2020-07-30 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

MALDOC DISTRIBUTION URLS
http://aawen4x4.com.au/4psi_files/private-uz5zad8s0i8es-2dy2awg1x1mj86/special-61789740803-bodOgY/ENv02z1n-tc5utsG7He/
http://aci.serabd.com/aci/available-7yrkemhow-coa7e2c3x33blm/individual-warehouse/fNTyUl-3K98dliM/
http://agacenter.ro/wp-admin/kh9-nhd-95338/
http://altdigital.co.uk/js/private-module/verified-profile/myoigsxqpsim-0z8u685t/
http://anja.nu/closed_disk/external_space/wy22_v458uxzu002uy/
http://aptigence.com.au/random/sites/8z2nfkn8/0rtv45642848544912c2usf979vz4cxfu5y/
http://artabout.gr/signature/XB915BTDKPNB/sybxs3e32bl/2g0ef934479799577067482sxw5w21t5edfq5c0ka/
http://asrijeweler.com/wp-admin/DOC/favf513476009051607a7eqbocb0pg0w97/
http://autobike.tw/image/eo-rgs-077537/
http://bemnessa.com.br/erros/multifunctional_zone/guarded_050947748940_peHQ6sGSipjM/npv_s0u3yv14689w5/
http://benthamstudio.co.uk/wolfsohn.co.uk/closed_resource/open_portal/f2mp_s3869v5/
http://bey12.com/logos/OCT/vk51tln/ifstp4h269839864890zx0jf6prk/
http://bloodcreative.co.uk/Scripts/private-B1PxU-bpyyZM3/lwm1o260shb-cdsu5t590era-ryiK9Kt-Pd9L2ciooPLIEB/192817551-NzXgC6/
http://bloomncare.com/wp-content/esp/rrxjpr/c22y0877995jcg2cdny5/
http://bruset.no/picture_library/multifunctional-zone/corporate-area/33739768-nGH9EnoK/
http://cagev.org/wp-includes/docs/a709cdyuc/
http://capitaladm.com.br/SGQ/nDMepQ/
http://casadorothea.com/cc/c9zt997bbm35_kelmu_resource/interior_forum/rrz3wlvnf_78w8x0/
http://chahooa.com/WP/vdg7nu3ov7/
http://cittadivita.it/fonts/INC/tfcetku53/
http://clanspectre.com/IBmM8PqOJz8pJR/open-box/security-warehouse/306363-leJ4rURzkoZurY8/
http://clinsaobento.com.br/Biblioteca_D/967506_CPEuTmDwki_module/5qrGll4R_K6afSvLLd1PLgd_area/62511521024_pKMvwVHCG/
http://colbydix.com/audio/sgk0nh-yyibwto2l0l-22eaFjtx56-hIzsQUZdrpkW7/interior-forum/562769-gJ1g7wIcupA/
http://comerford.org.uk/book/lu6ic4k2n7prgw-ik9d9k-zone/verified-profile/z7l07yy1tce1-9v3w8swy5yt0y7/
http://commercedusud.com/cgi-bin/tp-yjf18-85615/
http://coneymedia.com/wp-content/multifunctional-zone/guarded-portal/J5fLBVq-M87iwK4IN/
http://cosentinoconsult.com.br/wp-content/289915-NOjxWgPYhzlZ-disk/individual-warehouse/29584277322996-enoiFIpEXgvQ2A5/
http://cosmo.li/GFMI/multifunctional_sector/external_X5zR_GTkqUewl2xeA/973792286194_VTar6/
http://craigdphotography.com/news/ci0a9-6n0-82666/
http://creativeworld.in/picture_library/gz/
http://cyper.org/views/cog8y53oqe/
http://digipro.com.tw/gold99.com.tw/ty-8ej-60/
http://djeffries.com/wp-admin/zs2001-apm-888088/
http://ebe.dk/_bordershacked/hacked/GWSnK-WGkB2u6B6IWWMCy_TbyeojxK-KGB/
http://ebe.dk/_bordershacked/open_zone/security_area/b2jys09lmne9_7x511w3242360/
http://eduprecaro.com/index_htm_files/yMXnSMhR/
http://ehsan.it/Alternative/common_disk/additional_3228698_LqjOy9UH/qp8bsbq9f_9ys4u8vw1/
http://eiburaham.jp/parts/statement/fwdh69wd/
http://ejardine.com/dad/b2a2-3dxj-463/
http://elancla.cl/SpryAssets/93260076883-ZwGwOFtgV-Zs5dBJrc-5uo9pAMS/verified-area/3z5d9q5aq-847szuy07/
http://elementalburn.com/7107012102381-23SZF9DZczYzLB-module/payment/
http://elevationadvertising.com/mobile/Documentation/
http://entouchgraphics.com/modules/rbira-jm8h2-6965/
http://erronsplace.com/multifunctional-box/IccFI/
http://esnconsultants.com/medals/778147664/
http://facetsbusiness.ca/wp-admin/engl/DOC/0s7eun/
http://faroholidays.in/wp-content/ok2-m4gw0-309348/
http://fenlabenergy.com/restore/LFwzpHi/
http://ferafera.com/blueskies/521138744613-UYVWc-section/special-profile/jybevoll7-3uw86w65s74tuv/
http://ferienwohnung-malcesine.de/html/open-resource/individual-warehouse/tigcc-u7w0wy5s16tt/
http://ferramentariahonorio.com.br/PLASTICOS/q9cO97-movSovTXJ7-sector/test-portal/964586063641-7YLEwbuCTyL11LE6/
http://fiberdyneqatar.com/logo/DOC/ql0n5fu/e9pn1647457604mlskhssck1sju/
http://finnigans.org.uk/php/open_zone/special_portal/lpto4lxv5k_y8uszz2w/
http://firemaplegames.com/css/8411573_qhFoHRjICsQmP2d_box/90682778_L3hQOe_profile/091496923549_Mt2hTFCL62LQ5P/
http://firstlineit.co.za/logssite/paclm/
http://flancalfaltd10.com/dist/js/pages/je22cxqsy/
http://foodphotography.in/wp-admin/personal-module/guarded-profile/Zxx3lV2KyHk-Gje898jeLy/
http://foredeckmarine.com.au/assets/open-module/verifiable-DlcdjTE2-z3SB9tp5/91041647-bi9KojGqg/
http://forscene.com.au/images/LLC/kurca3u/r0yr3656933188whnvkchg5e9zmk/
http://fourserious.com/common_module/zij/
http://franelessac.com/blog_1/Overview/ke84h9/lf94416297123919elsfkmtdtyg4/
http://frnossa.com.br/img/PU/
http://fussey.co.uk/wvvw/TpBWheM/
http://gabrielfelipe.com/steiin-admin/lm/5ncuavl6fq/
http://gaoe.com.br/garantiasaude/available-resource/guarded-77nx-3k9ptdi3/637769-IGSyzn/
http://gaoe.com.br/garantiasaude/common_section/4Aqxi_J7ys4ENhUcLJ_portal/pY5pYRUJ_NJg9qN5ubauG9N/
http://garethjames.co.uk/plesk-stat/personal-array/security-s94-wwfhjs4woa0c90e/0ebs0k-8t9x3241tvtvy/
http://gjoweb.it/style/h4lxhwm2Zw_2etRUvvhPo_1X2syZQyo_833Oddln0w/special_warehouse/LYkofahV7_z39sI264aovxk/
http://globdesign.com/cgi-bin/rHfvyiy/
http://goldoni.co.uk/old_sitexxxxxxxxxxxxxxxxxxxxxxxx/invoice/9q40uix/
http://gombui.net/bibliophilia/swift/5gzmh467btdw/795638541389992424j5ka2fhi41hj/
http://goodbad.co.uk/zoeva/open-section/individual-827891-ugLLqPIwclQzf/M6UIqJ9hSDu-twcLI3vu/
http://graduasi.com/wp-content/Overview/s4crxbe969823987hzdz4bhkpgv06900r/
http://grecoson.com/images/tmr21x-p55m-916118/
http://heemaalnews.com/news/protected_sector/corporate_space/g9nz7dvuk2jq_5x5yyw10/
http://herms.com/iAntipodes/o0pa-2x8u-921938/
http://hertronic.com/modules/report/dumhok/
http://homecables.net/wp-content/0205789038156-TbjSB5zYdbVq-module/external-space/4walh-wxv7/
http://horado.ro/wwvvv/vzuWutd/
http://hostmelodia.com.br/lcradioetv/4x1x5u-21i-7655/
http://icacc.com/fcgi-bin/common-53883307959-gexpe8Tlo/external-130834287-Ej78rF/QWI2WRzzl-nahcpL6Npq3G2d/
http://icacc.com/fcgi-bin/multifunctional-khbuqe6ekcp0klpp-697hanmef/security-area/48402530470-L376N7/
http://iensenada.cl/images/rl1h_zz3fqcab9dejfj0g_sector/verifiable_warehouse/YMyGrmfceX78_tGm1jLrt/
http://inbsolutions.co.za/rams/open_X8jGihY_3Gpvxmh3XtKT/guarded_profile/5914710691_iHIsVlDa7gIhbQof/
http://incluschile.cl/naturebeautyspa.com/s3px7_Oss1rD2U_poDlw_e46Zq4IYf/external_owdgcz7ra_w5k/kjQGLcCDVJMp_ux8d4toy60x/
http://infectedarea.com/iwtfy/multifunctional-zone/test-072287610-Sryk0Ri98/03kdh8h4grsqo4op-60u2u17wus026/
http://infomagia.com.br/infomagia/bIx/
http://inmayjose.es/firma/luxart/
http://intelligence.com.sg/support/open_array/additional_Rza5V37_qk6kzm6rJwOixh/92377040671_CuUOCe3H/
http://inzien.me/img/VqSm/
http://irenicinternational.in/website.irenicinternational.in/fFTf/
http://irlenmenezes.com.br/thais/q2cgiibo0rg/8f62669073955108j5obt9dp8n3/
http://isatechnology.com/print/60ka4484819911634268909r5a94sk9qha44yu/
http://iserrat.com/wwvv2/90-1i-3993/
http://ishbudesign.com/vivantphoto/report/y2nfl582427761627221jle7pggwyc62khivc3j611/
http://ishtera.net/swift/w2936888764695127646oqtynli3xg7xsmj8qbtd/
http://itgastaldi.com/wp-includes/b5mzdpb-si-99862/
http://itmas.com.au/includes/personal-array/19685230-yUz7REuzuqRMRnv-8988541872-sf31dxhwaC9U/WsY8uB6aX7-isxs0pvs/
http://jamconsulting.com.au/emarketing2/eTrac/
http://jamesbillingsley.com/photo/oo511lkbwz2k/iv5457767573326884l709fjy5ls6up/
http://jamisonplazanews.com.au/balance/
http://janakre.com/Lf0709YEdM/eTrac/zsf9ft4i8c6p/
http://janoshi.com/cache/ic6su7/
http://jasonb.com.au/wp-includes/12dlpe5/
http://jawara.pro/wp-includes/open_box/close_0298711536_QnJwLpsMIs6/65274365448_5Uqgk9F0bcvFlKdG/
http://jenthornton.co.uk/selfie365.me/payment/gxz5iig0/r2453600824905i06n9m1y1g/
http://jessicaschochphotography.com/joomlatest/parts_service/
http://jestteesn.com/cgi-bin/browse/
http://jetjackinc.com/wp-admin/paclm/93lyz1xaxrc5/g17033349632990yn3foczzqq/
http://jetmundsen.net/public/wu6orx46683709305doo0m9879tm/
http://jimbrashear.com/downloads/Reporting/1xkor79915729116201642hw8honlznv86cctm/
http://jimlutzforohio.com/wp-content/swift/ya70132464563i0fsbynx8oen1/
http://johnstranovsky.com/balance/ceuacg/
http://jonathanfun.com/wp-admin/ZLicu/
http://joswinter.nl/evelaer/12i162369041528686404666hlvx89lok/
http://karenfishermusic.com/scripts/DOC/
http://karenscuts.biz/gallery/public/0soxhi9gcj/eme42u2766527950471035zum0ezi86jhpcg2rk6/
http://katana.co.uk/cgi-bin/caIijOty/
http://kcimage.net/images/report/ivtxrc7ryatx/
http://kecsfila.hu/wp-admin/3j-0wr-000/
http://kecsfila.hu/wp-admin/52ud3r55h/
http://keistadweb.nl/stats/FILE/57zm40646394379430olk0h96ebu/
http://kellymorganscience.com/wp-content/h9mw-ol7o-54/
http://kelomotor.hu/kep_kulcstarto_kicsi/siij1n-wry7-591374/
http://kentsparkman.com/images/payment/bvc284030016506aving9wh6llfaqmc/
http://kereselidze.com/Scan/7bty5xg/
http://kevincameron.net/tfnx/Reporting/
http://kevsun.org/fonts/report/kbvlhu4o/g97827940366v7x8vn9crvlv50dkj/
http://keyesfamily.net/john/FILE/
http://khaiy.com/cgi-bin/attachments/og2n94859134863356kubxol0r0gyldf1ob6789/
http://kmklawllp.co.ke/bin/closed_disk/verifiable_warehouse/4454466527_R7Ojkf/
http://kriomed.uz/admin/attachments/dpqccegbfdt/
http://ktbcs.co.uk/f07w_PzAMTx0KZ2JP_sector/verified_warehouse/7445119449_MBxcKPb9/
http://kultfitness.com/wp-includes/XubvOifYz/
http://kupkes.net/vddb/esp/
http://lacasamia.co.uk/z8ju268-oz5x-978031/
http://lancon.com.au/guest/public/
http://lansec.com.br/protected_pyig_mld1w/test_cloud/720536_50jkb/
http://laschuk.com.br/wordpress/docs/2gge4ej/
http://laurenebohn.com/lm/szfb5c54/
http://ldgcorp.com/6aqjxtad-7c1-01/
http://legend.nu/wordpress/parts_service/
http://leong.ws/Scouting.my/closed-Rpng-iupUpmO/open-portal/vjlva-wy3z97y8ww/
http://lifegiva.com/wp-content/ibrKl/
http://lighthouse-safety-solutions.co.uk/backup_oldfiles/sites/8lf9auekk/53kqs423125233926215bryrb9npsyy/
http://lindasfamilytrees.com/gedcomfiles/nw7gitwu6/0oak72363624345bs7okhmb3/
http://lindnerelektroanlagen.de/pages/Overview/teei81i/
http://linesoft.fr/include/INC/
http://lingledist.com/cgi-bin/LwnWMVaY/
http://lmimpresiones.cl/cgi-bin/299024650/
http://loboelhouwers.nl/thumbs/cm/css/72405/l02wb5/
http://logotypfabriken.se/wp-content/balance/tdfu46666340722745c16g659jfn01hq5gs/
http://lojajosemar.com.br/site/hdg-gux-5698/
http://lokeshullamkecskemet.hu/mail/eTrac/547jbn/
http://lubbocksss.com/OldSite/payment/ki1u109375710aw5vp7o5319jq/
http://luchies.com/scripts_index/attachments/df74rpt7r/
http://lucienc.net/opengarden/ECTe/
http://luczakj.c0.pl/referencje/esp/uwhqg2668285910mp4wq347u9x5qpu/
http://luggares.com/picture_library/esp/nw523892229086842bdpbyjxvyq5fz49g/
http://luilao.com/paclm/n389338722w6hiss0ntgl06s4672y/
http://luizazan.ro/wp-admin/uk7-u6-9136/
http://lunapizza.com/swift/
http://lunny.com/fogkbv-rl-843138/
http://madebyrob.net/photosbyrob.net/balance/71shau33243030126802pwjsvj580zyh9imi/
http://magdork.com/audio/lm/
http://mcomlhr.com/cgi-bin/qpds-5ub-25676/
http://megasolucoesti.com/css/multifunctional-zone/6p6fz5872xavk-l6kkagnmmxx-yrjo5qol2oj7pb-9woqaqbj/qwbxe9tcbih-8swx728z44/
http://mgregoire.net/cgi-bin/LYbx/
http://mifaingenieros.com/wp/swift/
http://modbecloset.com/bigfatbratbabydog/16abyxdj3gclguwp_yvgtghv2n_section/guarded_kt9q_1v4f83ev7n/0533420167_dquy7ucns/
http://mydcareahomes.com/RealEstate/RjBNr/
http://ngcdfkibra.go.ke/mail/sRxXqv/
http://nuwagi.com/old/EOBPpCJ/
http://oikotexnia-a-o.gr/abante/1xitqhrq/
http://omeryener.com.tr/stylus/NpWCrMKv/
http://oshop.es/test/common-296122707-8q58yAwAsJl/verified-cloud/d4aksuofzr7k-7652zzxw6/
http://perlahuelva.es/ENG/common-disk/security-cloud/ypr52ekq-060y/
http://puertosalsa.cl/js/multifunctional-section/verifiable-portal/1v5sq78-t50784t844t2/
http://rafamora.net/wp-includes/z05-bcc-341722/
http://randradeseguros.com.br/produtos/QeDYt/
http://renkegitim.com/cgi-bin/INC/90z6a8mhmv/
http://rhema.com.sg/cgi-bin/YxaR/
http://scmasabacus.com/js/common_8TzIKrXm_zlpCg8v2/guarded_portal/J6EYoJuYoQ_0iovJIIH/
http://sipesv.org./administrator/Documentation/
http://slanacom.si/css/Scan/9lutb0me/
http://stechman.com.br/afm/3s-epxi-43/
http://stonehouseevents.com/css/MIRKYGInc/
http://sugarcoatedspider.co.uk/awstats-icon/iwq5-ge0r-6687/
http://tecnozam.cl/wp-includes/Document/hdbyvnff8una/
http://teploservis.info/system/Reporting/8g1986539134vsifajldytp3h/
http://terichmir.com.pk/wp-includes/sTA/
http://trainingbodies.com/webmaster/available_disk/security_8n73pig8yadzs_loc5300i9/mvk135_yttzs0vy03155/
http://uniteddatabase.net/wp-content/hmy-a6-390220/
http://utah211.org/prototype_dev/Document/
http://vailventures.com/cgi-bin/Document/iwq3rgt2iaj/
http://vasinfo.com.br/uploads/INC/toqn40xxa/3dymlsk3665192952125550346k0hx52auspx56deh/
http://vidrorapido.com.br/banco/balance/l346g0rjbvf/kq72860476736qcu4tffv2rty2e9ypk/
http://viportal.co/shoock/FILE/
http://vtechnocrat.com/admin786/dgfyo/
http://w3art.com/dtla/common_module/guarded_profile/r0tpg3s_x5443w99/
http://w4icw.com/Website/parts_service/
http://witje.be/dutchphotozone/LudZ/
http://www.acinutrilife.com/test/report/
http://www.behnasan.com/wp-content/73F13HW4/n4f8xilqk/
http://www.calabria.com.pk/demo/zl6rm3schv_ar6j935e_module/verifiable_area/549884915170_5uveh3TmsGYeA/
http://www.cbi.com.eg/wp-content/multifunctional-box/479140351167-KQZikOmjyHvaK-forum/w152yv5-w0w0s0/
http://www.cuestionspirits.com/index_files/5RIHT/skjlee8h19/3r3875389870118i19wzyxkdq3r/
http://www.ekramco.ir/english/templates/docs/
http://www.ffval.hr/cgi-bin/attachments/
http://www.fuba.com.au/manager/closed_box/guarded_warehouse/FKAUwxgXL9Q_w10knzlpgci/
http://www.fulltel.it/wp-content/multifunctional-section/corporate-profile/8hEZ4c-0Mk2L6qu/
http://www.gammatron.com.au/ajd/invoice/mpze2u9/
http://www.industrialequip.net/cgi-bin/personal-152721572730-gls250/corporate-space/2ws4cr0p8pvwbg-u028sux64w2/
http://www.intercont.eu/own/swift/1berhkyl/
http://www.irishcarsagadir.net/images/17nlh-arj-19161/
http://www.isisjade.com/wp-includes/INC/egklww4213856084mdhayqgk1zafvni4vpb/
http://www.janoshi.com/cache/ic6su7/
http://www.kyesgroups.com/cgi-bin/i0boam6/
http://www.lerasole.it/wp-content/rlcju-gu-290417/
http://www.linesoft.fr/include/INC/
http://www.lojajosemar.com.br/site/hdg-gux-5698/
http://www.loveslap.com/wwvv2/Gm/
http://www.magoenmadrid.com/Arturo/w3j1xnp11/
http://www.magsoft.it/blog_img/lpary2-lu-94322/
http://www.puertosalsa.cl/js/vd7tdotu-782z1-95/
http://www.rsplot.com.br/iwKAZkA//
http://www.smarthub.ws/generated/personal-module/additional-space/94807247323-joDV3JKUi7TyvShK/
http://www.spcc.cl/OLDCODES/closed_sector/interior_portal/573409027_txvpo6F3Wd/
http://www.svkn.at/drupal/protected-sector/corporate-warehouse/54901370265050-o5vj09BJqgAyjn/
http://www.vpinversiones.cl/img/report/fa7sges/
http://yamnadlan.com/ynpw/zvjg-vo-892/
https://adhd.org.sa/sub_we-are/z48rpev90d/0bjo209677710ax9i7w4fskut4t11t/
https://backroom.co.nz/1080/Documentation/
https://chaoscopia.com/Scripts/sites/g74vm9gs/4b883927243019016csfy17fxlfe44ym3byboz/
https://dewide.com.br/cursoculinariasaudavel/emv/
https://flamesofrichmond.co.uk/img/eccgtgg/xnrrl340046272572dvmdyu8twrre46czm6vz/;/
https://gghekking.nl/ebanking/34ub1ibpctmc/zkoke5316762927778879wsc8yrs40n4xs7e5g0wh/
https://giantsinthesky.com/cgi-bin/sPeel/
https://goldilockstraining.com/wp-includes/parts_service/tyv2ng/
https://healinghandsonthemove.com/wp-content/balance/
https://ingesolutions.com/estructuras-livianas/eTrac/1xlyekqq33g/
https://irenicinternational.in/website.irenicinternational.in/fFTf/
https://jeffdahlke.com/css/Reporting/po3x708837819192166196fun7k976gnpv/
https://jrvservices.com.br/JRV_ANTIGO/36qkwciosy6qs-1dxjawwaw-zone/interior-space/QzveCXbS-5G5htj2uNr5dj/
https://kerosky.com/wp-content/swift/
https://kontaci.com/cgi-bin/browse/nfy6gx113300005267668887eps7evqjczwlh1eyi8mx1d/
https://lotuspolymers.com/wp-includes/gGwipB/
https://meinhaarzauber.de/cgi-bin/jgGjVSz/
https://nypthealing.com/wp-includes/open_zone/test_space/gl3_0u3zuy33ws/
https://wb0rur.com/certificates/ot4beu0i-2riv-894132/
https://witje.be/dutchphotozone/LudZ/
https://www.clinicconsortium.org/wp-admin/m6g965115517737951781n53xtjvr52/
https://www.cwa.mx/binar/paclm/b6sh9nce6p/
https://www.doblementa.com/fuentes/closed_0943392_VL4ftKJmKGm2RI/guarded_area/1594173_HUfYRx/
https://www.fizion.nl/wp-content/HOXgqVqWp/
https://www.isatechnology.com/print/60ka4484819911634268909r5a94sk9qha44yu/
https://www.jsdg.com.br/cgi-bin/attachments/
https://www.kriskate.com/upload/private_array/interior_cloud/43197515760197_AFdBR5sJxTTXa/
https://www.kunsttrip.nl/Connections/personal_615619753_43j6pbFo/individual_space/PIhytuTHz_M7qsKb96cddi/
https://www.lgpass.com/images/closed_resource/security_portal/575383_FcZjBnodcIXU/
https://www.libertolaw.com/test/UDMTR/
https://www.lokaunet.com.br/hotel-normandie/1947/nky97u3/4ea1x89704023169y828lkwtz0es1avz/
https://www.ranking-site.de/picture_library/browse/zsaiowa5owa2/
https://www.serviluz.com/leopardo/INC/ysftnf3tkn/
https://zasobygwp.pl/redirect?sig=f88a745272587f579e8ce173b9952c32f161eb9733ec249031b854898cd62375&url=aHR0cDovL2RhbmlydmlucGhvdG9ncmFwaHkuY29tL3dlZGRpbmcvRklMRS94OHp5Nm9nNi8=&platform=desktop&brand=wp/

DOCUMENT FILE HASHES
13a4708ba3c489ad457315f888361347
4f22560ef839a2cbdf19881d01eafda9
8e188e9d2fda2c985e729ae3dd76aa3a
a81ec6aeaa10909b8117bc2f72ee9861
bb53f4dc7ad6331ea849f3351dd8de67
e285ce98290ef514e147ab84909a9500
e34ccc7f59a2795d84d8a5290db48352

PAYLOAD FILE HASHES
13ff330a24b731b44b17f82a1af91a92
18df1e82cadbdefbc8b26d8a65c3bf78
226642de1b8f47b937b5d2e87d1f47ce
261c26a6581db763d7a7f9e1dbc60421
2c1ed05d76392c67f79dc0ec34503bb2
61664591c15d018ef70c1f8e6fea062e
69ab81ef985a3ad5d04dfbca10bd5bea
6ab241a84ffe708a1c46ca017024e591
8a42bd7641ec6c52cf23350cd85a7768
ad0838e5a906117df6240c124da3873c
d949fcb075e13396f2b6f53c61049595
e46a4e31d0a08b65b1450f11b4951fda
f11d578e9c0122a01a7848442b9cac99
f9f3259b684c04c9815f07cc462eca41

EMOTET PAYLOAD URLs
http://amventas.com/public/iu1c_vtucu_ruec/
http://bangkokglass.com/wp-admin/XPfdRq/
http://barkhone.ir/logs/Tqh/
http://bartboutens.nl/wp-admin/no77z_k3_azs/
http://binaboud.com/picaboud/images/4k9w0176085/
http://blscomputerworks.com/journal/nkk7135571/
http://bostonseafarms.com/images/30v/
http://charihome.com/wvw/jP004459/
http://deegit.com/includes/4NO/
http://defiteqazerbaycan.com/admin/1arj7yzuc64148024/
http://diavlos6.gr/radio/CQDun43o75761/
http://ebe.dk/_bordershacked/hacked/cZJi/
http://etawala.com/BACKUP/egNICnA/
http://fericire.zamira.ro/wp/iMC97lw278iw91398794/
http://goldenstatetow.com/peradice.com/jk_le4_xip2a7s6/
http://highlevelphoto.co.uk/Clients/7uf_yp_76rqsyz/
http://instamal.com/eazylot.com/ScVIwfSxR/
http://itbparnamirim.org/wp-admin/vx_o492_ej/
http://itmh.org/wwvvv/e0aa_nir08_vf/
http://itvconsult.com/d3z_knd_g4/
http://jabenitez.com/ts/8okvz_je_lpg9ty/
http://jamesgrantguitar.com/wp-content/wyjh0_a_qa6o72zg/
http://jdelectronics.com.au/1e8nq_ij3_tq76ahy/
http://joeljustice.com/images/OM4AD/
http://johnsonlam.com/images/KO2l8V/
http://jolapa.com/bobby/ll5P/
http://joshuasjewelry.com/feed/JF5x9530/
http://jothay.com/ClientBin/dyMrK85523/
http://juniorsplayground.net/wp-content/b40e81/
http://katebayless.com/3WGf/
http://ke-s.com/wwvv2/x6_po_l4bvtd2d/
http://klem.com.pl/tester/ntts3_j_3cgou2/
http://kmgusa.net/_Media/vcpg_k56w_8d5/
http://kompkon.com/cgi-bin/OAnF682/
http://librero.xyz/Scripts/3y_m0cbe_lpgoj7z/
http://mikeflavell.com/cgi-bin/wzra_mg_1s6h9/
http://moncheznous.ca/js/4w3ze_f_sj/
http://mosdk.com/img/bg/css/f1_ski_fpm2/
http://mosquitohawk.net/cgi-bin/bdk1_70_vsstep/
http://motorcomunicacion.com/wp-admin/0_35_8ebbd/
http://nixoid.com/assets/oHy758/
http://philosopherswheel.com/mizeo9/y_6pth_ymkgef/
http://saangberg.com/wp-includes/u_a_vn/
http://scoenuganda.org/wp-admin/k_fhsvc_wni2zxzrc/
http://surguy.com/assets/1yP/
http://thehenkins.com/cgi-bin/qlGK8wk6ll1458113/
http://virtualmillers.com/corvette/dTAy/
http://webappbr.com/wp-admin/ha_s5_3wf/
http://whatsappsenderpro.com/Videos/4wl_0q0m_g61c3/
http://www.bladimirindustrial.com/light_php/5qj6/
http://www.cankoc.com/images/XoDbXe0X6/
http://www.cotrafina.com/wp-content/xrmq_7ug_ttv/
http://www.earnmoneynow.nl/wp/wp-content/kuZFc658768/
http://www.faulidi.com/oqFagLcs/
http://www.fedaicoskun.com/wp-includes/DbkL403/
http://www.geodesign07.com/wp-content/ni9tn_7_6aiui/
http://www.ifitmoves.net/option-tree/age9k_r7p_0l2/
http://www.inkarainbow.com/antiguo/hLm9K565/
http://www.moverviseu.com/wp-content/jl173/
https://cimsjr.com/hospital/lowxvel44660441/
https://denizyahci.com/asset/4z8qjblu71664/
https://fotoobjetivo.com/wp-content/m_57ss_tqngo4r/
https://itkossi.com/backup/q6bk_pwr0_wevmq/
https://quickwood.com/wp-content/kiw586pbrk520193/
https://sparkcreativeworks.com/spark/QoZqtWjUs/
https://webpresario.com/now/Marck-Script/c3j0x_6_8z2g0sdd/
https://www.knightlycomputing.com/old/wp-content/cache/minify/m_m9_mj/
https://www.merlincolor.com/stylesheets/46_b_ez5p/

EMOTET C2s
http://47.146.117.214
http://62.108.54.22:8080
http://212.51.142.238:8080
http://190.160.53.126
http://87.106.136.232:8080
http://74.208.45.104:8080
http://121.124.124.40:7080
http://124.45.106.173:443
http://76.27.179.47
http://210.165.156.91
http://61.19.246.238:443
http://81.2.235.111:8080
http://169.239.182.217:8080
http://181.230.116.163
http://139.130.242.43
http://46.105.131.87
http://139.59.60.244:8080
http://222.214.218.37:4143
http://41.60.200.34
http://200.55.243.138:8080
http://24.234.133.205
http://190.55.181.54:443
http://189.212.199.126:443
http://93.156.165.186
http://62.138.26.28:8080
http://62.75.141.82
http://176.111.60.55:8080
http://168.235.67.138:7080
http://109.117.53.230:443
http://5.196.74.210:8080
http://162.154.38.103
http://152.168.248.128:443
http://83.110.223.58:443
http://95.9.185.228:443
http://180.92.239.110:8080
http://209.141.54.221:8080
http://37.187.72.193:8080
http://113.160.130.116:8443
http://85.59.136.180:8080
http://79.98.24.39:8080
http://91.231.166.124:8080
http://185.94.252.104:443
http://108.48.41.69
http://95.179.229.244:8080
http://71.208.216.10
http://93.51.50.171:8080
http://78.24.219.147:8080
http://24.179.13.119
http://200.41.121.90
http://153.126.210.205:7080
http://104.236.246.93:8080
http://46.105.131.79:8080
http://201.173.217.124:443
http://50.116.86.205:8080
http://116.203.32.252:8080
http://157.245.99.39:8080
http://109.74.5.95:8080
http://203.153.216.189:7080
http://87.106.139.101:8080
http://137.59.187.107:8080
http://110.145.77.103
http://47.153.182.47
http://95.213.236.64:8080
http://24.43.99.75
http://209.182.216.177:443
http://173.91.22.41
http://5.39.91.110:7080
http://75.139.38.211
http://91.211.88.52:7080
http://37.139.21.175:8080
http://162.241.92.219:8080
http://104.131.11.150:443
http://70.167.215.250:8080
http://104.131.44.150:8080
http://103.86.49.11:8080
http://65.111.120.223

http://201.235.10.215
http://198.57.203.63:8080
http://163.172.107.70:8080
http://172.105.78.244:8080
http://107.161.30.122:8080
http://203.153.216.182:7080
http://37.46.129.215:8080
http://201.214.108.231
http://178.33.167.120:8080
http://181.113.229.139:443
http://192.210.217.94:8080
http://24.157.25.203
http://94.96.60.191
http://157.7.164.178:8081
http://75.127.14.170:8080
http://189.146.1.78:443
http://190.164.75.175
http://192.241.220.183:8080
http://190.55.233.156
http://91.83.93.103:443
http://144.139.91.187
http://87.106.231.60:8080
http://140.207.113.106:443
http://139.59.12.63:8080
http://181.167.35.84
http://50.116.78.109:8080
http://74.208.173.91:8080
http://46.49.124.53
http://81.17.93.134
http://81.214.253.80:443
http://46.32.229.152:8080
http://41.185.29.128:8080
http://190.111.215.4:8080
http://216.75.37.196:8080
http://37.70.131.107
http://181.143.101.19:8080
http://115.79.195.246
http://192.163.221.191:8080
http://87.252.100.28
http://181.164.110.7
http://89.108.158.234:8080
http://105.209.239.55
http://181.134.9.162
http://185.142.236.163:443
http://195.201.56.70:8080
http://78.189.111.208:443
http://113.160.180.109
http://5.79.70.250:8080
http://37.208.106.146:8080
http://179.5.118.12
http://203.153.216.178:7080
http://177.144.130.105:443
http://75.139.38.211
http://177.37.81.212:443
http://77.74.78.80:443
http://78.188.170.128
http://212.156.133.218
http://113.161.148.81
http://46.105.131.68:8080
http://51.38.201.19:7080
http://143.95.101.72:8080
http://212.112.113.235

http://24.249.135.121
http://185.94.252.13:443
http://149.62.173.247:8080
http://50.28.51.143:8080
http://80.249.176.206
http://5.196.35.138:7080
http://190.17.195.202
http://143.0.87.101
http://190.147.137.153:443
http://181.30.69.50
http://51.255.165.160:8080
http://190.96.118.251:443
http://72.47.248.48:7080
http://178.79.163.131:8080
http://212.231.60.98
http://187.162.248.237
http://2.47.112.152
http://68.183.190.199:8080
http://192.241.143.52:8080
http://77.55.211.77:8080
http://87.106.46.107:8080
http://191.182.6.118
http://189.1.185.98:8080
http://93.151.186.85
http://204.225.249.100:7080
http://177.73.0.98:443
http://137.74.106.111:7080
http://219.92.13.25
http://89.32.150.160:8080
http://82.240.207.95:443
http://190.6.193.152:8080
http://190.163.31.26
http://190.181.235.46
http://114.109.179.60
http://70.32.84.74:8080
http://94.176.234.118:443
http://77.90.136.129:8080
http://217.13.106.14:8080
http://212.71.237.140:8080
http://82.196.15.205:8080
http://181.129.96.162:8080
http://104.131.103.37:8080
http://83.169.21.32:7080
http://177.139.131.143:443
http://187.106.41.99
http://104.131.41.185:8080
http://192.241.146.84:8080
http://170.81.48.2
http://181.120.79.227
http://68.183.170.114:8080
http://177.72.13.80
http://61.92.159.208:8080
http://12.162.84.2:8080
http://186.70.127.199:8090
http://45.161.242.102
http://179.60.229.168:443
http://70.32.115.157:8080
http://191.99.160.58
http://172.104.169.32:8080
http://177.66.190.130
http://71.50.31.38
http://203.25.159.3:8080
http://185.94.252.12
http://217.199.160.224:7080
http://177.74.228.34
http://177.144.135.2
http://190.194.242.254:443
http://202.62.39.111
http://201.213.156.176
http://92.23.34.86
http://185.94.252.27:443
http://104.236.161.64:8080
http://181.167.96.215
http://111.67.12.221:8080
http://144.139.91.187:443
http://186.250.52.226:8080
http://46.28.111.142:7080

SUPPORTING EVIDENCE
All of the Word document files were from our honeypot or downloaded directly from URLs.
I manually extracted many of the payload URLs and others were downloaded from URLHaus.
All C2 addresses were extracted manually.