2020-07-21 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

SENDERS OBSERVED
a[.]moustafa@elhazek[.]com
account@harmo[.]id
accountant2@namkatyorlapa[.]com
administracion@hotelpeninsula[.]com[.]ar
alfonsogarre@gacom[.]es
angela[.]sateles@a1solucoes[.]com[.]br
anil[.]raman@aimsgroup[.]com
anna@imperoperle[.]it
arshad[.]ali@pharmevo[.]biz
biblioteca@capecar[.]cl
brenda[.]cotzajay@quefacil[.]com[.]gt
chereyann[.]delacruz@lacto-b[.]ph
cinzia@grupponucera[.]it
citra@sungbojaya[.]co[.]id
clement@rcman[.]co[.]za
cobranca@percar[.]com[.]br
comercial@millenium-logistic[.]com
contabilidad@condosolutionscr[.]com
contabilita@tandoi[.]it
cucck@tmsholding[.]vn
d2@ajasun[.]com
dianagarles@concilig[.]com[.]br
diego[.]romanatto@cozil[.]com[.]br
donosti@danielbarcos[.]com
ecommerce@efhk[.]com[.]hk
ekhlas[.]ballouk@smartgroup[.]sy
ermes@impresamenorello[.]it
eunice@haboagencies[.]com
expedicao@clamel[.]com[.]br
facturacion2@asosa[.]com[.]mx
fnm[.]accounts@fnmpropertyservices[.]com
fo[.]secretary@grandmirage[.]com
gperez@aldlmontana[.]com
h[.]shams@ccnpp[.]org
hermosilloperisur@colchasconcord[.]com[.]mx
hfuentes@autoproductos[.]com[.]mx
hponsite[.]noida@sysnetglobal[.]com
ignacio@curtientes[.]com
igor[.]borges@brasilnovo[.]com
info@bshero[.]net
info@einkoki[.]com
info@fp-hardware[.]co[.]za
info@gulkamobilya[.]com
info@lamadridtransportes[.]com[.]ar
johnn@esjayintl[.]com
jose[.]herrera@cortolima[.]gov[.]co
lhr@standardpk[.]com
manoj@cargoplannersindia[.]com
manten-hikari@everything[.]co[.]jp
manutencao@sansei[.]com[.]br
marcusminatto@contato[.]net
morooka@sc-ko[.]jp
muhammad[.]adhitiya@sahabatinsurance[.]id
muhammad[.]faisal@synitedigital[.]com
nina@taimingco[.]com
nyi[.]nap[.]khun@mglexpress[.]com[.]mm
paul@vigorfe[.]com[.]hk
pekel44@poasbayi[.]com[.]tr
phillip@fp-hardware[.]co[.]za
planeaciones@pasteleriasanjose[.]com
producao02@syntec[.]com[.]br
purchase@versatilecorp[.]com
recursoshumanos@doerindustrial[.]com
rose[.]vendas@mcmineracao[.]com[.]br
rp@cdesignhotel[.]com[.]br
s-taketani@tsu-da[.]jp
s[.]florio@ctatende[.]it
sales3@myich[.]com[.]vn
segreteria@metacab[.]it
sgchemical@vinalon[.]vn
sitointernet@trasparenzeveneziane[.]it
sumeyyealtintop@happy[.]com[.]tr
thiago[.]oliveira@tlog[.]com[.]br
tkereselidze@gh[.]ge
tringuyen@cosianasuites[.]com
ventas@hotelcityplaza[.]com[.]ec
vtassone@centralplumbingsupply[.]com
xuyen@alexcomponent[.]com
y-saito@sumikae-palace[.]com
ysezerefe@erciyes[.]edu[.]tr

MALDOC DISTRIBUTION URLS
hxxp://0931tangfc[.]com/images/8u6n74/
hxxp://0931tangfc[.]com/images/n87wvaao-ni1ukbnpj-273558190608-mrzm7t74db/open-profile/oywpq-scdd0g4v/
hxxp://1[.]33x[.]us/wp-admin/9WJH36Q/
hxxp://111[.]cd[.]gov[.]mn/wp-admin/Documentation/hgeu40/y251426366on659uox9ydbae/
hxxp://2nong[.]vn/wp-content/open-resource/verifiable-portal/tuFX69av1TH-c7sczrHghobv/
hxxp://33x[.]us/wp-admin/personal_zone/open_profile/w92m2mpt_yy3v48t41t76/
hxxp://39[.]97[.]180[.]247/4lh/statement/0lt445/
hxxp://3fqw[.]com/oauth/W7HOV/
hxxp://409[.]cd[.]gov[.]mn/cgi-bin/browse/d1zfgyd5825891192c4utqlnyklz/
hxxp://415[.]cd[.]gov[.]mn/cgi-bin/Reporting/5d5en4f/
hxxp://421[.]cd[.]gov[.]mn/cgi-bin/public/khm90a/
hxxp://427[.]cd[.]gov[.]mn/cgi-bin/Document/
hxxp://439[.]cd[.]gov[.]mn/cgi-bin/Reporting/
hxxp://441[.]cd[.]gov[.]mn/cgi-bin/browse/pv68947385082927s46eqwn227yj497/
hxxp://54[.]76[.]19[.]197/wp-admin/82982741-yTIa2ajRcftqA-uxsa6-89qdox/external-area/0jqpnc5ro-7yt9tx0vzx/
hxxp://addahealingmusic[.]com/wp-includes/d4zkckftm2p/
hxxp://aeronchairbyhermanmiller[.]com/wp-includes/swift/jcms78418443cym8ppuwkpv3/
hxxp://aflora[.]com[.]ve/wp-admin/sites/
hxxp://aios[.]com[.]ar/wp-content/open_H7N5yKL_4symNCdbURs/corporate_portal/zftnesbxd_2ssvv/
hxxp://aiqupai[.]com/dln0/sidkz9y-xe-381638/
hxxp://annoncesplus[.]ma/wp-admin/invoice/
hxxp://api[.]shizheke[.]com/1pmudzxh/closed-672796732594-EAnFrqQ/external-profile/4483051064-chYuqw/
hxxp://api[.]xoweb[.]cn/addons/JjM/
hxxp://arsimiparauniversitar[.]gov[.]al/wp-includes/TUX8Y3CMKOMQRM/
hxxp://basedadosempresas[.]pt/respaldos/ogjslu-zkm3s18l4nd-zjQ4a-xsZR8Bd/special-area/1643958184864-DR4xAWp91/
hxxp://batyayura2015[.]had[.]su/wp-admin/open_box/corporate_954733_OYULoB6/452753159843_gdd1Q8OdCrQ5/
hxxp://beadsgem[.]com/wp-content/plugins/null/multifunctional_module/special_portal/37315784_ENsVOxfydw8kiR/
hxxp://behboard[.]ir/vu8/uxu47l6-k5-246053/
hxxp://bellemam[.]com[.]br/wp-content/LLC/m4o2pgh24894100523622ze376l4i9mz63/
hxxp://bergama[.]org[.]tr/wp-admin/9r6pi-bd-573412/
hxxp://bettiahnews[.]com/blogs/parts_service/n1g62vxjvo/
hxxp://bigmuscle-bh[.]com/wp-content/uploads/6548070111532600/dieaoe/00rh5r02379352232108immnneg38msgo812f7nf/
hxxp://brucelessons[.]com/e9ipmz/OjCwE/
hxxp://carpetcleanerinboston[.]com/wp-admin/open-module/additional-portal/1263256-T5eNwl6g/
hxxp://carspot[.]gokulnath[.]me/wp-includes/browse/jyqu789s0eqs/
hxxp://chaluasachtienphat[.]com/wp-content/uploads/parts_service/
hxxp://chitgarbar[.]com/01/closed-zone/additional-cloud/944464-DibhSAOQ7C/
hxxp://chitgarbar[.]com/01/wja7ho9-qywlv-582008/
hxxp://cnml[.]com[.]br/tmp/Document/mf1xmhhicy8/)/
hxxp://codjoo[.]ir/ma9vc/Document/x4zjdo3ws/
hxxp://comedorangelguardian[.]com/dashboardl/available-array/oW2nh8-fVNgz3a2N5NZ36-portal/4533529-z4972/
hxxp://construccionesfonseca[.]com/wp-admin/DOC/o4j3aze1/77f4329838655884314fueq47hcrseul/
hxxp://corepumps[.]easydialindia[.]com/wp-includes/Documentation/0njud3h4d/sw42215979703347xrezpmde7v/
hxxp://cpnti[.]com/wp-content/common-array/verifiable-space/ozlkdk0-543v5xu/
hxxp://crpelectric[.]com/ay1fti/multifunctional-module/close-forum/KovoR2-jIfLbLyp/
hxxp://ctconnector[.]com/wp-admin/statement/
hxxp://cyberhydro[.]site/p6c/browse/kd7gjjk/
hxxp://darkhan[.]cd[.]gov[.]mn/cgi-bin/FILE/
hxxp://davanto[.]nl/browse/j68s4tv11s/
hxxp://de9182c6421e48559953bf3f46f705a8[.]testurl[.]ws/wp-admin/payment/yioik292le/q2332802013qx9ujbwtz37dbv1c/
hxxp://dealer1[.]gokulnath[.]me/wp-includes/swift/
hxxp://delmercadito[.]com/wp-content/uploads/p5bqp90i-rug7kr-NvUdbI4ls-5tQAray/verifiable-portal/vcpswoknmu0n1el-18u98zs27/
hxxp://demo[.]yzccit[.]com/jslyzyxy/707ylpw45o1/
hxxp://dfrntco[.]com/wp-content/scjoye2_4ree14b_disk/5778895826_r5FQJe8eX2Hi_area/kq5hNvQoFb1_w2g1kc92qj/
hxxp://dimakesra[.]com/mywo6y/ACFuEfSe/
hxxp://dynomax[.]ee/wp-includes/private_disk/verifiable_zpms55j0_6ygez4ld34bjrn/vif032alo8s_t98s8w9z63/
hxxp://dz[.]martinface[.]com/uc_client/available_array/m2b5ak5gnfnqu_6gp65uv1s299_portal/gzcnvnz3by_z702s8x/
hxxp://edgologyservices[.]com/happyvocationindia[.]in/sites/1lr60pnz2sc/wq08245258i5mxy29ofst8vom/
hxxp://efis[.]top/wp-content/Documentation/4g7vwan/
hxxp://eifili[.]com/wp-content/aWKMvu/
hxxp://entechco[.]com[.]vn/cgi-bin/closed-array/close-4177495-w8S0FZlS1gVRwtb/256853-mb3HQOna2u00A/
hxxp://evisualsoft-001-site3[.]atempurl[.]com/Trends/wp-content/plugins/wp-file-manager/classes/61-vjd-574/
hxxp://ezelleproperties[.]com/wp-admin/multifunctional_711456_lTCJr/test_cloud/SFPjo6DP_s2kd0issGz/
hxxp://findrs[.]com[.]br/cgi-bin/FyWO/
hxxp://gabrielinsg-001-site1[.]htempurl[.]com/4vob4/nroq-4h-84/;/
hxxp://gasamado[.]pt/ovnz/docs/
hxxp://gmcollegeofnursingandpharmacy[.]com/wp-content/0591884186771-g4Iw1y9bZz-module/verified-cloud/d8xy-077y8/
hxxp://gokulnath[.]me/wp-includes/common_section/KhCFbA7_sJYvdjh9_forum/DDmLLBDPlYFb_d40zzr0dG/
hxxp://govn[.]com[.]tw/wp-admin/css/colors/k52bgt-zl-52515/
hxxp://hafizbhai[.]com[.]pk/wp-includes/Reporting/
hxxp://heartshapedglasses[.]ca/blogs/FILE/hwczm90/5ddzm9516820503529721ga3unzynmid9vfgeiebrv/
hxxp://hospital[.]gokulnath[.]me/wp-includes/browse/otviyq77552488rnekmhumnyt3738xnn/
hxxp://htownbars[.]com/couch_db/d1CecdE_Tsz685UA4BMrUT_resource/additional_923726953_g44F7DIoe/7c10odnlllec42l4_3tv9y6646/
hxxp://ichiba[.]in/wp-includes/public/
hxxp://iconhealth[.]in/wp-content/payment/1iyxp5y3r2v/9pr27060433012321d5s4sqbymb8h/
hxxp://idc[.]cxyw[.]net/w4sd/common-box/security-profile/0260710-2386t5tJczhr/
hxxp://ivytheme[.]com/wp-admin/tt6u-3vgvjwfkz94c-array/verifiable-b2m9dxvo9b7-r5m3jv566kv3d/683075190809-j8L7J7xRk7/
hxxp://jamiafazal[.]com[.]pk/wp-content/1z2dfead/
hxxp://joshandbrooke[.]com/wp-content/themes/OCT/e4850q236443277915fbe00mujrjj3zz2/
hxxp://joyville[.]global9[.]in/cgi-bin/attachments/iay8ntxpn/893p9p53177009853289yh2nhtgo9p5uczhuel/
hxxp://jungle-s[.]org/calendar-setup/statement/tzkra7f976666992944510ee02srjuxyc4qqew/
hxxp://keksuliki[.]online/wp-content/sd5e9d4_rxx0jmg7_ZHpdsj3_MZJurTW/4206127_BEozX69q2nlzww_space/606Ga9pJ0OU6_tbbep19M/
hxxp://kharkhorin[.]cd[.]gov[.]mn/cgi-bin/public/edduq0xdu1d/
hxxp://ksn1[.]go[.]th/web2018/includes/html2pdf/bQn/
hxxp://kynamvn[.]com/codeweb/closed-array/q8o34-ibk6079y-952560-61onwXn9zPpP/87969679967232-T92aRPddIKvlr/
hxxp://kynamvn[.]com/codeweb/personal_IINt_nFBbeofIDYDU3R/individual_portal/tKeIdf_JicKqvgJ/
hxxp://laopos[.]com/wp-content/v22fif1f-0x-407/
hxxp://lead[.]gokulnath[.]me/wp-includes/attachments/a6away8/
hxxp://leavilame[.]site/wp-admin/invoice/n0aivxno3h5o/
hxxp://legrace[.]info/m2wj4l/private-array/special-xaxld6-0js3awtw6ekf/6hggjhjnklix-77sxt/
hxxp://louisettepouliot[.]com/aeigu/balance/aq4sq0/
hxxp://lucas[.]hastalavista[.]com[.]br/wp-includes/INC/jpp0453137994273041r189xlssb70kfbnz3yi2y/
hxxp://m3[.]yunqiwp[.]com/q3r/available-disk/du17xcp-mg17-space/M4YVF6-7eM4zJLIc/
hxxp://mandal[.]cd[.]gov[.]mn/cgi-bin/LLC/
hxxp://maniactournament[.]com/uytreasdfhjkmnbv/Document/
hxxp://massagepracticetests[.]com/wp-content/uy/
hxxp://massages-yoga-paris[.]fr/administrator/private-zone/interior-1glf16lt38g22f-4p3xe2wct2byxv7/048737-vHeJ5Z/
hxxp://medint[.]io/wp-admin/multifunctional_1c1cp_myq46my71sbm/0284198117_FdmB7AqYh_j1PN2sug_Mw9mzfXW/Pw0tvxf_1a0f3jd3/
hxxp://minimerino[.]dk/wp-includes/available-array/verifiable-space/ejzc-58x317syxv/
hxxp://mnipl[.]com/wp-admin/closed_array/special_area/1orpf9ecsw_7xzt5t263/
hxxp://movie[.]cxyw[.]net/fork/protected-module/open-portal/2lkdhi3c0rv-48v4/
hxxp://mtln[.]net/s21/30340-MJCbIgSm-zone/open-196066771-HpPTai89mwSMl/i0sl2ei6-72yzvz1w244/
hxxp://mylisting[.]martinface[.]com/wp-admin/available-FUe1-mLSNIHV1ae1so/9Vjy-1RRRUlGK-profile/333515-Xqovm94aaI/
hxxp://myphamvietnam[.]net/wp-includes/g74e5554-71-095/
hxxp://nexwebsolutions[.]com/old/INC/881fjia/
hxxp://nmcllc[.]us/wp-admin/DOC/02qbd42rjk/
hxxp://nufc[.]vn/backup/balance/sb7pzpukn/
hxxp://nuglox[.]com/wp-admin/multifunctional-section/q0s4cbbkdmr-8st8wz-869034-Cioi8tEV/07884100175-YVjhsW7f7iocKk/
hxxp://offerhungama[.]in/wp-includes/swift/uzr18c21m1/
hxxp://ophospitality[.]com/settingo/open_resource/open_space/m2ztyzPFH9PA_8nwk25iM/
hxxp://orkhon[.]cd[.]gov[.]mn/cgi-bin/x42yrp3/cj970127789760433tsiazm56x3so4is/
hxxp://paycoinbrokerfx[.]com/cgi-bin/public/
hxxp://policelifeline[.]in/wp-admin/LPpQ_xullYkzZkuS_l5c5l_s2rumvkbkg/interior_2JJIN1P_E7TtPN4KixZ/30446086_kSU4jQEyjg/
hxxp://ponnoshomvar[.]com/13hmz/fevR/
hxxp://poolvasarmaye[.]com/wp-admin/Document/jj9lj20p/hctrq0869712525190780mfilhsn2mj7bjuf7cs/
hxxp://poverka-rf[.]com/assets/closed_zone/open_area/822889778646_sc2BdrmXgVX/
hxxp://pozakonu[.]ru/wp-admin/personal-rnFd-vvU2ncKPIhNczFk/corporate-area/g4Ilp-0fiumrvd29menJ/
hxxp://profitbets[.]kz/engl/payment/3vpvq17kwm3v/
hxxp://pto[.]umpwr[.]ac[.]id/wp-admin/5394488790682435/pzjlnkb839781269212732aw4xtmt7eaoyssy/
hxxp://qsms[.]mokk[.]bme[.]hu/wp-content/8el91cnn6/
hxxp://reklamatg[.]ru/wp-includes/LLC/
hxxp://ronakfence[.]ir/q0h/lm761u-9m0q-525/
hxxp://ropa-americana[.]com/ohba0/available_array/external_cloud/1244816301212_ndKC4sv7VPOju12/
hxxp://rsp-om[.]com/wp-includes/3t65zs/jvnkky455659526288kzt416bd8qqob/
hxxp://sdyppsb3[.]sch[.]id/uuzk1v/LLC/
hxxp://sevryugin-vg[.]ru/wp-includes/available_5kgtuwg1h4vic08_3xi26/verifiable_cK8VTSq25K_vgBEdMCnhO5/bE7zR4Gixwt6_9zisMyay4/
hxxp://shoppnaweb[.]com/wp-admin/docs/
hxxp://sipesv[.]org/administrator/Documentation/
hxxp://staging[.]vcsw[.]nl/css/docs/
hxxp://steelworks-students[.]com/wp-admin/e8fv4kevk/
hxxp://superfacil[.]center/wp-content/swift/w4m9v7p/v6j8s1996363895573739727a44tj656vse/
hxxp://supervisorio[.]solenevetechnologies[.]com[.]br/nb/WeGt/
hxxp://surgalt[.]cd[.]gov[.]mn/cgi-bin/esp/
hxxp://test1[.]cxyw[.]net/wp-includes/sites/8o1kuvntd/
hxxp://thelondonwolf[.]com/qicq6kz/personal_box/security_warehouse/jch_8y5zt778z46/
hxxp://third[.]parvezkhan[.]xyz/asset/uAeUmEY68-WtMXdTu-sector/security-area/qN70UK2-i8ef9M4uN/
hxxp://thithpt[.]edu[.]vn/wp-content/uploads/OCT/
hxxp://timelyrain[.]top/wp-includes/Overview/o8vyew6pg/
hxxp://tripok[.]ir/8gf6/3743/
hxxp://ukcyberhost[.]cf/billing/bb-data/cache/attachments/m1tqm4m/8bx9zj433759086689009mvvdanh4khd86i5qkx/
hxxp://umeedupvanfoundation[.]com/blogs/JB5HY27RGXBM90/
hxxp://universalbiz[.]us/aro8fxai8/Reporting/gfyjw0duwqrp/reoj077462164109mujqqqbcb76/
hxxp://valarchihomes[.]com/wp-content/kG/
hxxp://valarchihomes[.]qmarkonline[.]com/wp-content/kG/
hxxp://vanillapodcookery[.]co[.]uk/wp-content/mhNSu/
hxxp://vaobong66[.]com/cgi-bin/attachments/cy0nzo5gqr/
hxxp://vestasport[.]com/__MACOSX/CZ/
hxxp://video[.]vipservicegas[.]com/wp-admin/OCT/a9obf4288923813980388400i6jwr2k2x7v81zsr/
hxxp://vip-exness[.]com/wp-includes/OCT/x8wo49nv/
hxxp://wapt[.]churchinaccra[.]org/lk3ztzu/personal-t23x5t-pyd6u8/4u2y9RqvSa-HgO6zbbX5Jd-profile/FV8CKxHspcpj-KGhx6q2pciHtqa/
hxxp://we4-events[.]com/zn8z/innma4hupica/
hxxp://winningstocktrades[.]com/news-all-1/balance/ejno5jpev/
hxxp://www[.]69xjwk[.]com/wp-includes/available_disk/interior_forum/290390668_EXsy2GntHOC8joUg/
hxxp://www[.]airbornoutlet[.]com/9gm/oi3ex6wrzhz/ca8054655vbk39976q436pire1/
hxxp://www[.]cliplus[.]cn/keys/open_box/external_HXGp75_L7PZJNaO0/6911549_gMzCc1R/
hxxp://www[.]comedorangelguardian[.]com/dashboardl/available-array/oW2nh8-fVNgz3a2N5NZ36-portal/4533529-z4972/
hxxp://www[.]confiar[.]cl/wp-admin/DOC/ao5luw/x1605200yfh3h6etrq25sxas/
hxxp://www[.]dentistenice[.]fr/wp-content/available-h8c0mi-ohqxnm8d2z/guarded-0719135-L6rniU3Noo/sfkd76hr5exyog-8v737/
hxxp://www[.]diario7lagos[.]com[.]ar/wp-content/2uvor9_otm9p0f_disk/open_forum/xctqfhnebvcku_u77005w85sy46/
hxxp://www[.]evhanimim[.]com/wp-admin/12j-lmb8-501/
hxxp://www[.]healthmantri[.]com/wp-admin/Scan/7pkt2q3444570340475ebqqht7f14k9r5m17yx/
hxxp://www[.]mtu[.]monster/agx/Overview/zb868391483633223qmnt7srrz9ounadx/
hxxp://www[.]saltwaterpedalpubs[.]com/wp-includes/OY5BZSBVME/imgepcyswdp/
hxxp://www[.]selendemir[.]com/zwro/352362-be3oAUKvg1e8owI-dxoDd-jm5CprT/security-4425926-L147hz4rIHo4mQ/197716-WJxrSqNOj5jaapeL/
hxxp://www[.]wateridge[.]la/images/Overview/jzwuf82av1h/
hxxp://www[.]willingwater[.]com/wp-admin/y068zaq-c0h-635977/
hxxp://www[.]xbin[.]top/0oodenz/closed-sector/C3hi8m-F7vpUJNI5adN1-cloud/0i5vtnkfi5hvi-2tsw6539xw3368/
hxxp://www[.]zwajok[.]com/cgi-bin/swift/
hxxp://xuanwoyc[.]com/gg/Documentation/ouxoj1/
hxxp://yebni[.]net/gitlab/balance/y5s6eg5oo/
hxxp://youthindiaassociation[.]com/blogs/SkUHlcyQ/
hxxp://z99179m5[.]beget[.]tech/wp-content/paclm/s5edrm/
hxxp://zahran-eg[.]com/wp-content/mq7683/
hxxps://25minutewebsite[.]com/wp-admin/attachments/
hxxps://41-tee[.]com/stagingtest/closed-uETvL8dn-8N7tNAyCQRJ639x/additional-LEAIrx-D8XDmihNTQHPP/l0cLifJA5a-n5gLKpe1/
hxxps://abaksol[.]com/wp-includes/u3jxtj/
hxxps://abuhamzapetstore1[.]sizzlingmart[.]com/wp-content/esp/3aeybid2/tyydc7f8275860980n19enoj1vy6b0/
hxxps://ahbro[.]com/wp-content/browse/omxl046951300lyxdvye9ksa2j/
hxxps://allsound[.]fr/wp-content/uploads/statement/vhxjig/
hxxps://amirthafoundation[.]com/wp-admin/Documentation/tyy9rv/
hxxps://andreiahowell[.]com/wp-includes/docs/ue13jr490k/
hxxps://bawaslu[.]wonosobokab[.]go[.]id/wp-content/Scan/7h623096050tn6ok7lacgmbre/
hxxps://beeba[.]io/1uc23htxv/public/bge1pxu6p/
hxxps://bestgreaty[.]com/wp-content/plugins/woo-paypalplus/multifunctional_bty9_b15wac24q/verified_area/4247753484072_Ap6PVfLSyGn/
hxxps://biyaofushi[.]com/xkf1bbx/open_module/security_a8n_jdy/1764518343_6WZkUj0kZ/
hxxps://carbonazin[.]com/0a8yw5ng4/wUKA/
hxxps://carbonazin[.]com:443/0a8yw5ng4/wUKA/
hxxps://cdfairplayusa[.]com/wp-includes/Reporting/
hxxps://chisunstone[.]com/wp-content/FILE/y2yp6uoy/
hxxps://chivangbavi[.]com/ip5soow/8290162652443004/
hxxps://codeinsight[.]tech/mguvod3/Overview/r60d8vnbm5b/
hxxps://countrysidereports[.]co[.]ug/wp-content/fByNK/
hxxps://credid[.]io/wp-admin/j2041-0ccfs-673/
hxxps://demo[.]goctoeic[.]edu[.]vn/wp-admin/Mu/
hxxps://demo[.]superrishi[.]com/i1fn/INC/kh5986983520409952usgz05gy5byifwg/
hxxps://directgoo[.]com/xqda/z68i34/
hxxps://discounts[.]pec[.]org[.]pk/cgi-bin/balance/mu85978665125oqcqd9vewra0veenf/
hxxps://fartakadd[.]com/wp-admin/scin42776562857qaqe1qcuvqa4q/
hxxps://fartakadd[.]com:443/wp-admin/scin42776562857qaqe1qcuvqa4q/
hxxps://foto-leitges[.]de/catalogmap/paclm/
hxxps://fxzonebd[.]com/wp-includes/available-w91-8kwm1d1i4bbpscu/special-profile/VTMZs77-ILKNit0L0/
hxxps://geography-atlas[.]ga/wp-admin/xgqfth/
hxxps://govastore[.]pe/cgi-bin/KCAr/
hxxps://govn[.]com[.]tw/wp-admin/css/colors/k52bgt-zl-52515/
hxxps://h5ym[.]com/wp-admin/public/r4023302622s4rmnti95pu/
hxxps://hautenuriche[.]com/pressthiso/99c5xj8r-ude-55/
hxxps://helpdallas[.]org/upgrade/common_disk/special_216_dh4b332wo61/wj9vvclp8alpfqr_493637y112/
hxxps://huangqw[.]club/jl86l/public/
hxxps://imaginationstudio[.]me/ytg/qm307tstxsewz-upxylalu6h9-resource/special-portal/0x8zq7jw8cacye1-usz295z0270w/
hxxps://kashifbadshah[.]com/wp-admin/Reporting/
hxxps://ledgercover[.]com/wp-admin/parts_service/vo6bv2oh4/
hxxps://lifechangerministry[.]worthyofpraise[.]org/4izuyk/jHdwlCHB/
hxxps://lirugo[.]com/wp-admin/js/widgets/invoice/kv4rd2n/
hxxps://lovecryst[.]com/wp-content/iwdhgq7z-qpm-121212/
hxxps://lumabu[.]com/dialogue/swift/ottk0mvbc/
hxxps://lypro[.]top/wp-content/statement/i59vax1kma/6hrn5151297591frnzezffdxy09id2/
hxxps://maalwaal[.]com/_errorpages/ry_oap1tmfzkqmd6_sector/close_profile/q8k58i2dk461x_ux8s4w0w2/
hxxps://medicon[.]vn/ads/11x5vva-3a7-8884/
hxxps://medicon[.]vn/ads/11x5vva-3a7-8884/%20()/
hxxps://mengshuzhai[.]com/wp-includes/docs/nr67byp417025406692rjpwq8egtmv63ypw40cpr98/
hxxps://metalmecanicajc[.]com/wp-includes/bHSzwe/
hxxps://metalmecanicajc[.]com:443/wp-includes/bHSzwe/
hxxps://mirolin[.]vn/wp-includes/available_array/389790472231_iY7BR0Fcs4T5q_MIUw1n2Yk_uXHyFIlHv5egD/511474858_d3EIGR/
hxxps://moitruongtunglam[.]com/wp-admin/fxfcjjra-lm-33846/
hxxps://moxlogin[.]com/gdfonts/open_disk/individual_area/d82lH2JQCh_3KnkK3r1N6Ikv/
hxxps://musei[.]basilicata[.]beniculturali[.]it/cgi-bin/available-box/interior-g1hyz8vx-w4r3kid/JrzRJ-H7mauejoGh01/
hxxps://mystela[.]com/wp-admin/js/widgets/Documentation/
hxxps://n95mask[.]tech/o/bhvpM/
hxxps://nundi[.]com/wp-content/esp/9bx092za39i/nkpehc21025282867918678tadxpzn31w2onfmgm/
hxxps://pharma-israel[.]org[.]il/wp-content/paclm/
hxxps://pramodgroup[.]com/wp-content/INC/br0zi8605252789043597r8d7025jbtefql842lqb/
hxxps://protect[.]mimecast-offshore[.]com/s/LOqwCG5rvPcJNDXqc76aPn?domain=ronakfence[.]ir/
hxxps://protect[.]mimecast-offshore[.]com/s/RD0zCJqxyVf8W6o3iGppXq?domain=ronakfence[.]ir/
hxxps://readandcobooks[.]co[.]uk/wp-content/k4eLF-7XMHSfkhdfxpJ-array/security-warehouse/wa08-90w0u5s/
hxxps://sanjidatithi[.]com/wp-content/open-disk/close-cloud/ElBPVL4bHsxR-Mv8a1r6wapKmj/
hxxps://scyzm[.]net/wp-content/Reporting/xthm86751139096s1l2u5upxnc0/
hxxps://seis[.]me/3x_hashes/DOC/4udzk3/
hxxps://serviciosgeneralesafinity[.]com/wp-includes/common-disk/verified-portal/oy6ezku8x4n-1w25747sy/
hxxps://shai-albums[.]com/wp-content/paclm/7axo7h001068ltpaazvpiot33djhu2q8k/
hxxps://skyne[.]loogit[.]com[.]br/wp-admin/Pbjr/
hxxps://solarpower[.]lu/neuefotos/protected_JaUQF7_9xKIM06KtUS/individual_lkqiv18s8mqymq3_ebdab/0535700503597_nz6SMLrS4jCv/
hxxps://startup[.]style/wp-includes/sodium_compat/src/PHP52/INC/
hxxps://stelaly[.]com/wp-admin/js/widgets/M1MES0D/r2gxcca/
hxxps://suaydee[.]com/websiteguide/attachments/
hxxps://tattootrader[.]ink/wp-nontent/KyLWlYcJg/
hxxps://test[.]gcosoftware[.]vn/saomai/closed_qh0kkc08zf8quv_ijdrmme6z2yd9p7/close_area/83qedg1_9587tuz71v1/
hxxps://teste[.]pintrip[.]app/wp-admin/eTrac/
hxxps://therapeuticconsultations[.]ca/otn5qp/aqIfuiDq/
hxxps://tianchanzi[.]top/wp-includes/fllzff-mreqo-22637/
hxxps://totalgoo[.]com/396/multifunctional-section/external-warehouse/pmxClw-Mm3s3k2Id/
hxxps://u-firm[.]com/tpbnh/ajfx9t4a2gz/
hxxps://u3373545[.]ct[.]sendgrid[.]net/ls/click?upn=bVcRYP1LqML-2FrucV3haw2ZcY9Xc4jokOwwfoH-2B2bV6ng0tJ-2F15apQ7x1IyS-2FFCkJmfhDsd7ExUtJBbgwsipSUg-3D-3DBsfs_7jr05Bs9CFIjRmKLu606Uo-2B-2FjAShlGZ-2BswiUOSpcRpiurFitWh53GWDomnQyXUs3AWFha3cAOJTCs-2BFjQ4PW06GA0i3OsY5J0DOdRjgOb2tE7mHYTKoE9m5VRBztl4ewGO7dw9muWtBrcm8WDcTDCDeDKoEpuIDtp6yYgqBeuxp5o4R2Hb53rzkeH4w3-2FrBmQr3aAI5Gy2gGK4khH9ulmTzy6VgHlRAH-2F51JrBr5uyI-3D/
hxxps://uhc[.]edu[.]mx/titulacion/docs/6h7b3126728799294bz3js3c3th4ce/
hxxps://vangoh[.]com[.]mx/wp-content/uploads/2020/INC/
hxxps://vibb[.]no/8jgftb/Jauh/
hxxps://we4-events[.]com/zn8z/innma4hupica/
hxxps://wilsonvietnam[.]com/gallery/dWyfNb/
hxxps://winningstocktrades[.]com/news-all-1/balance/ejno5jpev/
hxxps://womart[.]in/wp-content/5okkdkkl0nqd1ps_dbwnkta_module/guarded_5lro22myi_f2fohakbv9q/9941389960_cGTkySSbXA/
hxxps://wp-stage[.]showheroes[.]com/wp-content/available_section/open_219546852_PPyteY3/233988114199_gooJxWoc7mkA6i/
hxxps://www[.]51gua[.]vip/css/DOC/
hxxps://www[.]7stripe[.]com[.]pk/link/esp/
hxxps://www[.]actioncatapp[.]com/vendor/google/paclm/sgw1hr/
hxxps://www[.]aibd[.]sn/wp-content/uploads/2020/OCT/
hxxps://www[.]allan-it[.]com/wp-admin/sites/
hxxps://www[.]chisunstone[.]com/wp-content/FILE/y2yp6uoy/
hxxps://www[.]hnlyx[.]top/wp-content/Scan/dlyc9ke/
hxxps://www[.]idacalifornia[.]org/wp-content/imk_storage/s7-u4-326595/
hxxps://www[.]jygasoft[.]com/wp-admin/private_resource/verifiable_area/946338247_DemByVe0X/
hxxps://www[.]nurmakina[.]net/wp-content/attachments/cu6z88224287408ygn7dccp0b/
hxxps://www[.]parvatisoftware[.]in/wp-admin/jeld-jx2-944262/
hxxps://www[.]rainmakeradvisor[.]com/wp-admin/common_resource/close_portal/w93kx81dxc_6tt2vu3syx/
hxxps://www[.]shouku[.]in/wp-content/docs/0wl0em/
hxxps://www[.]sinosafety[.]com/wp-includes/I2ZKC54QPK/o7zovr/
hxxps://www[.]stursulaschool[.]co[.]in/wp-content/31001168/b3z8q9yt/p25663221791128990se8snnuqul1y1tj/
hxxps://www[.]sushigarden[.]it/wp-content/LLC/rqvp8vyiptb/
hxxps://www[.]trueskills[.]in/sitetarget/esp/mt11qu152534977fxwkhzbbw/
hxxps://www[.]un-news[.]kz/wp-includes/private_bt1qm0ei_cv4h6x/verified_qexvennaxhzc_zd7568y/pauit_yy71zu7/
hxxps://www[.]winglux[.]com/wp-content/uploads/Document/
hxxps://www[.]xtecsoft[.]com/login/DOC/
hxxps://www[.]xtecsoft[.]com/login/Document/jdkx5op35688369fx8mqpa1k6/
hxxps://www[.]xuezha[.]cn/bznn/parts_service/qlo11xhzzem/ci16qfd80923279163okuaxmvye/
hxxps://xtecsoft[.]com/login/DOC/
hxxps://zowersaude[.]com/cxwq/invoice/het99o/k0150173905904anmeuqwjccn3/

WORD DOCUMENT FILE HASHES
0260e555f8d2b9961e3bb57a1235b6e2
806ad40048688258cb40cfec17af318c
c88982542acb7e3a401501db67d3888a
e102fec6961a54c753e1c0e1107419cf
e168d1c6752d9ce3f87fb0f0befe1df2
f8aa75491d87552f19fc6e3e088de305

PDF FILE HASHES
6e57c95692664138910ee3bd501cf194

EMOTET PAYLOAD URLs
hxxp://405[.]cd[.]gov[.]mn/cgi-bin/KbnY/
hxxp://acetnsk[.]ru/general/Ve/
hxxp://aromaticfragrances[.]com/020720/m2dkl050/
hxxp://aryaenterprisesrbl[.]com/wp-admin/uJ727532/
hxxp://badamboom[.]com/zxwxo/qkm/
hxxp://blog[.]tujanena[.]com/ariu/C2LSRbc8/
hxxp://bnemati[.]ir/8iujk/b0/
hxxp://bsc5000[.]com/aspnet_client/bw/
hxxp://chestersvideobar[.]com/blogs/w0x0lEZ/
hxxp://dainiksomoy24[.]com/be53np0/IlLy/
hxxp://departure[.]world/wp-content/V4GFFNihI/
hxxp://drsoli[.]com/k1vjzk/XtSsbRPzyI/
hxxp://duoclieu247[.]com/wp-content/34/
hxxp://emarclofitnessacademy[.]com/xlnwk/fdJI32622/
hxxp://factorialk[.]pp[.]ua/wp-admin/gGQxSh/
hxxp://fesghelland[.]com/wp-admin/8rSz788/
hxxp://fivestarcleanerstx[.]com/h/procurement/9uvmim/
hxxp://fly200[.]com/wp-admin/oe1q7cr/
hxxp://gundogmusgazetesi[.]com/wp-includes/SQ/
hxxp://hada[.]com[.]vn/wp-admin/m2s/
hxxp://khovd[.]cd[.]gov[.]mn/cgi-bin/G/
hxxp://kohsorkh-sarzamin-man[.]ir/wkyhhb/d2djxo/
hxxp://metanor[.]gr/docs/q75cvd/
hxxp://namedforyou[.]ianselby[.]com/ivai/ZtC/
hxxp://paula[.]strategicwebmarketingmd[.]com/wp-admin/rdi3505/
hxxp://phamthuan[.]com/wp-admin/h/
hxxp://rmacadetstore[.]com/cwu/l6y/
hxxp://shubhinfoways[.]com/p/0IJ259233/
hxxp://songbadtv[.]com/wp-includes/XQrT027149/
hxxp://stunnersecurity[.]com/wp-includes/PTyoVOEIY/
hxxp://theprizeguys[.]uk/test/1iu9sk/
hxxp://unagestion[.]com/components/w5dim/
hxxp://wiki-lspd[.]xyz/cgi-bin/bi3ygxO/
hxxp://www[.]coworkanytime[.]com/wp-content/uploads/DZIizOT/
hxxp://www[.]cppwolf[.]cn/team/7oRM8Z/
hxxp://www[.]oakeno[.]com/wp-admin/tvyPO/
hxxp://www[.]suprshoes[.]com/wp-includes/qf1/
hxxp://www[.]wiremeshseller[.]com/p/R3s08i7732871/
hxxp://xiaodaji[.]com/wp-includes/ID3/DeQFPrxR/
hxxp://zeing-kor[.]com/8lget8b/cQ44/
hxxps://ashok-poudel[.]com[.]np/wp-admin/MdO/
hxxps://blog[.]dengjieyuan[.]com/wp-includes/tCTVE/
hxxps://bucksngems[.]com/bucksn0/r96270/
hxxps://chatflair[.]com/generall/PF0d/
hxxps://chiangmainightsafari[.]com/wp-admin/lrPiggcI/
hxxps://coolsculptingbangkok[.]clinic/filterl/s/
hxxps://dylla-bautraeger[.]de/wp-includes/SMo3b9v4xi23889/
hxxps://enco-software[.]net/wp-content/Stf9930708/
hxxps://faq[.]lptrend[.]com/dbdmni/TPrr4sc6vcj597571/
hxxps://fivestarcleanerstx[.]com/h/procurement/9uvmim/
hxxps://hilifewomen[.]com/ewr1j0/edU9EPP/
hxxps://infphukien[.]net/wp-content/nyhjN892773/
hxxps://jiohosting[.]xyz/cgi-bin/J8W6hn25692/
hxxps://kavyarang[.]com/wp-admin/ik47a6f/
hxxps://kipliani[.]com/sys-cache/w84tjs1/
hxxps://lwzmy[.]com/logreport/LNGwoQlM/
hxxps://macx[.]work/wp-includes/doWAnod252/
hxxps://malaysia[.]hadatha[.]net/cgi-bin/3pT0462/
hxxps://modernchina[.]org/rb/dz9mY/
hxxps://oraripersonale[.]metodoinforma[.]it/public/x3t/
hxxps://petskingdom[.]in/wp-content/APf/
hxxps://planet7vip[.]com/czy/hR8MMWwRkY/
hxxps://protocoloevent[.]com/wp-includes/ch8/
hxxps://rampietstudio[.]co[.]za/wp-admin/hTUjFEYQY/
hxxps://rmacadetstore[.]com/cwu/l6y/
hxxps://schoolna[.]education/wp-admin/zxad67/
hxxps://sigmanled[.]com/9ij4nd/q5n3yt/
hxxps://soicaumb[.]top/wp-admin/YbCzkEw/
hxxps://ssfz[.]cc/wp-content/qOWryJ/
hxxps://teachtoachieve[.]com[.]ng/wp-content/bse6jwy66569462/
hxxps://techyhint[.]com/wp-admin/s/
hxxps://thelibrarysamui[.]com/wp-content/themes/stockholm/t9/
hxxps://themilandpalace[.]com/wp-admin/rO0Hya4srsd665/
hxxps://via0[.]com/wp-admin/js/grZw/
hxxps://wellnessbeautyhub[.]com/wp-admin/ntQ549/
hxxps://www[.]4kbutsho[.]xyz/wp-admin/JuMrBKIrC/
hxxps://www[.]catalystitsolution[.]com/1hbgb/IDU4954/
hxxps://www[.]kerenport[.]co[.]il/wp-content/OwVbK/
hxxps://www[.]maizi[.]site/wp-admin/koUdVjCTw/
hxxps://www[.]smninewschannel[.]com/drum/noc/
hxxps://www[.]thelibrarysamui[.]com/wp-content/themes/stockholm/t9/
hxxps://xavierlin[.]com/wp-includes/ojyqm/