Info from malspam pushing Emotet on 2018-02-21

Info from malspam pushing Emotet on 2018-02-21

EXAMPLE OF DOWNLOADED WORD DOCUMENT FROM EMAIL LINK:

SHA256 hash: dfd70395a33cb32bd9505736e5063bf81fc714470c811c7d25d97fb16d34a16c
File size: 169,472 bytes
File name: Tracking-009356584-LFY-HDSPQ.doc

EXAMPLE OF FOLLOW-UP EMOTET BINARY FROM WORD MACRO:

SHA256 hash: 64b55f7724d69e0e5240d0b892fc8f427b1951909160821d890860b9502c0184
File size: 122,	880 bytes
File locations: C:\Users\[username]\AppData\Local\Microsoft\Windows\cryptman.exe

URLS FROM EMAILS:

2mluxury.com/Past-Due-Invoices/
365mantenimientos.com/Important-Please-Read/
50school.ru/Sales-Invoice/
adc-managementsolutions.com/Invoices-attached/
advokat-khv.ru/Invoice-for-you/
aibolit32.ru/Scan/
alferezltda.com/Invoice-8728284-February/
alfin.mx/Invoice-receipt/
alivesupplementsolutions.com/Past-Due-Invoices/
allonzoochamp.com/Outstanding-Invoices/
alsparis.com/Dokumente-vom-Notar/
alwafaamedical.com/Overdue-payment/
amaionline.com.br/Invoice/
amvic.ru/UPS-View/Feb-20-18-05-00-13/
andbrittain.com/Invoice-Number-474491/
andrew-shoes.com/5-Past-Due-Invoices/
angkorcarrental.com/ACH-form/
anka27.ru/Invoices-attached/
anrogajugueteria.com/Outstanding-Invoices/
antarcom.ru/Service-Invoice/
anthonybrooksplumbing.com/Invoice/
aquariumaccessories.store/UPS/Feb-20-18-06-44-55/
ardri-lubrication.com/Question/
arktor.net/Sales-Invoice/
armastek45.ru/Past-Due-Invoices/
armatura12-spb.ru/Tracking-Number-0X36380244708393/Feb-20-18-07-09-36/
arovana-kovka.ru/Invoice-Corrections-for-29/78/
asabenin.org/Rechnungs-Details/
ascentautofinance.com/Past-Due-Invoices/
atp-skopin.ru/Dokumente-vom-Notar/
audit-eco.com/Information/
auto-ruli.ru/UPS-US/Feb-20-18-07-37-48/
avangard-mt.ru/Rechnung-Nr-13996/
aventpro.ru/Invoice-61666622-February/
avtoexpertiza12.ru/Document-needed/
awitoo.ru/Outstanding-Invoices/
axelcom.ru/ACH-form/
axm-auto.ru/Rechnung-Nr-33225/
bagc.co.uk/Invoice-Corrections-for-1576745/
bainwealthmanagement.com/Open-invoices/
balfesta.ru/Sales-Invoice/
balt-way.ru/Service-Invoice/
best-vitamin.ru/Open-Past-Due-Orders/
besterstromvergleich.net/Invoice-45462-February/
bezviz-ukraine.pp.ua/UPS-View/Feb-20-18-11-33-50/
biznesplan26.ru/Invoice/
biznessmebeli.ru/Informationen/
black-mount.com/UPS-Ship-Notification/Feb-20-18-08-17-33/
bloggaunho.com/Invoice-receipt/
bobmau.be/Service-Invoice/
boringhacks.com/ACH-form/
bosforliftamortisor.com/Sales-Invoice/
bttsal.com/Tracking-Number-7KPJ47410721494513/Feb-20-18-08-56-07/
bullita.net/UPS-Quantum-View/Feb-20-18-06-20-25/
camaspersonaltrainer.com/UPS-Ship-Notification/Feb-20-18-07-05-08/
cambodialogistics.com/Informationen/
candicedarbois.com/Invoice-04421533-February/
cartaodevisitar2b.com.br/UPS-Quantum-View/Feb-21-18-06-24-12/
casablancaband.pl/Invoice/
caspianpart.com/Important-Please-Read/
catalogcenter-dv.ru/Invoices-Overdue/
cense.dk/Dokumente/
cipovenaramky.sk/Invoices-Overdue/
club-banana.ru/2-Past-Due-Invoices/
cocktaildebeaute.com/Important-Please-Read/
dagestan-travel.ru/Past-Due-Invoices/
daocoxachilangnam.org.vn/SR7M87FSMMC20ZEU/LLC/
dental4u.ru/Rechnung/
desiyamakkalsakthikatchi.com/Service-Invoice/
diadal.ru/Paid-Invoices/
discoverykh.com/UPS-View/Feb-20-18-10-46-45/
drez2kill.com/Purchases-2018/
easyearningzone.com/Invoices-attached/
ekavi-apartments.com/Invoice/
elbview.com/UPS-View/Feb-21-18-12-34-28/
electonik.es/664-24-369427-109-664-24-369427-810/
elite-master.org.ua/ACH-form/
equilibriumpage.org/Invoice-receipt/
eravlad.ru/Invoice-Corrections-for-11/45/
eserwis.com/Document-needed/
exercisepersonaltraining.com/UPS-View/Feb-20-18-11-11-22/
expofuneraria.com.mx/UPS.com/Feb-20-18-05-18-46/
ezidri-master.com/UPS-View/Feb-20-18-06-33-18/
festival-troubadoursartroman.fr/Rechnungs-Details/
fincasescarritxo.com/Outstanding-Invoices/
fireflybrigade.org/Invoice-9683672-February/
first-company.org.ua/8-Past-Due-Invoices/
frokostliv.dk/Past-Due-Invoices/
funvic.org.br/Invoices-Overdue/
generaciondeactivos.com/UPS-Ship-Notification/Feb-21-18-05-28-57/
gimjedlicze.cba.pl/Invoice/
graindeseletgourmandise.com/Important-Please-Read/
groob-dohmen.de/Important-Please-Read/
happy-idea.ru/Rechnung-Nr-90979/
hatosantana.com/wp-content/Document-needed/
huagp.com/UPS/Feb-20-18-08-32-09/
incars-prestige.eu/Sales-Invoice/
intelomega.com/Invoice-7591325/
italyterme.ru/UPS-Express-Domestic/Feb-21-18-12-51-25/
jbtracking.joombooking.com/Past-Due-Invoices/
jochmann-bad.de/Question/
k-iss.de/ACH-form/
kamizelki.czest.pl/UPS/Feb-20-18-09-08-12/
kasjopeja.pl/21523/
kcg-inc.net/UPS-Express-Domestic/Feb-21-18-08-32-42/
lachowicz-service.pl/9-Past-Due-Invoices/
lasallevaldemorillo.es/Invoice/
leesarrasin.com/567-27-727323-338-567-27-727323-159/
letiquette.me/UPS.com/Feb-20-18-10-53-54/
libert-band.pl/Past-Due-Invoices/
libreriasur.com/Important-Please-Read/
loaizacomunicaciones.com/Open-Past-Due-Orders/
loaizaconstrucciones.com/Sales-Invoice/
mada-mirendra-tours.com/Invoice-for-you/
madiston.com/Paid-Invoices/
makesensepoker.com/020-46-835755-660-020-46-835755-843/
maldivtour.ru/Invoice-Corrections-for-13/89/
massimospinosa.com/Outstanding-Invoices/
maurerbruno.de/Document-needed/
mega975.com.ar/Paid-Invoice/
moj-ogrodzieniec.pl/Service-Invoice/
movieco.de/UPS-Express-Domestic/Feb-21-18-07-24-12/
mpgknml.pl/UPS.com/Feb-20-18-07-24-38/
new.asticom.net/Invoice-Number-016586/
newmarkountryklub.com/libraries/UPS/Feb-21-18-04-50-02/
newmosque.co.uk/Open-Past-Due-Orders/
noyanfamily.com/Invoice-0654772-February/
numaipartners.com/Invoices-Overdue/
old.elbic.ru/Information/
omoshirox.com/Invoices-attached/
pacosi.com/Invoice/
par8.ch/211-29-008284-556-211-29-008284-380/
paskibasenowe.pl/ACH-form/
percussionlights.com/UPS-Quantum-View/Feb-21-18-05-52-59/
personaltrainercamas.com/UPS-Express-Domestic/Feb-21-18-12-42-55/
personaltrainercamaswa.com/UPS-Ship-Notification/Feb-20-18-09-31-42/
personaltrainingvancouverwa.com/Outstanding-Invoices/
personaltrainingvancouverwashington.com/8-Past-Due-Invoices/
pfarreiengemeinschaft-gillenfeld.de/Sales-Invoice/
prime-masters.org.ua/Rechnungs-Details/
proyectosalji.com/Paid-Invoices/
pzhgp.org/Paid-Invoices/
rdiglobal.co/Invoices-Overdue/
ristateconstableservice.com/Paid-Invoice-Credit-Card-Receipt/
roba.com.pl/Paid-Invoice-Credit-Card-Receipt/
rocknrollmouse.ru/Invoice/
rosaimpex.cz/UPS/Feb-21-18-07-59-13/
sawadeepremium.com/Invoices-Overdue/
sc-wolfartsweier.de/Invoices-Overdue/
shopfragrance.club/UPS/Feb-20-18-10-05-06/
shopnwin.com/Invoice-8675541/
skydroneprojects.be/Invoice/
smetaz.ru/Question/
specrent52.ru/UPS-US/Feb-21-18-07-36-13/
specrent62.ru/UPS-View/Feb-21-18-04-21-10/
ssnn.co.uk/UPS.com/Feb-21-18-05-40-30/
stall-door.ru/6-Past-Due-Invoices/
svitmebliv.cn.ua/Rechnung-Nr-20765/
swehelp.nu/Invoice-receipt/
t-kristall.ru/Invoices-Overdue/
tc06.de/Question/
tdgo.ru/UPS-US/Feb-21-18-06-06-46/
tennis-kharkov.com/UPS-Ship-Notification/Feb-20-18-05-03-33/
terceirizavarejo.com.br/Document-needed/
terryfund.org/Service-Invoice/
test.alojamentouniversitario.com/ACH-form/
thebrassstargroup.com/Invoice-for-you/
thelimblab.com/Open-Past-Due-Orders/
thepaddocks.net/Gift-Card/Invoice/
torgdv.ru/Invoice-3913735-February/
trendy.tychy.pl/Tracking-Number-7OTJ11080948947256/Feb-21-18-05-00-06/
tripeakconstruction.com/Invoice-for-you/
tsvquellenhaupt.de/Invoice-receipt/
tuf.su/Invoices-Overdue/
tularent.com/cli/Dokumente/
u42408.netangels.ru/Sales-Invoice/
vancouverwashingtonpersonaltraining.com/Invoice-9052685/
wallpanels.astam.ro/ACH-form/
whiteboardtraining.nl/Information/
worldcabincrew.jp/Past-Due-Invoices/
www.2buy2.com/Rechnung-Nr-00409/
www.2mgsistemi.it/Invoices-Overdue/
www.7sensi.com/Important-Please-Read/
www.a12lab.com/Past-Due-Invoices/
www.academiademusicadaramada.com/UPS-Ship-Notification/Feb-20-18-10-11-48/
www.academysingers.at/Question/
www.accademiadeltennis.it/images/Question/
www.addco.it/Important-Please-Read/
www.advs.it/Open-invoices/
www.afffresco.com/Invoice-Corrections-for-96/77/
www.agenzianonvedolora.it/Document-needed/
www.agief.it/UPS.com/Feb-20-18-09-01-07/
www.agroquality.it/Invoice-Number-090367/
www.aimroma.com/Question/
www.alazzurra.org/Invoices-Overdue/
www.albero-verde.it/Important-Please-Read/
www.alessandroghiara.com/UPS-View/Feb-21-18-04-21-10/
www.alessiodimodica.com/Document-needed/
www.ambienteinnovazione.com/Invoices-Overdue/
www.antiquegalleriefacchini.com/Invoice-9596462-February/
www.appartamentiflora.com/Past-Due-Invoices/
www.aprirecallcenter.it/Invoice-for-you/
www.arcadipace.org/Important-Please-Read/
www.arcosrl.info/UPS/Feb-21-18-04-47-56/
www.arde.it/23274/
www.ardri-lubrication.com/Question/
www.arredarefacile.com/Invoice-for-you/
www.arsas.org/UPS.com/Feb-20-18-06-05-56/
www.arteinvisibile.com/Invoices-Overdue/
www.artigianamodelli.com/UPS/Feb-20-18-11-05-27/
www.as-elettronica.com/UPS-Express-Domestic/Feb-21-18-07-46-50/
www.asfodelomatera.com/2-Past-Due-Invoices/
www.atp-skopin.ru/Dokumente-vom-Notar/
www.autoinforma.it/Tracking-Number-5QT47736854617707/Feb-21-18-12-57-38/
www.baby-fine.com/Important-Please-Read/
www.baby-liberty.ru/09028/
www.beautiful-online.com/Invoice-for-you/
www.bebpalermo.com/Dokumente-vom-Notar/
www.beiramarhotel.com/UPS-View/Feb-20-18-06-16-58/
www.bfdancestudio.it/UPS-View/Feb-21-18-01-38-51/
www.bioecommerce.bio/Outstanding-Invoices/
www.bioenergiafrosinone.it/Tracking-Number-1NJD51048461087336/Feb-20-18-11-42-16/
www.cense.dk/Dokumente/
www.cipovenaramky.sk/Invoices-Overdue/
www.civitasweb.it/82/47-032-82/47-441/
www.coshop.be/UPS-View/Feb-20-18-07-27-10/
www.divisionesacusticasmoviles.com/8azx/UPS-View/Feb-21-18-01-20-47/
www.elgagilli.com/Invoice-26477813/
www.errecimobili.com/Past-Due-Invoices/
www.gelato-italia.com/Rechnungs-Details/
www.geocrime.org/UPS-Quantum-View/Feb-20-18-10-23-32/
www.gesumaria.net/Past-Due-Invoices/
www.giammarino.net/UPS-Express-Domestic/Feb-21-18-12-42-55/
www.giardiniereluigi.it/Final-Account/
www.gimel.it/wp-content/Invoice-for-you/
www.grandaimmobili.com/3-Past-Due-Invoices/
www.hrdesign.it/Outstanding-Invoices/
www.ideatecsrl.com/ACH-form/
www.ilnostroorto.com/Open-Past-Due-Orders/
www.initalytour.com/Open-Past-Due-Orders/
www.jelosa.com/Invoice-Corrections-for-15/54/
www.jir-abogados.com/UPS-View/Feb-20-18-09-39-26/
www.keminova.com/Important-Please-Read/
www.kercentral.com/Invoices-attached/
www.lacollinadegliameri.com/336-69-902246-876-336-69-902246-385/
www.libreriadelletorri.it/ACH-form/
www.limpiezasmarfe.com/Invoice-receipt/
www.loaizacomunicaciones.com/Open-Past-Due-Orders/
www.lucadelisio.it/Paid-Invoice-Credit-Card-Receipt/
www.mega975.com.ar/Paid-Invoice/
www.mobyco.biz/UPS-Quantum-View/Feb-20-18-08-49-23/
www.moliseservizi.org/Outstanding-Invoices/
www.mpdistribuzione.com/090-69-280691-004-090-69-280691-021/
www.napolicaput.com/Open-invoices/
www.naturaedintorni.net/Invoice-09900-February/
www.nonsolosicurezza.eu/Sales-Invoice/
www.opticom.international/Service-Invoice/
www.pagheon-line.net/Invoice-Corrections-for-48/89/
www.piccinnutrasporti.com/Paid-Invoices/
www.piscinerimini.com/Document-needed/
www.podereilboschetto.com/Paid-Invoice/
www.poggiodiorvieto.it/Invoices-attached/
www.poggiolafioraia.com/Invoices-Overdue/
www.progettazionedueeffe.com/Invoice/
www.prolococastelmadama.org/media/Open-invoices/
www.ptek-hf.com/media/Invoice-Corrections-for-i/d/
www.r-seabag.com/Service-Invoice/
www.raemsrl.com/UPS-Ship-Notification/Feb-21-18-12-02-19/
www.roba.com.pl/Paid-Invoice-Credit-Card-Receipt/
www.robertaalessandrini.net/Paid-Invoice/
www.securitaspuglia.com/Overdue-payment/
www.seligo.biz/Dokumente/
www.skydroneprojects.be/Invoice/
www.studiodalmaso.com/UPS-View/Feb-20-18-07-56-05/
www.tecnolamiera.net/Paid-Invoice/
www.toulouse-holdem-poker.org/UPS-View/Feb-20-18-10-44-06/
www.tourspompei.com/875-88-889362-220-875-88-889362-672/
www.trasportiprimiceri.com/Outstanding-Invoices/
www.villarosaagriturismo.com/Invoice-Number-t/d/
www.zagagro.hu/Outstanding-Invoices/
www.zollettedizucchero.com/Invoice-91607197/
xenialights.com/9-Past-Due-Invoices/
xn--alsn-nza.com/415-67-120812-535-415-67-120812-124/
xn--skavenbdlaug-zcb.eu/Sales-Invoice/
zmm.lodz.pl/Invoice-for-you/