exfil info for https://pastebin.com/6STfWZmt

5fgedhd.duckdns.org/believe/2020china_UPDATE.zip
exfil: [email protected],[email protected],[email protected]

accz10.ddns.net/accz18.ddns.net/fb.zip
exfil: writes to file `acc.txt`

accz10.ddns.net/sunnyteam.cf/codehotmail.zip
exfil: n/a (appears to be some java-based mailserver or something)

amanage-heiper.servehalflife.com/16Shop_Amazon_V1.9.0.zip
exfil: [email protected]

chase09support.duckdns.org/Spox_V5_Reloaded%20(2).zip
exfil: [email protected] / [email protected]

claims-2020.claim-get76.cf/LUCKY_SPIN_V2.zip
exfil: [email protected] (likely unconfigured)

huntington-auth.ddns.net/huntington.zip
exfil: [email protected]

joingrubselebtiktok.kozow.com/asik-Spammer_ID.zip
exfil: [email protected]

love-connection-instagram.giize.com/instagram.zip
exfil: writes to file `usernames.txt`

online07updates.duckdns.org/Support/Secured/skorp61.zip
exfil: [email protected]

s3cur3091.freedynamicdns.org/chasev3.zip
exfil: [email protected]

secur3039.zapto.org/CHASE%20XBLATI%20SCAMA%20V2%202020(2)%20(2).zip
exfil: [email protected]

secure03rc-wells.servehttp.com/Wels%20Fargo%20Scampage.zip
exfil: [email protected]

secure07achases.serveirc.com/Chase%20Spox%20V3.zip
exfil: [email protected]

secure09lb-chase.serveirc.com/web/auth/spoxchaseltee.zip
exfil: [email protected] / [email protected]

serviciosmanuelaesparasistema-co.cf/cm/htm.zip
exfil: [email protected] / [email protected]

verifi-s3cure.gleeze.com/verify/Original1.zip
exfil: [email protected]

verification09support.duckdns.org/secured04/huntington%20(2).zip
exfil: [email protected]