxp://hcfoods[.]com[.]au/cgi-bin/swift/dmlu7f9/
hxxp://hcsnet[.]com[.]br/qvf/
hxxp://hdsr[.]net/cgi-bin/73147137571702/0iv554548995156639kist29n80or33d3bxecr561/
hxxp://hegelito[.]de/wp-admin/3iz1jbwj-jnpw-844/
hxxp://helpmegrowutah[.]org/administrator/balance/jt4w8wwgdoi/
hxxp://henkphilipsen[.]nl/cgi-bin/DOC/
hxxp://herbanarts[.]com/inc/eTrac/6bzxvjgte/ic3019773564ff4871eg3lp4p1/
hxxp://hercinovic[.]com/Scripts/attachments/uuib4bo/55681905236344037nvffkvh1/
hxxp://hesa[.]co[.]id/_errorpages/sVDA/
hxxp://heyfoxcomic[.]com/68838057/
hxxp://hguk[.]net/cgi-bin/parts_service/
hxxp://hirken[.]com[.]au/administrator/sites/g172cd310vo/
hxxp://hitisland[.]com/corrupt4/m0vav60t-qftb-084/
hxxp://hoelscher1[.]com/clayupdate[.]com/CVNFOQ/
hxxp://hofhuistechniek[.]nl/localhost/2ti9oa/
hxxp://holhaug[.]com/OCT/
hxxp://hollam[.]com/blog/statement/433w52/o665719766859014p4o4pa4o3dbae/
hxxp://hollowmoon[.]net/sites/sites/2nl4laoy2hrm/
hxxp://hoogveld-service[.]nl/image/public/1qqxmgx1ceqd/c6jf7i3034098706716050vjgwdxvaue/
hxxp://hostech[.]com[.]br/cgi-bin/swift/g6o0qx1y/
hxxp://houdevelt[.]com/spaans/report/d3608164554247882vc0flmtetcefq/
hxxp://hshub[.]org/ThemeXP/sites/
hxxp://huffpuff[.]com[.]au/richard/paclm/
hxxp://ibda[.]adv[.]br/ARQUIVOS/Reporting/lgq27i4980789571308984v31psm7yqvkm4qt3c/
hxxp://icisa[.]cl/wp-includes/39cfu-gt1z-74/
hxxp://idealli[.]com[.]br/vianna/XOel/
hxxp://ifcingenieria[.]cl/15395MZFKWK/5sty-khh-190133/
hxxp://ikasp[.]se/fonts/4r166-ca5-902/
hxxp://ikbenpink[.]be/cgi-bin/rwi/
hxxp://ikexpert[.]com/dni-ph-092/
hxxp://imaimax[.]com/xq06330747110950rfqjzsz50lwr0d5djwyln/
hxxp://imdavidlee[.]com/wp-content/gnwl7ww5xqwm/
hxxp://immediax[.]com/CGI/00g6kg10pyw/
hxxp://immocop[.]ch/banner/public/ikbrx3tz/
hxxp://inkarainbow[.]com/antiguo/INC/pgmmsdyvzmth/
hxxp://interdentclean[.]com/wp-admin/duwrjuq4ud/
hxxp://jamarhomecareinc[.]com/wp-admin/cL/
hxxp://kaleembrothers[.]com/cgi-bin/va7833496035804878vsakgm998p19t/
hxxp://kanchpurcity[.]com/cgi-bin/attachments/jol906643089308093945scz916spmbqbmrpzx/
hxxp://kibrit[.]com[.]tr/wp-admin/p09puc8nlsl/
hxxp://kustens[.]com/A-Kus/attachments/ph06yz/
hxxp://labonni[.]com[.]br/v_2018[.]/qb9f9cijl/
hxxp://lakallehn[.]net/cgi-bin/esp/
hxxp://likonifreighters[.]com/wp-includes/LLC/lxh9ld06a/
hxxp://lillethun[.]com/miguel/protected-110800226-zewee0NnortB/close-075452092-hY4K7sBjKVPb/Cp2UeKGgHLO1-sbdhxIk7/
hxxp://limpio[.]ba/wp-includes/8pv9212236803yuuakn6sx/
hxxp://lupusalimentos[.]com[.]br/assinatura/lgswgttc-flpkz-93501/
hxxp://meinhaarzauber[.]de/cgi-bin/h4rms-5pr-166131/
hxxp://mitrausahacontrucion[.]com/css/browse/
hxxp://molco[.]cl/colegio/paclm/q54j394/
hxxp://nasim[.]hostlin[.]com/Murcia/0U71BHBBAOW3/jtx972797138066170giyvj9hkzynty6ugplkb/
hxxp://onourstyle[.]com/admin/HOFOVm/
hxxp://orionexpresso[.]com[.]br/cgi-bin/F9VFQ3/
hxxp://overonedjs[.]com[.]br/wp-content/thmtposz-xj-9958/
hxxp://paco[.]co[.]th/wp-content/Reporting/8c66726022781d99o53mku4ah9y/
hxxp://parvamusic[.]ir/wp-includes/Reporting/
hxxp://pastaciyiz[.]biz/wp-includes/INC/fsyrb08lxg/
hxxp://pattyprado[.]com[.]br/sitepppp/YNvXCn/
hxxp://pck[.]ostrowiec[.]pl/wp-content/browse/evvkspfokj6/2jn441542467414881wqpu1bhcmdbktphjnz/
hxxp://poskorea[.]kr/css/Wk/
hxxp://quasi-monkey[.]com/cgi-bin/multifuncional/sJohKR_XIXSDius_matriz/87_7a9ty4bs/
hxxp://ranking-site[.]de/picture_library/asf2r-7jesd-9262/
hxxp://renergyholdings[.]com/shortcodes/uG/
hxxp://rhinoplas[.]co[.]id/bin/attachments/
hxxp://sagnosys[.]com/fonts/public/
hxxp://saimission[.]org/sai/OCT/
hxxp://sathobby[.]com/wp-admin/personal-sector/verified-profile/Tu3Y55aa4s-y2KbMM77/
hxxp://sehahealth[.]com/wp-content/awto7y-hn-1775/
hxxp://servicebras[.]com[.]br/personal_disk/Documentation/djez7cmhe/j032083030854758b6yd44fw/
hxxp://sggogreenbags[.]com/wp-content/lm/s5972015qtqs92zfih69/
hxxp://shivakunwar[.]com[.]np/softee/24eo46-cbfh-9709/
hxxp://slideit[.]co[.]il/me-tlv[.]co[.]il/lm/
hxxp://speakerrepairs[.]co[.]za/stqmpb/browse/y3iw41875607992rgglscreh5er2uw56qvr/
hxxp://standardcolours[.]com/organic_pigments/WmkJgjfGr/
hxxp://subforsanta[.]org/views/lm/6jmqrm8pqm/
hxxp://ted-shirt[.]de/OCT/
hxxp://tewoerd[.]eu/img/closed_array/test_forum/ioctdec0z1rkopl_3z5y1vyx1x49sv/
hxxp://tfosgroup[.]com/wp-admin/lm/6qi9u071df/
hxxp://toutdoor[.]com[.]my/templates/ZKYVns/
hxxp://tyronescleancredit[.]com/wp-admin/eTrac/pwtnwqtqr/opx22615643nfkdjdzpt2d2w9a43/
hxxp://uniaoabc[.]com[.]br/protegido/oy3-806-65/
hxxp://waxtoncctv[.]com/forms/1092492180151127/qauamgmilj98/rf3023731744520h5cq5zgzh9/
hxxp://www[.]aci[.]serabd[.]com/aci/Document/dqg717m1/
hxxp://www[.]aeroasia-interior[.]com/cgi-bin/multifunctional-section/corporate-warehouse/873955838570-NdrzVDgktL3zda/
hxxp://www[.]asrijeweler[.]com/wp-admin/DOC/favf513476009051607a7eqbocb0pg0w97/
hxxp://www[.]bloomncare[.]com/wp-content/esp/rrxjpr/c22y0877995jcg2cdny5/
hxxp://www[.]botamotocross[.]site/wp-content/lJs/
hxxp://www[.]cagev[.]org/wp-includes/docs/a709cdyuc/
hxxp://www[.]cittadivita[.]it/fonts/INC/tfcetku53/
hxxp://www[.]clinicavitalefsa[.]com[.]br/cgi-bin/statement/
hxxp://www[.]commercedusud[.]com/cgi-bin/tp-yjf18-85615/
hxxp://www[.]cpmred[.]com/demoobj/DOC/1hofoks807em/0gg6fnw1346989803726jxslnrux3/
hxxp://www[.]criminal23[.]de/SmartHome/DNS/sites/hav4bk11061912129m4uk8wlplsmuuz5s/
hxxp://www[.]devaux[.]ch/picture_library/Documentation/c2888953404626u50nzzeqecfagwml2jrlf7/
hxxp://www[.]diasdiascontabilidade[.]com[.]br/images/common_section/external_forum/65455377365_eZAn79BXgCBJEmNJ/
hxxp://www[.]dii[.]com[.]pk/tests/ezcku7-q1tjw-0018/
hxxp://www[.]directresponsegroup[.]com/cfc/common_sector/826050420871_5ToPo9_forum/C7qQJEIWI1y_6hd84432iK/
hxxp://www[.]essand[.]com/test/LLC/
hxxp://www[.]fanda[.]co[.]ke/cgi-bin/report/
hxxp://www[.]fiberdyneqatar[.]com/logo/DOC/ql0n5fu/e9pn1647457604mlskhssck1sju/
hxxp://www[.]findio[.]co[.]ke/cgi-bin/Overview/9rxax6/
hxxp://www[.]forexshifu[.]com/cgi-bin/KG/
hxxp://www[.]francescoarzeni[.]it/dist/available-section/corporate-344051876-gtX30sO/76851718337-igerFk9wcJKtZ/
hxxp://www[.]frontlyeadinternationalschools[.]com/wp-includes/LLC/
hxxp://www[.]fuertecaja[.]com/wp-content/wzn6iv-ry-81561/
hxxp://www[.]geoav[.]cl/wordpress/parts_service/3rm0c33l3/w36044098077zvc9m7uvkeq7q5gbv90b/
hxxp://www[.]graduasi[.]com/wp-content/Overview/s4crxbe969823987hzdz4bhkpgv06900r/
hxxp://www[.]grecoson[.]com/images/tmr21x-p55m-916118/
hxxp://www[.]handler[.]cl/resumen-uso-inodos/closed_d7hvmliyjo3_d9i6cx8/close_t375m97buaw1_7mukunz9/h6bw_wy96wyxts767v/
hxxp://www[.]hazelfranks[.]me[.]uk/css/vu82k-syf-7188/
hxxp://www[.]hellojohnwebb[.]com/blog/ya6j-n1-68030/
hxxp://www[.]henseldesign[.]de/css/report/mbaxq6z535/
hxxp://www[.]herms[.]com/iAntipodes/o0pa-2x8u-921938/
hxxp://www[.]howie23[.]org/audio/rnvnjev-93fn-494786/
hxxp://www[.]ico6[.]com/vqmod/NVDB99/6z8y5de7/
hxxp://www[.]jawara[.]pro/wp-includes/esPZ/
hxxp://www[.]kecsfila[.]hu/wp-admin/52ud3r55h/
hxxp://www[.]kewcorp[.]ca/wp-admin/vMaElS/
hxxp://www[.]logisafe[.]com[.]mx/cgi-bin/9100092/
hxxp://www[.]lokeshullamkecskemet[.]hu/mail/eTrac/547jbn/
hxxp://www[.]mcomlhr[.]com/cgi-bin/qpds-5ub-25676/
hxxp://www[.]mcsgroup[.]co/assets/ncj02fs-iwts6-070/
hxxp://www[.]mifaingenieros[.]com/wp/swift/
hxxp://www[.]mitrausahacontrucion[.]com/css/browse/
hxxp://www[.]mjhl[.]com[.]mx/nidavelier/sites/kmwkxwnvpi3/4y0vcs20577928188282a5328gvvooig41u/
hxxp://www[.]ngcdfkibra[.]go[.]ke/mail/sRxXqv/
hxxp://www[.]niaayuningimandari[.]com/wp-includes/Overview/
hxxp://www[.]orionexpresso[.]com[.]br/cgi-bin/F9VFQ3/
hxxp://www[.]palestina[.]gob[.]ec/wp-content/LLC/
hxxp://www[.]renkegitim[.]com/cgi-bin/INC/90z6a8mhmv/
hxxp://www[.]rsplot[.]com[.]br/iwKAZkA/
hxxp://www[.]rsplot[.]com[.]br/iwKAZkA///
hxxp://www[.]scmasabacus[.]com/js/FILE/r6f4g5co4m/
hxxp://www[.]sfiromilos[.]gr/libraries/Overview/9p7jx45432144860352qor325j5bmd3z6p81/
hxxp://www[.]slanacom[.]si/css/Scan/9lutb0me/
hxxp://www[.]slservicebd[.]com/wp-content/ObaGMM/
hxxp://www[.]smmboster[.]com/lm/pa1b3du7h/
hxxp://www[.]softwarestore24[.]de/assets/LLC/b5x6hc7/qx56072491005zr2nl7vhavfsgnc38/
hxxp://www[.]teploservis[.]info/system/Reporting/8g1986539134vsifajldytp3h/
hxxp://www[.]vasinfo[.]com[.]br/uploads/INC/toqn40xxa/3dymlsk3665192952125550346k0hx52auspx56deh/
hxxp://www[.]viportal[.]co/shoock/FILE/
hxxp://www[.]vizyonpr[.]com/wp-includes/FILE/
hxxp://www[.]wedif[.]com/wp-includes/641103991036/6zq71964877680747aj2viz2qlcgikqz2/
hxxp://www[.]whenua[.]cl/peZzya/
hxxps://backroom[.]co[.]nz/1080/INC/
hxxps://communicateplc[.]com/assets/personal-disk/open-area/400482922-t01G7nAkRpWmteX/
hxxps://extremcopy[.]hu/_megrendeles/xaujy78-5ywj-121283/
hxxps://grafikos[.]com[.]ar/elecciones2019/public/1h2dduqoy62v/
hxxps://gtdesign[.]ch/cut_r_37ul9/payment/i9k97o/
hxxps://heartssetfree[.]org/9c950e/Scan/oh2753083skvphuiffhodq9oz2/
hxxps://laminingraphics[.]co[.]za/cgi-bin/lm/e5sp18662767484wwnkh6ngcm8qyrpsh/
hxxps://mcsgroup[.]co/assets/ncj02fs-iwts6-070/
hxxps://mewolters[.]nl/tmp/DOC/7llw7pqb/
hxxps://originalone[.]ma/ftp/statement/
hxxps://smartlogo[.]com[.]br/nova/balance/9v68wheh/
hxxps://tewoerd[.]eu/img/closed_array/test_forum/ioctdec0z1rkopl_3z5y1vyx1x49sv/
hxxps://toprakmedia[.]com/cgi-bin/attachments/
hxxps://www[.]aistidafa[.]com/ar/payment/lvat7ei2tf1/
hxxps://www[.]groovability[.]nl/2016/oLJ/
hxxps://www[.]imammaliktetouan[.]com/wp-admin/FILE/f0ec3r336527547211143lwnb825q4gmnb3d/
hxxps://www[.]irenicinternational[.]in/website[.]irenicinternational[.]in/fFTf/
hxxps://www[.]kosses[.]nl/bin/parts_service/
hxxps://www[.]lojajosemar[.]com[.]br/site/hdg-gux-5698/
hxxps://www[.]madlychic[.]com/cgi-bin/hucr5999590815rof242clcvbjblaz9f/
hxxps://www[.]mifaingenieros[.]com/wp/swift/
hxxps://www[.]vasinfo[.]com[.]br/uploads/INC/toqn40xxa/3dymlsk3665192952125550346k0hx52auspx56deh/
hxxps://www[.]yeumoitruong[.]vn/install/CQbLnC/
hxxps://yeumoitruong[.]vn/install/CQbLnC/

DOCUMENT FILE HASHES
026d79bfb1570cb3e0e11fb1b9d6a164
4b70e551720cedccf1ee93ddfb1e1891
69958b76a381cffb29ee62c7f8bf1a6d
7f2a717430d3255af92341903fda516a
956b4be79a9f4e5d727ec94664b8be7c
be8191a6c889c03af801fd332f158f2a
d57412cba1bff91fc130dc9954b3edb0
ed4fa77a52ee49b857f927deeec36621

PAYLOAD FILE HASHES
5b64c11061c5e636aafae6d884e88c1c
6f2cd722d7da1748e16aa4e5002ab51a
8d114db18203e89565cb5b0d147b85f4
927c0227bb85e2536311d0e7342c0a4b
aacfecdf30f9b81c5f63b32c56a9d078
b8a2f7fe47c411ff67b3265e6c88ef22
bc67412fbe3f6f98c8e3dbbb0c3540df
f069f1b32e2fc3cc958f9343552c784e
f4212cad8014e1e165b0bbf99a2a38e9
fab005ca8a0841ba18d75f7b5895e396

EMOTET PAYLOAD URLs
hxxp://alaksir[.]com/Scripts/TW6LJpx/
hxxp://dishnchips[.]com/Library/WK/
hxxp://dogbluemedia[.]com/dbm-salon/1g_9s_98t0/
hxxp://duncanllc[.]com/groundingthecloud[.]org/NQzx12/
hxxp://eldridgelondon[.]com/wp-admin/QS/
hxxp://elifmakina[.]net/ww4w/WnRLv/
hxxp://elisent[.]com/assets/ReH6966/
hxxp://eliteseobusiness[.]com/takeout[.]eliteseobusiness[.]com/GYa538680/
hxxp://empmtg[.]com/guestbook/uQ4qC339/
hxxp://enhancementtechnology[.]co[.]uk/wp-includes/w0r_c6_zy8an/
hxxp://ensource[.]co[.]uk/EAYO10088k/32eMeaoiq7963578/
hxxp://finestones[.]dk/blogs/mxa61_d_ys8fqozh/
hxxp://firman[.]com[.]au/fq_cze_gakl53z/
hxxp://greatfxmedia[.]com/clients/6whg9_9ww91_ev4kr/
hxxp://gregladen[.]com/blog/knEIK06090/
hxxp://grieta[.]net/cgi-bin/rzXeV/
hxxp://groncrete[.]com/bower_components/cvbh8_f0_84rai/
hxxp://gsiquick[.]com/prueba/gRQ9G61/
hxxp://gtsouth[.]com/drinkmenu/38vq_z8al_r5cujfy90n/
hxxp://guarany[.]net/banner_tm/IUI2890/
hxxp://guariz[.]com[.]br/WuutjlO/
hxxp://guppon[.]com/kani/E6JqEyw/
hxxp://guyn3[.]com/newsletter/z3a_r_rm70xlsb3/
hxxp://haek[.]net/wp-includes/o5kn_2i_4qtj9wg/
hxxp://hafder[.]com/images/fhq7h7babdbe5q5052/
hxxp://intere[.]com[.]br/erros/trdodu31307815/
hxxp://itcnt[.]com[.]np/wp-admin/AXc/
hxxp://jojofun[.]co[.]uk/loges/v7yi_9z9l1_evrg/
hxxp://kennol[.]pk/wp-admin/yu7d_oh2g_zmwbfmqo/
hxxp://lf-hj[.]cz/a_b3rvy_ua/
hxxp://luckybit[.]jp/o/e_hzu0_hlyygcbr9u/
hxxp://macserwis[.]pl/4995371c/1_m_1dau4ki6f/
hxxp://meuambientedecoracoes[.]com[.]br/update/ux5_iq061_x7f/
hxxp://misenar[.]com/rideforhd/8Q/
hxxp://signworld[.]nl/website-ivo-2019/nRxK/
hxxp://spitzertech[.]net/wp-content/D9pmd93694/
hxxp://starrpromotions[.]co[.]uk/files/0swfh_d7_3wqdwymn00/
hxxp://torqueandtalk[.]com/wp-content/d4wa_m9_8u5yii2j/
hxxp://whateverest[.]ch/meditationes/4Pdv9304pyj8191258/
hxxp://withdrake[.]com/stacymgreen/etqjdgf4343351/
hxxp://www[.]duhallow[.]com/wp-content/pm2kX374/
hxxp://www[.]giardinosullamaremma[.]it/wp-content/MnICFTr/
hxxp://www[.]gravelrecords[.]com/wp-admin/5h_jns_l3s6/
hxxp://www[.]greaudstudio[.]com/docs/olohz_suq_munasyr/
hxxp://www[.]gunesoluk[.]com/eotps/heb_x_1ehlbx9/
hxxp://www[.]hatchdogs[.]com/assets/XIw/
hxxp://www[.]marisqueiraobarqueiro[.]pt/modules/2eyu_76wd_82/
hxxp://www[.]sourcetechno[.]com/wp-includes/pl0_sux_k2b4cgyr/
hxxp://www[.]tarjetasas[.]com/web/o9kb_qb_na7usf6/
hxxp://yeichner[.]com/old/iyv0hf8926444/
hxxps://classic-recipes[.]com/cgi-bin/eoDJ13/
hxxps://firstaid-redliv[.]dk/wp-content/c_zjmm_0p7xzukpo9/
hxxps://gregemerson[.]com/wp-includes/hudy17240/
hxxps://groovyboove[.]co[.]uk/blogs/8T94mmdka13/
hxxps://urbaneden[.]net/awstats/gjec_g3g_jjblgv8wkh/

EMOTET C2s
hxxp://24[.]249[.]135[.]121
hxxp://185[.]94[.]252[.]13:443
hxxp://149[.]62[.]173[.]247:8080
hxxp://50[.]28[.]51[.]143:8080
hxxp://80[.]249[.]176[.]206
hxxp://5[.]196[.]35[.]138:7080
hxxp://190[.]17[.]195[.]202
hxxp://143[.]0[.]87[.]101
hxxp://190[.]147[.]137[.]153:443
hxxp://181[.]30[.]69[.]50
hxxp://51[.]255[.]165[.]160:8080
hxxp://190[.]96[.]118[.]251:443
hxxp://72[.]47[.]248[.]48:7080
hxxp://178[.]79[.]163[.]131:8080
hxxp://212[.]231[.]60[.]98
hxxp://187[.]162[.]248[.]237
hxxp://2[.]47[.]112[.]152
hxxp://68[.]183[.]190[.]199:8080
hxxp://192[.]241[.]143[.]52:8080
hxxp://77[.]55[.]211[.]77:8080
hxxp://87[.]106[.]46[.]107:8080
hxxp://191[.]182[.]6[.]118
hxxp://189[.]1[.]185[.]98:8080
hxxp://93[.]151[.]186[.]85
hxxp://204[.]225[.]249[.]100:7080
hxxp://177[.]73[.]0[.]98:443
hxxp://137[.]74[.]106[.]111:7080
hxxp://219[.]92[.]13[.]25
hxxp://89[.]32[.]150[.]160:8080
hxxp://82[.]240[.]207[.]95:443
hxxp://190[.]6[.]193[.]152:8080
hxxp://190[.]163[.]31[.]26
hxxp://190[.]181[.]235[.]46
hxxp://114[.]109[.]179[.]60
hxxp://70[.]32[.]84[.]74:8080
hxxp://94[.]176[.]234[.]118:443
hxxp://77[.]90[.]136[.]129:8080
hxxp://217[.]13[.]106[.]14:8080
hxxp://212[.]71[.]237[.]140:8080
hxxp://82[.]196[.]15[.]205:8080
hxxp://181[.]129[.]96[.]162:8080
hxxp://104[.]131[.]103[.]37:8080
hxxp://83[.]169[.]21[.]32:7080
hxxp://177[.]139[.]131[.]143:443
hxxp://187[.]106[.]41[.]99
hxxp://104[.]131[.]41[.]185:8080
hxxp://192[.]241[.]146[.]84:8080
hxxp://170[.]81[.]48[.]2
hxxp://181[.]120[.]79[.]227
hxxp://68[.]183[.]170[.]114:8080
hxxp://177[.]72[.]13[.]80
hxxp://61[.]92[.]159[.]208:8080
hxxp://12[.]162[.]84[.]2:8080
hxxp://186[.]70[.]127[.]199:8090
hxxp://45[.]161[.]242[.]102
hxxp://179[.]60[.]229[.]168:443
hxxp://70[.]32[.]115[.]157:8080
hxxp://191[.]99[.]160[.]58
hxxp://172[.]104[.]169[.]32:8080
hxxp://177[.]66[.]190[.]130
hxxp://71[.]50[.]31[.]38
hxxp://203[.]25[.]159[.]3:8080
hxxp://185[.]94[.]252[.]12
hxxp://217[.]199[.]160[.]224:7080
hxxp://177[.]74[.]228[.]34
hxxp://177[.]144[.]135[.]2
hxxp://190[.]194[.]242[.]254:443
hxxp://202[.]62[.]39[.]111
hxxp://201[.]213[.]156[.]176
hxxp://92[.]23[.]34[.]86
hxxp://185[.]94[.]252[.]27:443
hxxp://104[.]236[.]161[.]64:8080
hxxp://181[.]167[.]96[.]215
hxxp://111[.]67[.]12[.]221:8080
hxxp://144[.]139[.]91[.]187:443
hxxp://186[.]250[.]52[.]226:8080
hxxp://46[.]28[.]111[.]142:7080

hxxp://201[.]235[.]10[.]215
hxxp://198[.]57[.]203[.]63:8080
hxxp://163[.]172[.]107[.]70:8080
hxxp://172[.]105[.]78[.]244:8080
hxxp://107[.]161[.]30[.]122:8080
hxxp://203[.]153[.]216[.]182:7080
hxxp://37[.]46[.]129[.]215:8080
hxxp://201[.]214[.]108[.]231
hxxp://178[.]33[.]167[.]120:8080
hxxp://181[.]113[.]229[.]139:443
hxxp://192[.]210[.]217[.]94:8080
hxxp://24[.]157[.]25[.]203
hxxp://94[.]96[.]60[.]191
hxxp://157[.]7[.]164[.]178:8081
hxxp://75[.]127[.]14[.]170:8080
hxxp://189[.]146[.]1[.]78:443
hxxp://190[.]164[.]75[.]175
hxxp://192[.]241[.]220[.]183:8080
hxxp://190[.]55[.]233[.]156
hxxp://91[.]83[.]93[.]103:443
hxxp://144[.]139[.]91[.]187
hxxp://87[.]106[.]231[.]60:8080
hxxp://140[.]207[.]113[.]106:443
hxxp://139[.]59[.]12[.]63:8080
hxxp://181[.]167[.]35[.]84
hxxp://50[.]116[.]78[.]109:8080
hxxp://74[.]208[.]173[.]91:8080
hxxp://46[.]49[.]124[.]53
hxxp://81[.]17[.]93[.]134
hxxp://81[.]214[.]253[.]80:443
hxxp://46[.]32[.]229[.]152:8080
hxxp://41[.]185[.]29[.]128:8080
hxxp://190[.]111[.]215[.]4:8080
hxxp://216[.]75[.]37[.]196:8080
hxxp://37[.]70[.]131[.]107
hxxp://181[.]143[.]101[.]19:8080
hxxp://115[.]79[.]195[.]246
hxxp://192[.]163[.]221[.]191:8080
hxxp://87[.]252[.]100[.]28
hxxp://181[.]164[.]110[.]7
hxxp://89[.]108[.]158[.]234:8080
hxxp://105[.]209[.]239[.]55
hxxp://181[.]134[.]9[.]162
hxxp://185[.]142[.]236[.]163:443
hxxp://195[.]201[.]56[.]70:8080
hxxp://78[.]189[.]111[.]208:443
hxxp://113[.]160[.]180[.]109
hxxp://5[.]79[.]70[.]250:8080
hxxp://37[.]208[.]106[.]146:8080
hxxp://179[.]5[.]118[.]12
hxxp://203[.]153[.]216[.]178:7080
hxxp://177[.]144[.]130[.]105:443
hxxp://75[.]139[.]38[.]211
hxxp://177[.]37[.]81[.]212:443
hxxp://77[.]74[.]78[.]80:443
hxxp://78[.]188[.]170[.]128
hxxp://212[.]156[.]133[.]218
hxxp://113[.]161[.]148[.]81
hxxp://46[.]105[.]131[.]68:8080
hxxp://51[.]38[.]201[.]19:7080
hxxp://143[.]95[.]101[.]72:8080
hxxp://212[.]112[.]113[.]235

hxxp://47[.]146[.]117[.]214
hxxp://62[.]108[.]54[.]22:8080
hxxp://212[.]51[.]142[.]238:8080
hxxp://190[.]160[.]53[.]126
hxxp://87[.]106[.]136[.]232:8080
hxxp://74[.]208[.]45[.]104:8080
hxxp://121[.]124[.]124[.]40:7080
hxxp://124[.]45[.]106[.]173:443
hxxp://76[.]27[.]179[.]47
hxxp://210[.]165[.]156[.]91
hxxp://61[.]19[.]246[.]238:443
hxxp://81[.]2[.]235[.]111:8080
hxxp://169[.]239[.]182[.]217:8080
hxxp://181[.]230[.]116[.]163
hxxp://139[.]130[.]242[.]43
hxxp://46[.]105[.]131[.]87
hxxp://139[.]59[.]60[.]244:8080
hxxp://222[.]214[.]218[.]37:4143
hxxp://41[.]60[.]200[.]34
hxxp://200[.]55[.]243[.]138:8080
hxxp://24[.]234[.]133[.]205
hxxp://190[.]55[.]181[.]54:443
hxxp://189[.]212[.]199[.]126:443
hxxp://93[.]156[.]165[.]186
hxxp://62[.]138[.]26[.]28:8080
hxxp://62[.]75[.]141[.]82
hxxp://176[.]111[.]60[.]55:8080
hxxp://168[.]235[.]67[.]138:7080
hxxp://109[.]117[.]53[.]230:443
hxxp://5[.]196[.]74[.]210:8080
hxxp://162[.]154[.]38[.]103
hxxp://152[.]168[.]248[.]128:443
hxxp://83[.]110[.]223[.]58:443
hxxp://95[.]9[.]185[.]228:443
hxxp://180[.]92[.]239[.]110:8080
hxxp://209[.]141[.]54[.]221:8080
hxxp://37[.]187[.]72[.]193:8080
hxxp://113[.]160[.]130[.]116:8443
hxxp://85[.]59[.]136[.]180:8080
hxxp://79[.]98[.]24[.]39:8080
hxxp://91[.]231[.]166[.]124:8080
hxxp://185[.]94[.]252[.]104:443
hxxp://108[.]48[.]41[.]69
hxxp://95[.]179[.]229[.]244:8080
hxxp://71[.]208[.]216[.]10
hxxp://93[.]51[.]50[.]171:8080
hxxp://78[.]24[.]219[.]147:8080
hxxp://24[.]179[.]13[.]119
hxxp://200[.]41[.]121[.]90
hxxp://153[.]126[.]210[.]205:7080
hxxp://104[.]236[.]246[.]93:8080
hxxp://46[.]105[.]131[.]79:8080
hxxp://201[.]173[.]217[.]124:443
hxxp://50[.]116[.]86[.]205:8080
hxxp://116[.]203[.]32[.]252:8080
hxxp://157[.]245[.]99[.]39:8080
hxxp://109[.]74[.]5[.]95:8080
hxxp://203[.]153[.]216[.]189:7080
hxxp://87[.]106[.]139[.]101:8080
hxxp://137[.]59[.]187[.]107:8080
hxxp://110[.]145[.]77[.]103
hxxp://47[.]153[.]182[.]47
hxxp://95[.]213[.]236[.]64:8080
hxxp://24[.]43[.]99[.]75
hxxp://209[.]182[.]216[.]177:443
hxxp://173[.]91[.]22[.]41
hxxp://5[.]39[.]91[.]110:7080
hxxp://75[.]139[.]38[.]211
hxxp://91[.]211[.]88[.]52:7080
hxxp://37[.]139[.]21[.]175:8080
hxxp://162[.]241[.]92[.]219:8080
hxxp://104[.]131[.]11[.]150:443
hxxp://70[.]167[.]215[.]250:8080
hxxp://104[.]131[.]44[.]150:8080
hxxp://103[.]86[.]49[.]11:8080
hxxp://65[.]111[.]120[.]223