2018-03-01 EMOTET INDICATORS

MALDOC DISTRIBUTION DOMAIN:
hXXp://begardi[.]com/Past-Due-Invoice/

MALDOC DELIVERED:
56c3c050403e1ccda89c6c7062b5a73f
b43b70c046a3840d498f82f83323e3bde1de1c04f044dc7f61f4ebd3a355636d

PAYLOAD DISTRIBUTION DOMAINS:
hXXp://www.abexport[.]com/1ZQqbk/
hXXp://try-o[.]ru/dDC9Eo/dDC9Eo/
hXXp://nbzip[.]ru/CDvxeez/
hXXp://www.irasetaranto[.]it/tymS4SC/
hXXp://test.itsdco[.]com/gPzhcDB/

PAYLOAD DELIVERED:
f02f5fdca66198de21fb510edeb81f44
da09bea087509791fbc9f42f0f94dc501a50b6100b6a13176bc404b833a3754f

C2:
hXXp://106.187.91[.]235:4143/
hXXp://45.56.65[.]180:4143/
hXXp://91.217.66[.]130:443/
hXXp://80.86.91[.]232:4143/
hXXp://54.227.38[.]29/
```


```
ADDITIONAL MALDOC DISTRIBUTION DOMAIN IDENTIFIED:
hXXp://advantagetennisacademy[.]com/Invoice-for-you

ADDITIONAL PAYLOAD DOMAINS:
hXXp://opora-company[.]ru/O5Go/
hXXp://age-edu[.]org/Rd5Y/
hXXp://pengusahacerdas[.]com/HImEbI/
hXXp://strategicsonline[.]com/Tzxhw/
hXXp://astoriasuites[.]com/H0E06a/
hXXp://www.ohne-windeln[.]de/wveWdy/

ADDITIONAL PAYLOADS OBSERVED:
b944f6cc2bd513a77a758186c7e2a1f3
f416760b2b968429768fd20dbf59f7ec06a1663ee4444cc924c54fd5d66725c1

9290e30fbfafe66d92050cd09780e1b4
e18849bfec63ead50bf2a5721191916097e054d1b7a5dd1c703b61cf37fc68ac

2684fd79a559ea41a48c937f2f4b1696
f76979497af79493b3c7d189f1e569a41fe0c9923dc2ee33ffc749b7c62ef710