Emotet hosted in Japan 5/Feb/2019

Main object- "02_19"
	url	http://aroa-design.com/OVMG_NCDGe-ubsV/uT/Clients_information/02_19/
	sha256	2e76712669301aee0c9ddafde3390f2da76fa277f2c9d4c48fee5e9013f5540f
	sha1	aa0f1cb38fd2587e6eac8151cac7214e55940c6d
	md5	de447bbbe4da2a894374bb8f9c7f480f
Dropped executable file
	sha256	C:\windows\temp\212.exe	ee336755a22c0bb4a25a54b9c61546f73c9f2a9ea5cd3333db76df78258bb6b9
DNS requests
	domain	hoatuoifly.com
Connections
	ip	103.28.36.25
	ip	201.142.199.76
	ip	197.232.52.70
	ip	190.159.143.96
	ip	190.47.153.46
	ip	189.135.82.225
	ip	187.146.243.126
	ip	23.254.203.51
	ip	105.227.228.7
	ip	181.30.61.163
	ip	187.209.66.50
	ip	72.47.248.48
HTTP/HTTPS requests
	url	http://hoatuoifly.com/x4KlFN7m3X
	url	http://hoatuoifly.com/x4KlFN7m3X/
	url	http://189.135.82.225:8080/
	url	http://190.47.153.46:8080/
	url	http://72.47.248.48:8080/
	url	http://23.254.203.51:8080/
HTTP requests wrote in MalDoc Macro
	http://hoatuoifly.com/x4KlFN7m3X
	http://choobika.com/AzIHTA6I8
	http://debesteuitvaartkostenvergelijken.nl/Cbz03rYf
	http://keylord.com.hk/byFJORP
	http://host1724967.hostland.pro/P1KDmtw
Emotet C2 communication analysed with Cape Sandbox
	201.142.199.76:465
	190.159.143.96:20
	197.232.52.70:20
	189.135.82.225:8080
	187.146.243.126:22
	190.47.153.46:8080
	181.30.61.163:22
	187.209.66.50:7080
	105.227.228.7:22
	189.236.96.21:993
	23.254.203.51:8080
	72.47.248.48:8080
	219.94.254.93:8080
	187.153.217.39:50000
	187.232.31.68:7080
	187.208.214.53:20
	181.164.241.251:443
	84.45.230.228:443
	101.187.168.2:443
	181.39.66.29:443
	144.76.117.247:8080
	216.81.19.67:22
	79.98.31.206:443
	133.242.208.183:8080
	68.149.151.102:22
	190.110.239.130:465
	190.110.239.130:995
	78.186.175.183:21
	165.227.213.173:8080
	70.24.147.203:443
	132.248.18.45:8080
	70.45.30.28:8080
	200.80.163.11:7080
	190.246.193.16:443
	186.71.54.74:20
	190.162.189.46:80
	190.17.128.149:21
	92.48.118.27:8080
	109.104.79.48:8080
	189.131.162.36:80
	190.190.100.185:80
	138.68.139.199:443
	69.163.33.82:8080
	63.143.67.107:20
	101.187.168.2:465
	210.2.86.72:8080
	181.126.84.70:80
	187.153.217.39:7080
	24.53.231.96:50000
	192.155.90.90:7080
	5.9.128.163:8080
	187.147.145.48:143
	190.97.32.17:80
	159.65.76.245:443
	185.86.148.222:8080
	1.9.150.93:80
References
	https://app.any.run/tasks/ee5e770f-1984-4c4e-8301-78469b6d586e
	https://cape.contextis.com/analysis/34983/
	https://cape.contextis.com/submit/status/34986/