2020-07-20 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
abid[.]ali@bigbirdfoods[.]com
accounting@emesustravel[.]com
bambang[.]irwansyah@pmt[.]co[.]id
bich.plg2@phanthietgarment[.]com[.]vn
guoying9@cfldcn[.]com
hy-matsushima@irimaru[.]co[.]jp
kgarcia@corporacionadc[.]net
khuetq@haiancorp[.]vn
lideres[.]fsa@globalpack[.]com[.]br
mindelo@swelldsul[.]com
nyi[.]nap[.]khun@mglexpress[.]com[.]mm
ops3@fontana-ftp[.]com
regenciagenial@gk[.]com[.]ni
tes.sales07@tesvn[.]vn

MALDOC DISTRIBUTION URLS
hxxp://224fgbet[.]com/cgi-bin/w2np2phc_EkOUKHK_disk/special_Kqesx5w_OCO0pTsaAvb8Sp/2mil6mbiwwleka_9uu7/
hxxp://24kitten[.]com/homfjj/FILE/
hxxp://ahiraatfashion[.]com/wp-admin/LLC/mb7syd89659110tspyxuoqfl8y/
hxxp://atsgrandstand99a[.]in/wp-content/uploads/attachments/
hxxp://axis-map[.]com/wp-admin/RGL440CNC/r2j3ky01ozlu/573113743626774500sei4uvc2z5f5p2/
hxxp://bahamasmenmarch[.]com/cgi-bin/statement/ncroakuks24/6gqgt231953528r6oab9fkkt3o8nmmf0153/
hxxp://biocharcoal[.]biz/assets/paclm/p1r67412932cras4kfuzu52xx9hf/
hxxp://bioconscientific[.]com/wordpress/INC/epqz7g6a1tqk/
hxxp://blog[.]nuvemvet[.]com/wp-content/uploads/khpo2_xgxsif4_disk/open_269961081369_3hXV6tZIL/09884770150099_vP6Tlg/
hxxp://blog[.]sigma[.]la/wp-content/invoice/
hxxp://blogdobene[.]com[.]br/wp-content/paclm/oqh37904908337604i1kril24jg6njb/
hxxp://calzadosyaccesorios[.]com/wp-content/plugins/wp-optimize/cache/balance/6uum399349075e49y7zg5lmhju/
hxxp://castrack[.]in/wp-content/i3kIS-inU1FIkh6hcKLIo-module/cufm31fe6pa3-gus-forum/nyIWMyaqX-kyfGHrjymvpo/
hxxp://charlols[.]ascjcapstone[.]com/wp-content/uploads/report/jo547910368498puwdwre1w/
hxxp://cnml[.]com[.]br/tmp/Document/mf1xmhhicy8/
hxxp://createanwebsite[.]com/websiteguide/paclm/
hxxp://cryptonewssource[.]com/wp-admin/closed_50503358_EWTPtDGEj/individual_forum/3780115806_25ob70cUNCxq/
hxxp://deltaconcretos[.]com[.]br/wp-admin/mw9ci66b73f2yb_cvrs20ip7_resource/open_warehouse/072007625_23icRvh/
hxxp://diplomaciat[.]org/wp-admin/available_section/wwc_5zlmfgr86y197_portal/1596469_mAM7X5KO8eCDr/
hxxp://dsoft[.]software/euy/q1ju3fch3l/40cj6g039405p921ltvxz81/
hxxp://edmedicationguide[.]com/wp-admin/balance/c72682830684102z3frfjy8i55xmv7/
hxxp://elilaifs[.]cn/wp-admin/parts_service/jecxwnaz1j/[.][.][.]/
hxxp://ellepioffice[.]com/images/invoice/
hxxp://fokuss[.]tv/wp-content/e88-p8fd-06518/
hxxp://gayasianporn[.]men/wp-includes/docs/
hxxp://global9[.]in/cgi-bin/attachments/w77z4335091023lbvrwgqrqmjsk3c/
hxxp://gojicreamasli[.]com/wp-includes/private_module/security_space/2021163_SDnFlEAG/
hxxp://goviet[.]co/wp-content/LLC/
hxxp://guncelsarkisozleri[.]com/wp-admin/closed_XegDGkOU6k_BDa4RUKZ9T8jDp/special_276798820_cRJCPEjzf4SV0c/h4k1QdzQ_qHh0bqwbdyk7o/
hxxp://guoxiaorui[.]cn/wp-admin/private_box/verifiable_nEW9GaZcD5_ErEAKDURusH1/396272401412_MxKASVnr/
hxxp://h5[.]qq125[.]com/little/Reporting/cvk76m6/
hxxp://healthandsafetyevolution[.]com[.]au/2vqjz/attachments/b083p507483844725c9mgx4jd8ejmjp3uslo/
hxxp://hyundailamdong[.]com[.]vn/wp-content/sites/n79kxk1/
hxxp://i-rewardshop[.]com/wp-admin/multifunctional_zone/rx2lb_74zwcm1q413a_warehouse/2618221935_OK7zN9/
hxxp://jojo[.]school/2empdo/multifunctional_resource/rzdbt5sfk_r9e4g3acj_space/28114737_IJ895I306nW8/
hxxp://kidozvilla[.]com/wp-content/open-resource/t4saZYMk-hKrEQAWebGrNw-forum/mvru1ufrxa-s06v016688v66/
hxxp://koncenful[.]com/wp-content/lm/hmhj52/ook7ri689941810111164mlk5ffuksnm6anf/
hxxp://konsultaniso[.]biz/vxggugz/invoice/
hxxp://koogaya[.]com/wp-includes/sites/
hxxp://leonardoenergie[.]it/media/balance/
hxxp://letu8888[.]com/wp-admin/report/ck165923294108833875trpu7qznfted/
hxxp://makcanpeyzaj[.]com/cgi-bin/available-section/interior-38UmAZus-OB5ZbE0hkw2UV/fsgh8il32peneox0-0ys95/
hxxp://nmgoodsvungtau[.]com/eyycq1/private_hc7h_W86AIqS52N0v6s/open_portal/iecv_87362307yu4t/
hxxp://oojo[.]ru/wordpress/available_zone/close_9OebNEzs8m_z9g3Jg8ABn/uydsbwaptsroph32_6s5w51v808xz26/
hxxp://postpolicy[.]it/wp-content/362114823344470/
hxxp://pourinplace[.]com[.]au/protected-721756433-UEytBICYRMNi7y/individual-cloud/g0f9LGvFt-ptp2bxK58/
hxxp://proba[.]viruskompjuteri[.]com/cgi-bin/attachments/
hxxp://qhn[.]vn/default/attachments/
hxxp://raz-dlugin[.]co[.]il/wp-content/axwsbj5fj/fw848836656dlyec7y44ho3ekea7wt3/
hxxp://samplewebsitesolarsystem[.]global9[.]in/cgi-bin/personal_zone/additional_space/uVXYOc1T_uJ4j1m9f04/
hxxp://secpin[.]com/cgi-bin/available_disk/interior_70578141747_tLe5PqBk/ombaruwi2_0653w3s/
hxxp://secure[.]app-amazon[.]com[.]recovery-account[.]amazon[.]com[.]alphatravelmongolia[.]com/assets/esp/ujq5533535942qgcxakvkzo21408s/
hxxp://seimeinooka[.]jp/wp-content/Reporting/xvu9eb/
hxxp://sngp[.]ir/wp-admin/parts_service/fwjopp87287710fjozromldg5c3ijf/
hxxp://stylowepodroze[.]pl/cgi-bin/docs/n18032519nn53tcc8h5c0/
hxxp://thecareerventures[.]co[.]uk/wp-content/closed-array/open-forum/820713356294-Ba1VaQQ/
hxxp://tm-74[.]ru/recent_searches/swift/d499ccg1z8/
hxxp://trelectoniclimited[.]com/wp-content/multifunctional_zone/close_LJh3ta0h_OqAGMHGVZ1bWb/686299627893_xN7EHt3ccgn/
hxxp://udhayamgeneraltrading[.]com/wp-content/parts_service/
hxxp://utkanbostanci[.]xyz/cgi-bin/personal-sector/guarded-dq1-bn4m3jo68y/z9p-v1w3y1852x2/
hxxp://valery[.]ir/wp-admin/qqvC-kULzS253EdA-disk/test-portal/9739919332199-JZtfIjjtzfA27qdB/
hxxp://vivoworld[.]co[.]za/blog/available-disk/open-5caoh9dp-2qqr1q32o7xujr/iabfoy1y1-10941y5t/
hxxp://voteclevelandforcongress[.]com/jz1st07z/private-sector/open-1783753521-S0WMhH/2x66eqj3uogmasyn-x5zw6s/
hxxp://wellnessredifined[.]com/wp-admin/available_disk/guarded_space/1685897_HW1bxJWn/
hxxp://willingwoods[.]com/wp-admin/c4ltvj0f7/
hxxp://work[.]wangyu100[.]com/admin/open_module/verified_PpzZb7ffT_Ami55ISr/630051342_HEGSoUG0cnu2ZoV/
hxxp://www[.]0931tangfc[.]com/images/8u6n74/
hxxp://www[.]0931tangfc[.]com/images/n87WVaao-Ni1UKbnpj-273558190608-Mrzm7T74dB/open-profile/oywpq-scdd0g4v/
hxxp://www[.]3fqw[.]com/oauth/W7HOV/
hxxp://www[.]addahealingmusic[.]com/wp-includes/d4zkckftm2p/
hxxp://www[.]adrianamurakami[.]com/home/esp/gvciffc/23747744351595hz85cik4i45p/
hxxp://www[.]basedadosempresas[.]pt/respaldos/ogjslu-zkm3s18l4nd-zjQ4a-xsZR8Bd/special-area/1643958184864-DR4xAWp91/
hxxp://www[.]cardapioideal[.]com/websiteguide/Documentation/ylbe1qva29/
hxxp://www[.]decoridea[.]net/image/personal-resource/7qq4d4pu8jl-20izkpkoy3o-area/01wo0-3s2z8923152/
hxxp://www[.]droolingoven[.]com/wp-content/DOC/ivxowwaxbs/g420635861004094978eb3ig1nz2iws1i/
hxxp://www[.]drsoli[.]com/k1vjzk/multifunctional_box/special_area/ab6pukxbu4_64x454y46339z/
hxxp://www[.]edmedicationguide[.]com/wp-admin/balance/c72682830684102z3frfjy8i55xmv7/
hxxp://www[.]ezelleproperties[.]com/wp-admin/multifunctional_711456_lTCJr/test_cloud/SFPjo6DP_s2kd0issGz/
hxxp://www[.]farmacianuovaferretti[.]it/softaculous/001987522_o3QNhDetUxyJMfW_zone/additional_portal/SyYDtze7rG8_bsmc88Gkz/
hxxp://www[.]gh99[.]cn/d/Documentation/
hxxp://www[.]hrb112[.]net/wp-admin/sites/qonvh1m0708914ch3oca98wr1gb2/
hxxp://www[.]hxy58[.]cn/wp-admin/i5aoh6flp74y1-s1wmck-resource/individual-area/SSxyOV0IFf-v7G8urrd4up/
hxxp://www[.]lovesceneonline[.]com/images/Scan/wjqmogm/
hxxp://www[.]timelyrain[.]top/wp-includes/docs/shjz1ovk/
hxxp://www[.]timelyrain[.]top/wp-includes/Overview/o8vyew6pg/
hxxp://www[.]yunguji[.]com/wp-content/Scan/dd338476174971667033gjkbd11d976pl/
hxxp://yaalaa[.]cn/wp-admin/swift/k5j8h6/
hxxp://yq001[.]com/admin/docs/
hxxp://zabor[.]minsk[.]by/blogs/common_zone/x8xlpnjxrpy6t_rjp2qrv1_profile/69909594547_Tee4IQ/
hxxps://1[.]33x[.]us/wp-admin/9WJH36Q/
hxxps://33x[.]us/wp-admin/personal_zone/open_profile/w92m2mpt_yy3v48t41t76/
hxxps://anhdung[.]cf/zh8uj/closed-mVbWo-Lf2b4ytDyUtki/additional-portal/12659545774-iKu33eqyMzGk/
hxxps://bomfimadvocacia[.]com[.]br/wp-content/Documentation/
hxxps://butuhapa[.]id/wp-admin/DOC/f8b2g0/
hxxps://cardapioideal[.]com/websiteguide/Reporting/p3nzub7trs/p684roh721987448kb5xv5wj3l7cfxazj/
hxxps://citireal-group[.]com/wp-admin/multifunctional-disk/close-portal/8am2h6-y8161638zt/
hxxps://coverdomesticappliances[.]com/wp-content/Documentation/
hxxps://cpnti[.]com/wp-content/common-array/verifiable-space/ozlkdk0-543v5xu/
hxxps://dz[.]martinface[.]com/uc_client/available_array/m2b5ak5gnfnqu_6gp65uv1s299_portal/gzcnvnz3by_z702s8x/
hxxps://ecoenergie[.]com[.]tn/wp-admin/private-resource/special-profile/0pI20WC6-63fgqyq66xnIpw/
hxxps://evrimo[.]com/wp-includes/browse/
hxxps://findyourboat[.]eu/wp-content/5w-ggz8duidpz-section/security-portal/9wv1kha4xzzb70-z057u/
hxxps://fisipedia[.]com/ebi/lm/
hxxps://fotros19[.]ir/wp-admin/personal-module/open-forum/eironmillckl4-ws6y4u1/
hxxps://gachchiulua[.]com[.]vn/old/011880-7A1cksIz3XpUT34n-9177989-lvZNNppH9/additional-cloud/730137939-0XIfPi1QW/
hxxps://gehua[.]com[.]cn/vrwmg/closed_section/verifiable_cloud/I79wBvJ56pT_Jtycbeyq3M/
hxxps://gehua[.]com[.]cn/vrwmg/protected-array/verifiable-f8kpf06bnqkg-4g5q634m/u8IZWp-boGkKqoshl/
hxxps://gibelarmino[.]com[.]br/wp-snapshots/swift/
hxxps://gibelarmino[.]com[.]br/wp-snapshots/swift//
hxxps://gmjenkins[.]com/sean/lm/
hxxps://goldenbridgeelectrical[.]in/jmc3r/attachments/j1932485318pp2qvxj5ca13j2djd5/
hxxps://healthpointchc[.]org/lm/dn3wzemw7fk/
hxxps://hervin[.]martinface[.]com/wp-admin/open_khshqva21g_x5ttqqcj92/guarded_b2s7tfnfg3f8_jkupu27q4npw/c3yeb9lZETW_5rmH4491ILHLz5/
hxxps://huakai[.]com[.]tw/wp-content/closed_593437422_ggMWM/security_y7y6_y0o6/8i97h0_0xs645/
hxxps://hushpuppi[.]xyz/wp-content/available_resource/open_area/2408959_o4IL0Wj/
hxxps://innveso-digital[.]com/includes/sites/5rcj4ci/72oo518108929h1yw7g525mtr0y/
hxxps://ivytheme[.]com/wp-admin/tt6u-3vgvjwfkz94c-array/verifiable-b2m9dxvo9b7-r5m3jv566kv3d/683075190809-j8L7J7xRk7/
hxxps://iwp[.]kim/wp-admin/report/e3cktl766195076c0cikoray2wxzd45ulpuxx/
hxxps://learntocodeafrica[.]com/wp-includes/eTrac/xbpankeawfx9/
hxxps://medint[.]io/wp-admin/multifunctional_1c1cp_myq46my71sbm/0284198117_FdmB7AqYh_j1PN2sug_Mw9mzfXW/Pw0tvxf_1a0f3jd3/
hxxps://medistalk[.]com/wp-content/parts_service/a63wky3luq99/
hxxps://milestonesolution[.]cf/wp-includes/lun184196425tq6vyei0af0nliatfi/
hxxps://mirangallery[.]ir/wp-content/common-zone/FHhHNa-HuFXytdkkWvp9G-cloud/54716410-ffDLwnsTlwmm/
hxxps://mooon[.]store/wp-admin/common_zone/test_kxbhepgqbt3gen_goqxbtd89j/529034720_4FcaYsXNbJpoENkn/
hxxps://mylisting[.]martinface[.]com/wp-admin/available-FUe1-mLSNIHV1ae1so/9Vjy-1RRRUlGK-profile/333515-Xqovm94aaI/
hxxps://nbss[.]co[.]in/js/sites/
hxxps://nmcllc[.]us/wp-admin/DOC/02qbd42rjk/
hxxps://nxrtts[.]com/wp-admin/browse/kefzenw910614406579jegjsx9v5acv2xjq6/
hxxps://ouryen[.]com/wp-admin/available-resource/external-space/y5rkjFAe9B0L-48KfMK6Kqe/
hxxps://pan[.]sextoyforfree[.]com/view/invoice/z6z1uleps86/
hxxps://pellesbar[.]co[.]il/wp-content/available_zone/KNJGZ_VlzntlTk_kiIWP_cpY0PhyPrciSA/4bzklsgyst_s94u96/
hxxps://policelifeline[.]in/wp-admin/LPpQ_xullYkzZkuS_l5c5l_s2rumvkbkg/interior_2JJIN1P_E7TtPN4KixZ/30446086_kSU4jQEyjg/
hxxps://poolvasarmaye[.]com/wp-admin/Document/jj9lj20p/hctrq0869712525190780mfilhsn2mj7bjuf7cs/
hxxps://reklamatg[.]ru/wp-includes/LLC/
hxxps://roofingservicecompany[.]com/k2ban/balance/db8jpsw/
hxxps://ropa-americana[.]com/ohba0/available_array/external_cloud/1244816301212_ndKC4sv7VPOju12/
hxxps://sandhutengineersandconsultants[.]in/cgi-bin/multifunctional_7932735101051_xqvmkA1k/special_QFqehEB_wHbb6DvVH/w8m7v_3208/
hxxps://siworldcare[.]com/wp-admin/Reporting/
hxxps://smartrent[.]com[.]co/wp-content/nwwsawd7/zhindm4477339280946bjo310azdte95j2/
hxxps://studentscorner[.]info/wp-content/tbu33y-7k66e-70546/
hxxps://suezelevators[.]com/aa/snlb8ld1ilp/
hxxps://supercutscissors[.]com/wp-content/uploads/11a-t48x-5941/
hxxps://tasty[.]website/new/parts_service/pjbpdknvxu7/
hxxps://teta-co[.]com/en/LLC/10xi2l3w5w9/m9itm275200454323349817ogag2sha7gelm19g6/
hxxps://traeumen-zwischen-baeumen[.]de/wp-admin/backend/statement/a1ee2lb42211110056352144x2qrdl2ij3q2wlrntp/
hxxps://udhayamgeneraltrading[.]com/wp-content/parts_service/
hxxps://volparts[.]com[.]tr/css/paclm/
hxxps://wdbqschools[.]org/Document/ctrhu7ca1710/n7mqil-568877423-6079999-pilc3-20s15dh
hxxps://wdbqschools[.]org/MEDICAL/trxxunnz4/r5j2-637696672-3587111102-pd39p-bl7s70yx
hxxps://winningmindssolutions[.]com/v6jyzpw/protected_module/interior_profile/VHLjySauQ_6tuvhj4G/
hxxps://wpbkw[.]com/wordpress/browse/
hxxps://www[.]allsound[.]fr/wp-content/uploads/statement/vhxjig/
hxxps://www[.]biyaofushi[.]com/xkf1bbx/open_module/security_a8n_jdy/1764518343_6WZkUj0kZ/
hxxps://www[.]cardapioideal[.]com/websiteguide/Documentation/ylbe1qva29/
hxxps://www[.]diario7lagos[.]com[.]ar/wp-content/2uvor9_otm9p0f_disk/open_forum/xctqfhnebvcku_u77005w85sy46/
hxxps://www[.]dongguanjixie[.]com/wp-admin/tj3bzd/
hxxps://www[.]droolingoven[.]com/wp-content/DOC/ivxowwaxbs/g420635861004094978eb3ig1nz2iws1i/
hxxps://www[.]lakinsurancebrokers[.]com/8qqciw9ur/personal-sector/verifiable-forum/85823007880643-pLlQ9xTNxyzFza/
hxxps://www[.]lavidagroups[.]com/backup-files/personal_resource/0063688_4ifDH1sv_area/0im1xui0_1twsut4xt71z/
hxxps://www[.]le-bascala[.]com/wp-admin/available-box/additional-1wqdun-jt21nj35k3dcgh/04wco45djfqca3-3z5x40u/
hxxps://www[.]marolabtek[.]com/wp-includes/protected_module/verified_forum/qons7wtihvtv5di_588v/
hxxps://www[.]panoramatecnologia[.]com/fisy1/qckmpIp_82y9LHfyp6MN_box/close_profile/3mhzlcogex_9y854y9x4xvs84/
hxxps://www[.]pharma-israel[.]org[.]il/wp-content/paclm/
hxxps://www[.]readandcobooks[.]co[.]uk/wp-content/k4eLF-7XMHSfkhdfxpJ-array/security-warehouse/wa08-90w0u5s/
hxxps://www[.]spfi[.]org[.]in/fonts/available_zone/x2ZV3S_Mnnm8b8oFkm_portal/UeVVw0qJO1_x7Nv2Nvm7/
hxxps://www[.]supercutscissors[.]com/wp-content/uploads/Reporting/4v9rvl4460721uwty5svu6eg2cw/
hxxps://xo57[.]com/wp-admin/Scan/3nfy50tod/
hxxps://yoyoso[.]nz/wp-admin/multifunctional-resource/corporate-warehouse/xw9a70mybzbjeblu-ty4318w6249y/

WORD DOCUMENT FILE HASHES
4e8d15cdf4bf67d34b38f5e71836d60c
94770c600743164ce0d5e00478c39c7b
a64c3e1007adeb81f91c394b75afe508
a7d6db9221a0f4816338342dc4be7e39
3365621ec91eae344c76cc98f1dbf7e0
ff6fe5c4c6fbd433a9ff296469f2e560
7674532d3da3b2737624f9ad3c472eb5

PDF FILE HASHES
358173f5ed5b04417c70efa712fbc7a7
68f08afe5a8ac831a46eb6d222ba6967

PAYLOAD FILE HASHES
118302289eb5079c8ef0ba3f72bfa8f8
11b11dd28aef3b8f85149d9e2f19f69a
1b958731ebe74d0d474ca1d3a80d80f1
2c56b15a14e285ebf15380559c125805
3865f8609b4179d04d7a2d3eb4fee0c1
7d6f9c789a1b4a9ac50c64618d211621
bdad19bd621b6741f3d7c32d3a9098cd
c48ee5f52a225f2516efd5ad0a08e994
c8bceb737a01f3d8d18099118abadf7f

EMOTET PAYLOAD URLs
hxxp://abatiy[.]com/yaa/po0395/
hxxp://dnamsolutions[.]com/wp-content/uploads/2020/06/1lysfmz246/
hxxp://elseelektrikci[.]com/wp-content/hedk3/
hxxp://gardenlogy[.]com/images/4x2vqro/
hxxp://gobisz[.]com/wp-content/wbhJWVHG/
hxxp://hdlinkslist[.]site/wp-admin/EfxXO94/
hxxp://job[.]schooljano[.]com/assets/cV3536/
hxxp://mytestingserver[.]ml/wp-admin/41m/
hxxp://ripro[.]martinface[.]com/wp-admin/nkf75/
hxxp://sportchecker[.]net/wp-admin/tG517758/
hxxp://uniworldstudios[.]com/plugins/x2/
hxxp://website[.]cxyw[.]net/admindm-yourname/8QvK/
hxxp://wellnessbeautyhub[.]com/wp-admin/ntQ549/
hxxp://www[.]cxyw[.]net/wp-includes/JwryoDD2/
hxxp://www[.]elseelektrikci[.]com/wp-content/hedk3/
hxxp://www[.]wangyutv[.]com/wp-includes/B/
hxxp://z-lab-company[.]com/cgi-bin/Bn2bet3uy9384/
hxxps://adealbox[.]com/wp-includes/WSWQqo9uu6n233110/
hxxps://apecwyndhammuine[.]com/wp-admin/otrWfeJy/
hxxps://bitvshe[.]club/wp-content/eUogo68753/
hxxps://celadon-emerald[.]mockienan[.]com/wp-content/35FcEzOH/
hxxps://citirealbinhthuan[.]com/wp-admin/YJDKtSXLX/
hxxps://dev1[.]eisntmoodle[.]site/test/Vg2OrSkyy/
hxxps://digitalsanyog[.]com/wp-content/oaCMT590/
hxxps://elseelektrikci[.]com/wp-content/hedk3/
hxxps://gachchiuaxit[.]com/wp-admin/wkrl/
hxxps://innovertec[.]com/af/tNpI/
hxxps://kdtphumy[.]com/wp-admin/zBhg8yr5k6450/
hxxps://lawofattraction[.]work/xqe/26ne2fi8ls6u552721/
hxxps://oneindex[.]martinface[.]com/view/omH8LwIL/
hxxps://pan[.]martinface[.]com/CloudreveInstaller/gf6b59/
hxxps://roicons[.]com/wp-includes/GW804307/
hxxps://video[.]martinface[.]com/fonts/awDD6XwyN/
hxxps://www[.]lwzmy[.]com/logreport/LNGwoQlM/

EMOTET C2s
hxxp://101[.]187[.]97[.]173
hxxp://103[.]86[.]49[.]11:8080
hxxp://104[.]131[.]103[.]37:8080
hxxp://104[.]131[.]11[.]150:443
hxxp://104[.]131[.]41[.]185:8080
hxxp://104[.]131[.]44[.]150:8080
hxxp://104[.]236[.]161[.]64:8080
hxxp://104[.]236[.]246[.]93:8080
hxxp://108[.]48[.]41[.]69
hxxp://109[.]117[.]53[.]230:443
hxxp://109[.]74[.]5[.]95:8080
hxxp://110[.]145[.]77[.]103
hxxp://110[.]44[.]113[.]2:8080
hxxp://111[.]67[.]12[.]221:8080
hxxp://113[.]160[.]130[.]116:8443
hxxp://113[.]160[.]180[.]109
hxxp://113[.]161[.]148[.]81
hxxp://114[.]109[.]179[.]60
hxxp://115[.]79[.]195[.]246
hxxp://116[.]203[.]32[.]252:8080
hxxp://12[.]162[.]84[.]2:8080
hxxp://121[.]124[.]124[.]40:7080
hxxp://124[.]45[.]106[.]173:443
hxxp://137[.]59[.]187[.]107:8080
hxxp://137[.]74[.]106[.]111:7080
hxxp://139[.]130[.]242[.]43
hxxp://139[.]59[.]12[.]63:8080
hxxp://139[.]59[.]60[.]244:8080
hxxp://14[.]99[.]112[.]138
hxxp://140[.]207[.]113[.]106:443
hxxp://143[.]0[.]87[.]101
hxxp://143[.]95[.]101[.]72:8080
hxxp://144[.]139[.]91[.]187
hxxp://149[.]62[.]173[.]247:8080
hxxp://153[.]126[.]210[.]205:7080
hxxp://157[.]245[.]99[.]39:8080
hxxp://157[.]7[.]164[.]178:8081
hxxp://157[.]7[.]199[.]53:8080
hxxp://162[.]154[.]38[.]103
hxxp://162[.]241[.]92[.]219:8080
hxxp://163[.]172[.]107[.]70:8080
hxxp://168[.]235[.]67[.]138:7080
hxxp://169[.]239[.]182[.]217:8080
hxxp://170[.]81[.]48[.]2
hxxp://172[.]104[.]169[.]32:8080
hxxp://173[.]91[.]22[.]41
hxxp://176[.]111[.]60[.]55:8080
hxxp://177[.]0[.]241[.]28
hxxp://177[.]139[.]131[.]143:443
hxxp://177[.]144[.]130[.]105:443
hxxp://177[.]144[.]135[.]2
hxxp://177[.]66[.]190[.]130
hxxp://177[.]72[.]13[.]80
hxxp://178[.]33[.]167[.]120:8080
hxxp://178[.]79[.]163[.]131:8080
hxxp://179[.]5[.]118[.]12
hxxp://181[.]120[.]79[.]227
hxxp://181[.]129[.]96[.]162:8080
hxxp://181[.]134[.]9[.]162
hxxp://181[.]164[.]110[.]7
hxxp://181[.]167[.]35[.]84
hxxp://181[.]167[.]96[.]215
hxxp://181[.]230[.]65[.]232
hxxp://181[.]30[.]69[.]50
hxxp://181[.]31[.]211[.]181
hxxp://185[.]142[.]236[.]163:443
hxxp://185[.]94[.]252[.]104:443
hxxp://185[.]94[.]252[.]12
hxxp://185[.]94[.]252[.]13:443
hxxp://185[.]94[.]252[.]27:443
hxxp://186[.]208[.]123[.]210:443
hxxp://186[.]250[.]52[.]226:8080
hxxp://186[.]70[.]127[.]199:8090
hxxp://187[.]162[.]248[.]237
hxxp://187[.]51[.]47[.]26
hxxp://189[.]218[.]165[.]63
hxxp://190[.]108[.]228[.]62:443
hxxp://190[.]144[.]18[.]198
hxxp://190[.]147[.]137[.]153:443
hxxp://190[.]160[.]53[.]126
hxxp://190[.]163[.]1[.]31:8080
hxxp://190[.]17[.]195[.]202
hxxp://190[.]171[.]153[.]139
hxxp://190[.]181[.]235[.]46
hxxp://190[.]194[.]242[.]254:443
hxxp://190[.]229[.]148[.]144
hxxp://190[.]251[.]235[.]239
hxxp://190[.]55[.]181[.]54:443
hxxp://190[.]55[.]233[.]156
hxxp://190[.]6[.]193[.]152:8080
hxxp://190[.]63[.]7[.]166:8080
hxxp://192[.]163[.]221[.]191:8080
hxxp://192[.]210[.]217[.]94:8080
hxxp://192[.]241[.]143[.]52:8080
hxxp://192[.]241[.]146[.]84:8080
hxxp://192[.]241[.]220[.]183:8080
hxxp://195[.]201[.]56[.]70:8080
hxxp://2[.]47[.]112[.]152
hxxp://200[.]41[.]121[.]90
hxxp://200[.]55[.]243[.]138:8080
hxxp://201[.]173[.]217[.]124:443
hxxp://201[.]212[.]78[.]182
hxxp://202[.]62[.]39[.]111
hxxp://203[.]153[.]216[.]178:7080
hxxp://203[.]153[.]216[.]182:7080
hxxp://203[.]153[.]216[.]189:7080
hxxp://203[.]25[.]159[.]3:8080
hxxp://204[.]225[.]249[.]100:7080
hxxp://209[.]141[.]54[.]221:8080
hxxp://210[.]165[.]156[.]91
hxxp://211[.]20[.]154[.]102
hxxp://212[.]112[.]113[.]235
hxxp://212[.]51[.]142[.]238:8080
hxxp://212[.]71[.]237[.]140:8080
hxxp://216[.]75[.]37[.]196:8080
hxxp://217[.]13[.]106[.]14:8080
hxxp://217[.]199[.]160[.]224:7080
hxxp://219[.]92[.]13[.]25
hxxp://220[.]128[.]125[.]18
hxxp://222[.]214[.]218[.]37:4143
hxxp://24[.]1[.]189[.]87:8080
hxxp://31[.]31[.]77[.]83:443
hxxp://37[.]139[.]21[.]175:8080
hxxp://37[.]187[.]72[.]193:8080
hxxp://37[.]208[.]106[.]146:8080
hxxp://37[.]46[.]129[.]215:8080
hxxp://37[.]70[.]131[.]107
hxxp://41[.]185[.]29[.]128:8080
hxxp://41[.]60[.]200[.]34
hxxp://45[.]118[.]136[.]92:8080
hxxp://45[.]161[.]242[.]102
hxxp://46[.]105[.]131[.]68:8080
hxxp://46[.]105[.]131[.]79:8080
hxxp://46[.]105[.]131[.]87
hxxp://46[.]214[.]11[.]172
hxxp://46[.]28[.]111[.]142:7080
hxxp://46[.]32[.]229[.]152:8080
hxxp://46[.]49[.]124[.]53
hxxp://5[.]196[.]35[.]138:7080
hxxp://5[.]196[.]74[.]210:8080
hxxp://5[.]39[.]91[.]110:7080
hxxp://50[.]116[.]78[.]109:8080
hxxp://50[.]116[.]86[.]205:8080
hxxp://50[.]28[.]51[.]143:8080
hxxp://51[.]255[.]165[.]160:8080
hxxp://51[.]38[.]201[.]19:7080
hxxp://61[.]19[.]246[.]238:443
hxxp://61[.]92[.]159[.]208:8080
hxxp://62[.]138[.]26[.]28:8080
hxxp://62[.]75[.]141[.]82
hxxp://68[.]183[.]170[.]114:8080
hxxp://68[.]183[.]190[.]199:8080
hxxp://70[.]32[.]115[.]157:8080
hxxp://70[.]32[.]84[.]74:8080
hxxp://72[.]47[.]248[.]48:7080
hxxp://73[.]11[.]153[.]178:8080
hxxp://74[.]207[.]230[.]187:8080
hxxp://74[.]208[.]173[.]91:8080
hxxp://74[.]208[.]45[.]104:8080
hxxp://75[.]127[.]14[.]170:8080
hxxp://75[.]139[.]38[.]211
hxxp://77[.]55[.]211[.]77:8080
hxxp://77[.]74[.]78[.]80:443
hxxp://77[.]90[.]136[.]129:8080
hxxp://78[.]188[.]170[.]128
hxxp://78[.]189[.]165[.]52:8080
hxxp://78[.]24[.]219[.]147:8080
hxxp://79[.]7[.]158[.]208
hxxp://79[.]98[.]24[.]39:8080
hxxp://80[.]211[.]32[.]88:8080
hxxp://80[.]249[.]176[.]206
hxxp://81[.]2[.]235[.]111:8080
hxxp://81[.]214[.]253[.]80:443
hxxp://82[.]196[.]15[.]205:8080
hxxp://83[.]169[.]21[.]32:7080
hxxp://87[.]106[.]136[.]232:8080
hxxp://87[.]106[.]139[.]101:8080
hxxp://87[.]106[.]231[.]60:8080
hxxp://87[.]106[.]46[.]107:8080
hxxp://89[.]32[.]150[.]160:8080
hxxp://91[.]205[.]215[.]66:443
hxxp://91[.]211[.]88[.]52:7080
hxxp://91[.]231[.]166[.]124:8080
hxxp://91[.]236[.]4[.]234:443
hxxp://91[.]83[.]93[.]103:443
hxxp://93[.]156[.]165[.]186
hxxp://93[.]51[.]50[.]171:8080
hxxp://94[.]176[.]234[.]118:443
hxxp://95[.]179[.]229[.]244:8080
hxxp://95[.]213[.]236[.]64:8080