2020-12-22 Emotet IOCs

THREAT ATTRIBUTION:  EMOTET

CYBERCHEF RECIPE TO GET URLS FROM THE BASE64-ENCODED POWERSHELL SCRIPT
----------------------------------------------------------------------
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'`'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'=Y3nkOs'},' ',true,false,true,false)
Split('@','\\n')
Find_/_Replace({'option':'Simple string','string':'qqs2'},'/',true,false,true,false)
Extract_URLs(false)


SENDERS OBSERVED
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

MALDOC DISTRIBUTION URLS
http://30sheji.com/ALFA_DATA/7mtG02g5HX7y0BZIXgrOVl9NOMjFE3lyyiJOxS36oylFVzMYLyZerbsF/
http://abrillofurniture.com/bph-nclex-wygq4/eniEucjq9yrM/
http://accoytranslingual.com/extended-metaphor-soa9a/RI5/
http://adishpatni.com/snapchat-viewer-wcb6m/iaFn7KuRF8ONpcHvlTOmXr3IYELEyGt/
http://adobocn.com/conan-exiles-7bemi/Wny3NUeo8LsFARNr3VQUJTkRTTekYd6iDu6iwiApDbsgeT/
http://agadirled.com/wp-admin/Overview/63375067625248/aO/
http://aksudardokuma.com.tr/layouts/ZtqtiU7NeZxEyuET3JwIZia0Ab/
http://akybron.hu/wordpress/qLBq8CxNGP91uh08NCwRmvbWffgUvekdNiPM/
http://aliados.i-bank.us/wp-admin/BXh79DoxPCeQxhNzZGGKgcVqquSnjnIje62sSLWJHlFDYdraz592m4zTECwhXJx1FWdUHx/
http://alizarei.ir/test/dFFcZPQWhw5Hb8A7gucgNoUgYgSVAIMZQCYekzqvV6VMSUyI/
http://angel2gether.de/BlutEngel/asgN3zzof5X8feCfpNw1Tvsl/
http://anurontv.co.in/g8evqiv/vqvmy/
http://appajuntaments.es/sidemenu/7QYA/
http://applecn-abrasives.com/content/to5kPmc1cOFBAAEbLsoVxRnK7NZdqDwOsRv/
http://archersrocksafaris.co.za/kaspersky-india-6fouf/eGZM0P6ZWpQbXpEUTkiC43/
http://aretchiropractic.com.au/wp-content/statement/ZPN/
http://atlanticgrupo.com/n/8oN3xU0Ovf/
http://avinatajhiz.com/cgi-bin/7kzxFqsT9kqbwawGB9grYBUrY6U85far10J3QJb3j/
http://avinatajhiz.com/cgi-bin/8/
http://bbs.soyul.cn/kafka-streams-rrd0x/Overview/37134/lbo0tsoc-550795/
http://bedigi.xyz/cgi-bin/fKci09A5TrmXN3f6ckgE2XQwQhiJ1/
http://beidou.run/Acoemeti/gaa/
http://bilhen.co.za/abante/mP/
http://blog.samskrtlife.com/c/3nqYF6UVR9/
http://bloxstorage.co.uk/cgi-bin/Scan/UjBPuNS/INC/tehngiybbmi-00067/
http://boke.xiaoxiekeji.top/9a654zor/UhEkexYRqEjG3Vf7XURn/
http://booksearch.com/index_files/9jwHSwZZCBTpcG0qWrbVycvdBICob8cQfffR2tYjDg6/
http://boomi-indonesia.com/content/4750MO7oyaswJdJ4NwXcuggKRINuzRu/
http://botalo4ka.store/p/y3qdvlZ3JBXN3lNmitWLk37bUDHTeGoCTo1yLwzdyPFPT/
http://boxertraining.mx/local/categories_library/admin/images_categories_library/7QjUltk2QLnnDct/
http://c2030920.ferozo.com/wp-admin/Pages/dn4o6wv-000106/
http://calgaryautorepairservice.com/wp-content/form/2829914108/jGDESjs/
http://carbonquotes.com/wp-admin/Services/
http://clientsure.co.zw/f/TMLeVqxI/
http://club-figueroa.com/wp-content/public/vl/
http://cnymb.top/y/Speech/
http://confidentcaredentistry.com/cgi-bin/byph0sw1v-0006356/
http://connecticutsfinestmovers.com/_backup/cIVVEizBh9ooQHrdXu49nksjYGGv3WkmqDkD0J4rai9f1rD48Ja1Osiv3VGE/
http://countrynavigator.com/ark-aberration-66ay4/invoice/1xw2clr-830449/
http://creationskateboards.com/satori_wheels_spencer_hamilton/WRLUbPer/
http://dabaibai.com/wp-includes/public/831526720787/b291kcjqathux-0055/
http://dailyneeds.worktoday-timesheets.com/how-to-qt3jx/HL6HeqvwG23mXMpEeqMe54d3kcRGubohfKXq8Yncn8/
http://daoisthealing.com/cgi-bin/ggDTPTkVTMMzVn81NJQ5IDXcKNy90gOlG7RkpReZ7jVhmClDeMRPW/
http://deepakjaintinu.com/wp-includes/qVFbUJkT2s1xVYlBcyv04aONpR5x8UyHSRO/
http://demo.impactmmg.com/privacidad/3676226087032/jXycNuw/
http://dev1.assar.in/wp-includes/B84S6yqq1m8Yl51/
http://drziq.com/nynfp18/fJxmu62pCBk1WDYGOU89kONsgbHbDUeNSDXP/
http://easternstores.in/cgi-bin/statement/pw0aztotm3-083/
http://eastwestsurveyors.com.au/gc25-forklift-etwcf/NWqFAMdXSsmX6SzVjD6QjF3PmAkKKzzLvpizyhdtLKCvpJtsbxdtdsSBotsqyIJBGhk/
http://ediet.ir/wp-admin/k5EHtH6jpKuHtAuJr1t7gP3atWyTpcFhUGQOLgmEmiAc1XgK8lXI4/
http://elliesophtalmologie.com/sagittarius-today-ogacy/vT0YN1GWZXcQ2Vng0C1Pbvf5wACIWaM5gXK0/
http://emlog.soyul.cn/content/svGT6ohwKwTnY2auZyqTyhepxjY5tTMOq26/
http://esgfiltration.com/cgi/Iu9Rxxzz9LEYPNh4Si0qPlnnCJswKNN9qgy7xzZ6NNGYhdwd8cx6/
http://espider.eu/journal/YPGCCZbjJLMQFNNncbOOymB13ZCrJsTn0ANewk53xKeQRYjEDeTikL5CWTBadBq1nh/
http://eurogemsis.com/wp-content/tudiwCAScATBOhUH8BXKrE7ieqLw0jQQv7kT36SPEwqKasICvqqjFBe2tFFh/
http://exxonabnie.ir/orbi-slow-glero/gGkUV5JkrMKN1kGyELyVka973qrXnWF/
http://fenfa.vishou.net/codepay/BFUJuGN2bxYz8WzUpBQCOpPyBSGBoz458n/
http://gapuragamapersada.com/wp-content/languages/sLfE/
http://geekdeer.co.za/wp-admin/b3rlkflDgzReGyGZFiivLIKrd3y8C38MJJ6pQ3VfQzPF3x/
http://geosrt.com/aqqhwdap/bnijdctxwnxu2fxyeicnz9xbu4a79ennyt1mtnwmmw/
http://ggf1.com/mindwerkfooter/D4nPuwygTRUtIhA1UVcZU5DaQSvmvUCHqlhaF7zATa74MGIAYADtTQDCgCRHntlz6YWw/
http://giaoduc.giaodien.vn/cubase-10-abg6t/nQ4jGjRz8zh30aYJ7wjip45Qdw2IMVb/
http://gluonpharma.com/fonts/W/
http://goldentrading.com.bd/godrejlocks.com/EMlb7cWE2ieYhNeewg5VLeF5ZwvV4H5FTa6CNNAe2TIq6N0kSqhX2mQeEep/
http://goutworld.com/2008-dynamax-0erpl/vvaSWq1Sl/
http://gurtekinler.com/wp-content/Uc7ze7iephRBkO6tvQRa0qW8Mj5JSe/
http://h002295863.nichost.ru/unlevelness/DY7jFdzySKQYkULg07EnumW/
http://hairworld.com.vn/eglandular/Cs6aoFQngguoMue5aAPH/
http://happyinvestors.vn/wp-includes/k5MPXYCMEXRL82sLCNVwuNJ0PJk/
http://hatchcelerator.net/wp-content/invoice/338908677344382/9lx6m8afc-000603001/
http://hnstech.vn/wp-includes/0jSxeCZ4Z8NwsJP6DThHVdJ/
http://homatalwatan.org/wp-content/uploads/t5Zc10ncLwB4xJLFM1KkiptluxDn1lpUbAPiYXhWsagzcBfGJMje8cba77s/
http://hyphen-concord.com/default_page_assets/DOC/EENyRNRiw/
http://icaruslearning.cl/content/eTONVKPydhdRSPo8fthz1xuXIpttSir6FPvF57V1zMkIyXnxvSJLjYCflN3J/
http://iguanapneus.com.br/telling-ex-isnoi/FwjV8IBKL07puzRg99GC9bb/
http://ikizhavuz.com/wp-content(old)/redHSAMn7xQ22wYZJ88MuPXzou69VG2RHTm50biB6NEUPbYHuttWpJJqh/
http://institutoisor.org/g/Oh1ucGWd3nfPDUukPD80BZbwbfescnqDDASuvx9GN/
http://insumosdentales.co/q/cxxyYbo01yB8I48vzoohjgpQBiHVkomS/
http://insurecars.co.za/wp-content/6arDQzbGiKzva9htDYqbv9fC5ARNq/
http://iskconfalls.com/w/yH8YCy23wwfS/
http://jada-msag.000webhostapp.com/wp-admin/kptUDLYSmfsi2FvEUdJrO44ynd4YMbDmFwoL19IgPg2/
http://jdkems.com/admin/NaUf0YPks1n6aH4bQU9zZ0BB60BPvvkvRv3J60w7VH5qfIQYRGxwtHfoAg0VTcYk/
http://johnloveskim.com/a/bV/
http://juhuanguo.cn/wp-admin/28JF9MR2FbrMmxlgNTTO1rvLeCnlWtEjkQvyl8/
http://kolerkar.com/wp-snapshots/qSWJmM2Lair9iPJr/
http://konev-dev.ru/test-trucker/BsJvC9KZU7MwplXqxtTZ5cwCJIOmmUZSi8HVuhgvQ3TR9mOuumAWc4ss7qYuHjBg/
http://kpchicagolaw.com/n/KttsDXcH2pdSrE4xUJkrSYXzxYKRv9dX/
http://kspnasari.id/wishcart/JP7RtWfwz0KYVQ2m0yFEZuupdW0g5d9XI7Vo76m3CMDikbZ4Brydl4ht7k/
http://lacigognedelily.com/cdle-unemployment-qsnl5/XiSfW6I/
http://lainiotisllc.com/postauth/qLzbhchxxy2XnxoXhYXHZQzpt3dRNaHarynTR3oOizCMxw3to37kdOlaDoN/
http://larayochoaclinicadental.com/wp-content/AKQ5we3MfiCTxukxFFogd6bqIApw5SzwDV1rWDb/
http://liubaozi.cn/wordpress/wayW90OoXCT5diCZSYmJ1qg5XZyS3x86p5/
http://logicmoo.org/mydokuwiki/CsGbdW9Kym3v40f6HzZP63Ivl1b8Jz6AfYOPNh39MhPCbSxVSPlkaJhVO72a/
http://lucky-scent.com/rangamaati.org/attachments/attachments/0253492410/1z3tjv2i-70138/
http://m.bureau-praktika.ru/blogs/attachments/attachments/CYk/
http://maksimumgruptemizlik.com/wp-content/DGQyMFRAZXZ2fpHeYCS9FnuYsdyZV6n/
http://medistaffconsulting.com/crm/vendor/dnoegel/sitemap/0ja8dZBFnYbMnMQ6avLE/
http://members.nlbformula.com/cgi-bin/Scan/6500101/hfyRP/
http://memoria.od.ua/wp-admin/ZRDEhBKxgf/
http://neabot.com/wp-includes/Gp9c2oAlybHuBicFaHpCOR8ZpO1TetL5Y3JnVmAgPP2SAtzHf6hdrEfRJm2k8X1XZDgbw/
http://nicetelecom.us/vsr/81CqdFelyiUdYH4cxNWZGPBnWFEhI3yXPjkGDGJhMZzv6Idk8iSNYm/
http://nnpanewswire.com/how-did-lx1an/ODJkX2QddrqdnQh4K/
http://noithatnamviet.info/wp-admin/WKsar3f0zugFHZ3S9WtaLVqVqs7OiG3rEbn96ZGdfWWDvXu5/
http://nonnarina.ax/wp-content/TgjpYgCSgQJAPYCZDPrzF8XAK4f1esP0V3d7PTY/
http://panya-realestate.000webhostapp.com/wp-admin/SpeechEngines/
http://pathology.world/wp-includes/MBnJLwwnABuo5uFPvAAJqFuAsVUGTaanHn0ms0f3rvFCVlShLM/
http://phonerepaircentre.com.au/dr7777ev/udVqP54MnBAUVAw/
http://pinakiganguly.com/admin/MSInfo/
http://podcasterz.hu/softaculous/RjcHrladaah1w/
http://pradesaventura.coopula.cat/k/6eSAyhCiVHZOEZh5Vggq1euIBVdX0F2bz0kPgrvfEDGU7oG7pq2p8s/
http://pusher.co/leg-covers/Sz5ujJHPoe6gvtVuApCNUBs26Kao3Ro1HkpjUgkhP1HE/
http://reteartigianatodigitale.it/softaculous/form/Ir/
http://rsii.in/video-storytelling-cvrgukt/HfveDb8cWtmaeKClJOoqkc3rFLW80os11WjooeldgYbu/
http://rubisasphalt.com/wp-includes/5wDSSIs4aNUUCh0PdiOOXiGdDEvnMusgGlIoaRayABn6NPod/
http://rydchile.cl/wp-content/G3RM700m8rKZKiOSinwS6oSBtyb7UZmgFxZzv01TmvQ6AybXBrbFd1/
http://safelink31.xyz/wp-admin/4S0bPitHXzv/
http://saierc.com/wp-content/5DAZHXt2D0GaDkHxvf8KXs/
http://sistempark.net/wp-includes/VMmKousre/
http://sky.impactmmg.com/webkit/rwMa5tT8umtcmheazLISfW3x44Ij75TDZYhrr7xZBGQf8rh3j/
http://sogesaeirl.com/like-app-z1f0x/X5D39NSUXo5j09CfCwb8t5ddD7I0f8p13UBmUB8JpDGCUaCTTjvX/
http://soham.co.in/pacman-package-6n9ps/m32/
http://subscription.thegymcocobeach.com/communications-rfp-th8dg/XhK1osljCRMREID2zaOrhoaLP5Pwf5TzDdW0YpjyGLlwixeSipb6/
http://surfboarddigital.com/carol-stream-i7lsj/s7rZRUk7s2/
http://switzersfoodhall.ie/h/9WAHIGhFlzdJJvXtA5XoO5enXmlHuNZL0oAoQIGG0JUbUnCo9EOgZ155oTr6/
http://sylwiamarciniak.art/wp-includes/payment/00025564/ft4fa1yndp-083/
http://thebeautymall.co.uk/wp-content/M6YDTAAKftemqF1UDHS0lzDRU2p/
http://tobpm.kz/wp-content/wCnyDxHLaB08WKTT7VAlVqNdG2dJmeSNperhqF2IZm/
http://treatwellonline.com/directions/oixeGsPCBaTiJ5KLEDVhZeGTTHnnGL4CkLVrAe0PrFSX1xvPwZVuCC5qwHBjK/
http://trongthanh.com.vn/wp-admin/VEwucZ92vCWVZmVwQUbAauWAg/
http://turbo-services.com/C://gJ7MI2nvhMIIyLRtpyFXmwIg2vp5OS6Ax4hoHuqdP31YI036pS/
http://turbo-services.com/C:/gJ7MI2nvhMIIyLRtpyFXmwIg2vp5OS6Ax4hoHuqdP31YI036pS/
http://ufaam789.com/cgi-bin/LslQ2d8Y2BhqMwc1XmtOFIPXCrM21GoAlp2yQQb6LeTWPvUX/
http://ummahstars.com/app_old_may_2018/assets/jhVT5BOuV9Mu4cxKEQhrMdptYWL5zRKb1Mnv/
http://upinsmokebatonrouge.com/var/kZKk4S0XnGUwc0OKsia1/
http://upinsmokebatonrouge.com/var/xSwuOxSEImbhf04jGn5RxyjNzmvLa5Lbve9frMgHaas7drqE4OybiICW5pDWS/
http://vantaikhanhchi.com.vn/wp-admin/Il1raWts5LMYXuGDkGzfc2bgpgpUBb2hhvooTearExXsKrupqhiZBfe1BlEPmo99Qa/
http://versatile-solutions.in/wp-includes/PrhrntvtMKt8kKdKIhmreeuchuhoGF2S7a/
http://vespepadane.com/cgi-bin/6bBBCSXLi9Td6TqVinkHaqwxuAjSs2qm9hJMqrrwA2X/
http://vongu.store/send_newsletter/Oi2fMLYJenkrurThxJzW29LXjo6PFbYEfQc33nwsgBc05fpCRbyBCwEoO/
http://wagnerbandeira.com.br/wp-admin/S/
http://weneedpatientadvocates.com/reviewproduct/browse/27434837736608921/NqVtXIPZS/
http://wptest.impactmmg.com/st-orderpages/lUCVMWUr0cbYyTKRWtfmffqjHgSJ34gXHqQ6MzY3Fnf1vjFNgIlccv7j/
http://www.achutamanasa.com/cgi-bin/BFeriAt1bDTdBLi95GQ0r3iHRyS5PwNwxROTpevhj0EFgow0H/
http://www.adobocn.com/conan-exiles-7bemi/Wny3NUeo8LsFARNr3VQUJTkRTTekYd6iDu6iwiApDbsgeT/
http://www.celinepeyraud-psychologue.fr/wp-content/D7CQ3IoTNQu5UXCBeF4x8kGbntlJumdduH0T/
http://www.chtr.ch/wp-content/dvf187rVXs9/
http://www.cwa.mx/himalaya/ziqqBxu4F7CwSORdFXKiHmhwFCC/
http://www.dadashuo.com/wp-content/ocPUw2Sqj28961UhZuYnojADjliilrP25tKOPKVWtIdM19ido/
http://www.dmv-seo.com/wp-admin/invoice/19317449483919268/tb46fqj7928f-0038058/
http://www.mlrodasepneus.com.br/index11/NNjzVXE4iK54pJCPRZb2ZfqnCbPtE6Wyei/
http://www.montegray-lingerie.store/content/eC3qfTq08OugdT3br/
http://www.reteartigianatodigitale.it/softaculous/form/Ir/
http://www.servicesforlandlord.com/wp-content/GgQJ2RkXq5GzClrDnwPdTv3/
http://www.sprintnegociosdigitais.com/wp-includes/form/ZScgn/
http://www.taotuli.com/hereness/phuMg33WjdOC4VjorlN/
http://www.tbks.tech/wp-admin/O0jHdTfPN/
http://www.terplandia.com/publish_f2/j57DVgxq5B3kbJ6ckaxsZG/
http://www.wiratech-europe.com/wp-includes/Pages/7635/b9dc-0071/
http://x.ziyoubb.com.cn/wp-includes/WkcTboK3jM1MKm3EuF9pdIGREGrqyuHX/
http://xichengkeji.top/classic-retro-l8swk/3926bosets0n4/u2cfhti77-96/
http://ycwdi.cn/wp-includes/pucoigTfH7DW7EuB7IHMkUMFX8Y36cn/
http://zahradnydomcek.eu/assets/HAtCGXWLkxqRW0w7Udd1gJ6WIwvWnfjiaclE3yWTSUTY4Gv905SwY8v4NtKjIM876/
http://zerohourtransit.com/information-17/4gqekdttfmtg-44/
http://zimolimo.com/grand-slam-mizlpu/rj55kL3XXUBfAqML2srZqQxbBkPih6fr49KgrgLpmLIg/
http://zzznan.com/wp-admin/NL9wu1TisXOy1RVpkCyGfvtoQe8r2Grvon8eggV0MNTeI7RUUBIi5ntluBkrAF/
https://173.201.145.24/_db_backups/RLISUK/
https://789hosteley.com/wp-includes/u0Rbt8QQnx7Pe/
https://accoytranslingual.com/extended-metaphor-soa9a/RI5/
https://alibabadairymilk.com/wp-includes/statement/6426/xOwKkVPOT/
https://amystuff.in/g/XNQwfDc1pDH2Uj4sNQU7RUZ66Nrv2dh/
https://antong.soyul.cn/wp-admin/AUMaf0/
https://aplicativoparasindicato.com.br/wp-includes/rmsUxVMu4iEU9dzDZD04L4GX2ROiC3JcvOrExSuWC8h/
https://apollontheagency.com/content/FILE/417480417/t4rpvamg6jg-0248/
https://bilhen.co.za/abante/mP/
https://bqkj2013.com/wp-includes/TDTqs7cFNCLTGZsR9NT0jgtRNpmt4xQSPT61xc1eHQBn47RxvEjx/
https://caminhodosveadeiros.com.br/h/Ld51n5yo2sVpA9ix2ZHZLqX7/
https://charcoalbagss.com/wp-includes/R65TkK0aVwOi2fMLYJenkrurThxJzW29LXjo6PFbYEfQc33nwsgBc05fpCRbyBC/
https://club-figueroa.com/wp-content/public/vl/
https://connecticutsfinestmovers.com/_backup/cIVVEizBh9ooQHrdXu49nksjYGGv3WkmqDkD0J4rai9f1rD48Ja1Osiv3VGE/
https://countrynavigator.com/ark-aberration-66ay4/invoice/1xw2clr-830449/
https://dj.4zido.de/i/612BRNn/
https://drziq.com/nynfp18/fJxmu62pCBk1WDYGOU89kONsgbHbDUeNSDXP/
https://ediet.ir/wp-admin/k5EHtH6jpKuHtAuJr1t7gP3atWyTpcFhUGQOLgmEmiAc1XgK8lXI4/
https://elliesophtalmologie.com/sagittarius-today-ogacy/vT0YN1GWZXcQ2Vng0C1Pbvf5wACIWaM5gXK0/
https://exclusivetr.com/wp-content/BW3IsTDB62eZYI3ZRJd43iWzEf72vLJI7g6hzCBrxUJ31Bq/
https://fabisalon.com/wp-content/7EZ6FFE85SiGuCz6dN7WoVr/
https://facturadirecta.intercom-attachments-6.com/i/o/280127824/052973f559484f6132123057/8773282-122020-G_66278004.doc/
https://facturadirecta.intercom-attachments-6.com/i/o/280129039/52c425367b0563ce1c45830a/5491-2020-ZY-9997527.doc/
https://feants.com/wp-admin/IH7p66cMBIcHhwYpG1okuq9PQZzkSJsThj0PReRsQmCrsW6dH9X/
https://gacetaeditorial.com/p/oKnpPMNzoaKZ5G4G8pQdFnHw3gCC1J7azzYmRESltw/
https://gapuragamapersada.com/wp-content/languages/sLfE/
https://geekdeer.co.za/wp-admin/b3rlkflDgzReGyGZFiivLIKrd3y8C38MJJ6pQ3VfQzPF3x/
https://giasutiendat.net/buying-a-qak5p/WN31f63LtoDWi7VjBecS8B/
https://goutworld.com/2008-dynamax-0erpl/vvaSWq1Sl/
https://halalactivities.com/wp-admin/VOEgjfrc9qtfE0bMrSX1k2nc4FWPf4IIaSPGElzNFT/
https://hallsen.com/wp-content/2EfV88gnYP/
https://hanvifa.com/wp-admin/8l/
https://himateka.umj.ac.id/logs/lYXDs29RCGSmj0ohf9LsYZN7ilqsUrpBoZPRxy0BGqcsY4e7dVXvZZMrXgJWxP/
https://hostvngiare.com/u179068337/UVcLx146Bn93au8UYYXxg/
https://hqtechvietnam.com/bcm943602cs-hackintosh-meedf/qvICbkT60pTME3MnvoYiJEMe6asyVKowXpgiUe3BewX7WpAfxV9vCIaQ31D5s3s/
https://idealdisplays.co.za/wp-admin/4ndDW31Brb/
https://interiordesign-philadelphia.com/d1080aa2967f18019b939651c595328e/rn4LL3SnsUW1/
https://jbshop.shop/proposer-site/ovVyo5rrNLAgd0QxXvkvE2RwbkbKvGXCv/
https://jebee.vn/wp-content/U9RsHzhPXQDEDvZ6RPnxd9tV9/
https://johnsonjoyonline.com/admin_links/7nKJa4TqWamdP6PdsxXjfKG9WtVQhBjlgFeEzjUtwleNnw1ZF/
https://joywaysolars.com/wp-includes/GZPQQQm77GmxUVmpBPMOgXZHohbQDLQMn6Lx0J1qaWE5DLa3CFWLabsxS2OjdYZgUflRTD/
https://lacigognedelily.com/cdle-unemployment-qsnl5/XiSfW6I/
https://lacompaniahb.com/wp-content/z0fgicYVU7/
https://leyarled.com/wp-admin/F78eT7euvofvhSPYenEJFyp1jNVnwOnTpBgRiArLbvjmN0azJl1jG0GCn4l/
https://logicmoo.org/mydokuwiki/CsGbdW9Kym3v40f6HzZP63Ivl1b8Jz6AfYOPNh39MhPCbSxVSPlkaJhVO72a/
https://lsfour.com/wp-admin/hIDfbPOa1IQ4thgfJDF8GYdDzYj4VE7qTNqkvdz0pD/
https://mangatun.com/wp-includes/form/818896209/px8v5v3a0ie-60287/
https://maritimesurveyandservices.com/cgi-bin/BOxssaY75grLSn9n2Q1kQaNXvZNWR8luhqq1AHl6WKORhOzLOw3C9LPmMntYcnm1n/
https://medistaffconsulting.com/crm/vendor/dnoegel/sitemap/0ja8dZBFnYbMnMQ6avLE/
https://nextmobile.ga/wordpress/EQuFyldTwnoKJv34jbYCJqSrOeP2W/
https://nicetelecom.us/vsr/81CqdFelyiUdYH4cxNWZGPBnWFEhI3yXPjkGDGJhMZzv6Idk8iSNYm/
https://pathology.world/wp-includes/MBnJLwwnABuo5uFPvAAJqFuAsVUGTaanHn0ms0f3rvFCVlShLM/
https://phawayagency.com/wp-admin/SOI7HC89a2POcagDPPa2GZCKdOOoh1o6I8RR9yAirIHNh3uWHx/
https://phonerepaircentre.com.au/dr7777ev/udVqP54MnBAUVAw/
https://planalife2love.co.uk/reorder/8MT1oKrpI7ZtvcgjUXOcd9Dn1qnIGwUuQKBnCx1eejO/
https://podcasterz.hu/softaculous/RjcHrladaah1w/
https://powerup.rent/wp-admin/YGkEoN22Z3okdrOEaYj6N4mzFd0zeRvw4gzg6I4KzwKsdnPAB/
https://praticideas.net/wp-content/5nxk9R7pIxOAP8bYYojGh4Rl69ZT6uMTycnblB4OUEIzYvRuc22u0pyZbSvqTNlp7/
https://pusher.co/leg-covers/Sz5ujJHPoe6gvtVuApCNUBs26Kao3Ro1HkpjUgkhP1HE/
https://pwk.ft.uns.ac.id/wp-content/gallery/sei1yiza-00029734/
https://rakshith.ml/wp-admin/ZD1yxcXHu7UCQCqQSJYOfOCBth63C
https://seoweblog.net/earth-sub-bykpd/jeRA2euFqQ6aWcCm2Kne4pUWdyjIR0ebMin0N4izMvo2UPcmiPfKYyHDDt/
https://shoutingimages.com/wp-includes/ecNLZHkyBqZay8jzpDXNn5yu/
https://swallowcliff.co.za/e/c5Q/
https://szyhdzpcb.com/impenitently/wIL7tLPi0SJVPJt1Av18CWCQMZUJ0oLE/
https://thedrag99.com/wp-includes/VBEKzueaIX3Xg8PxajxRqWeddktOL5C86V7bjqSULcvJiwBXI8cZU2sUuu6cEBZ9qnfXAz/
https://thegioiso24g.com/wp-admin/T60AcsmsWU/
https://theo.digital/wp-admin/report/7115973860/HOrttJr/
https://thesaaspro.com/printdetail/cT83isHErdDSJaLTu3jH3DWUNDsoJvBvxk6d0F/
https://tuxpirate.com/wp-admin/rptA33JTEDZo4rriYLgrV2Ik0XG7KE/
https://ummahstars.com/app_old_may_2018/assets/jhVT5BOuV9Mu4cxKEQhrMdptYWL5zRKb1Mnv/
https://upinsmokebatonrouge.com/var/xSwuOxSEImbhf04jGn5RxyjNzmvLa5Lbve9frMgHaas7drqE4OybiICW5pDWS/
https://vivc.edu.vn/projectile-motion-ppunf/NYMv4KWbYbJiOcRon9Ml1idBsARCcn/
https://wordpress.tempsite.digital/wp-content/invoice/735993540091/dXha/
https://www.acboilers.com/_/DOC/kEkqpw/
https://www.chrisdior.com.au/test/balance/qgtkbp60x0/
https://www.cwa.mx/himalaya/ziqqBxu4F7CwSORdFXKiHmhwFCC/
https://www.szyhdzpcb.com/impenitently/wIL7tLPi0SJVPJt1Av18CWCQMZUJ0oLE/
https://www.terplandia.com/publish_f2/j57DVgxq5B3kbJ6ckaxsZG/
https://www.ummahstars.com/app_old_may_2018/assets/jhVT5BOuV9Mu4cxKEQhrMdptYWL5zRKb1Mnv/
https://zahradnydomcek.eu/assets/HAtCGXWLkxqRW0w7Udd1gJ6WIwvWnfjiaclE3yWTSUTY4Gv905SwY8v4NtKjIM876/

000webhostapp.com
30sheji.com
4zido.de
789hosteley.com
abrillofurniture.com
acboilers.com
accoytranslingual.com
achutamanasa.com
adishpatni.com
adobocn.com
agadirled.com
aksudardokuma.com.tr
akybron.hu
alibabadairymilk.com
alizarei.ir
amystuff.in
angel2gether.de
anurontv.co.in
aplicativoparasindicato.com.br
apollontheagency.com
appajuntaments.es
applecn-abrasives.com
archersrocksafaris.co.za
aretchiropractic.com.au
atlanticgrupo.com
avinatajhiz.com
bedigi.xyz
beidou.run
bilhen.co.za
bloxstorage.co.uk
booksearch.com
boomi-indonesia.com
botalo4ka.store
boxertraining.mx
bqkj2013.com
bureau-praktika.ru
calgaryautorepairservice.com
caminhodosveadeiros.com.br
carbonquotes.com
celinepeyraud-psychologue.fr
charcoalbagss.com
chrisdior.com.au
chtr.ch
clientsure.co.zw
club-figueroa.com
cnymb.top
confidentcaredentistry.com
connecticutsfinestmovers.com
countrynavigator.com
creationskateboards.com
cwa.mx
dabaibai.com
dadashuo.com
daoisthealing.com
deepakjaintinu.com
dev1.assar.in
dmv-seo.com
drziq.com
easternstores.in
eastwestsurveyors.com.au
ediet.ir
elliesophtalmologie.com
esgfiltration.com
espider.eu
eurogemsis.com
exclusivetr.com
exxonabnie.ir
fabisalon.com
fapp1.globelinkww.com
feants.com
ferozo.com
gacetaeditorial.com
gapuragamapersada.com
geekdeer.co.za
geosrt.com
ggf1.com
giaoduc.giaodien.vn
giasutiendat.net
gluonpharma.com
goldentrading.com.bd
goutworld.com
gurtekinler.com
hairworld.com.vn
halalactivities.com
hallsen.com
hanvifa.com
happyinvestors.vn
hatchcelerator.net
hnstech.vn
homatalwatan.org
hostvngiare.com
hqtechvietnam.com
hyphen-concord.com
i-bank.us
icaruslearning.cl
idealdisplays.co.za
iguanapneus.com.br
ikizhavuz.com
impactmmg.com
institutoisor.org
insumosdentales.co
insurecars.co.za
intercom-attachments-6.com
interiordesign-philadelphia.com
iskconfalls.com
jbshop.shop
jdkems.com
jebee.vn
johnloveskim.com
johnsonjoyonline.com
joywaysolars.com
juhuanguo.cn
kolerkar.com
konev-dev.ru
kpchicagolaw.com
kspnasari.id
lacigognedelily.com
lacompaniahb.com
lainiotisllc.com
larayochoaclinicadental.com
leyarled.com
liubaozi.cn
logicmoo.org
lsfour.com
lucky-scent.com
maksimumgruptemizlik.com
mangatun.com
maritimesurveyandservices.com
medistaffconsulting.com
memoria.od.ua
mlrodasepneus.com.br
montegray-lingerie.store
neabot.com
nextmobile.ga
nicetelecom.us
nichost.ru
nlbformula.com
nnpanewswire.com
noithatnamviet.info
nonnarina.ax
nospamproxywebp.beckhoff.com
pathology.world
phawayagency.com
phonerepaircentre.com.au
pinakiganguly.com
planalife2love.co.uk
podcasterz.hu
powerup.rent
pradesaventura.coopula.cat
praticideas.net
pusher.co
rakshith.ml
reteartigianatodigitale.it
rsii.in
rubisasphalt.com
rydchile.cl
safelink31.xyz
saierc.com
samskrtlife.com
seoweblog.net
servicesforlandlord.com
shoutingimages.com
sistempark.net
sogesaeirl.com
soham.co.in
soyul.cn
sprintnegociosdigitais.com
surfboarddigital.com
swallowcliff.co.za
switzersfoodhall.ie
sylwiamarciniak.art
szyhdzpcb.com
taotuli.com
tbks.tech
tempsite.digital
terplandia.com
thebeautymall.co.uk
thedrag99.com
thegioiso24g.com
thegymcocobeach.com
theo.digital
thesaaspro.com
tobpm.kz
treatwellonline.com
trongthanh.com.vn
turbo-services.com
tuxpirate.com
ufaam789.com
umj.ac.id
ummahstars.com
uns.ac.id
upinsmokebatonrouge.com
vantaikhanhchi.com.vn
versatile-solutions.in
vespepadane.com
vishou.net
vivc.edu.vn
vongu.store
wagnerbandeira.com.br
weneedpatientadvocates.com
wiratech-europe.com
worktoday-timesheets.com
xiaoxiekeji.top
xichengkeji.top
ycwdi.cn
zahradnydomcek.eu
zerohourtransit.com
zimolimo.com
ziyoubb.com.cn
zzznan.com

DOCUMENT FILE HASHES
2545a77120ccf83a8092d8cc65a77e4c
3c054d4f5e04a21f909443798366a4c9
64473ad4b96dff130656f265ccdce849
6b4a1540ddeae75af188ed80f15c2309
9220d38a8e3db16b2a3b0fd3009eac3d
ac69322c478739512ec8373340a20243
fb5971710a7f0cd9a50cd0f125724bfa

PAYLOAD FILE HASHES
1d46f239ffd37859b57988e106c65b1b
25ae68bf1e048b33f96da18445f20b15
43fda4c2cf269c9c5798bac566555e4a
47a903d673385641d1a77dd4cd1c7254
597563e3532dbfd11f5773dc2c8fe0ec
8d592f49bab635fa2399e5cc27ae21bc
af7673079b91bbf4982177becc9bcae9
b75cdcd11f74c132565642bc6a72df96
bda2237a2c8189c1c0f2d87691d2bb26
d16949283379c1d4ba4709740aedaf14
e0c19eda125911d42160af76d5f06b9c

EMOTET PAYLOAD URLs
http://alshuwail.com/cgi-bin/5/
http://andeanreach.com//System/
http://anjumanclick.com/q/kvM/
http://ardenneweb.com/765779o900/re/
http://biolandmedical.litofis.com/VGX/
http://cearacultural.com.br/admin/Sys/
http://cherkashchanu.com/Z:/4ZE8/
http://ciroiluminacion.litofis.com/wp-includes/eKWy/
http://comunicacaovertical.com.br/agencia/MtX/
http://countsquare.com/standardservices/mnR4/
http://genzmag.com/ratings/VQ8n/
http://hbprivileged.com/cgi-bin/kcggF/
http://heaventoearth.com/360views/xu/
http://howwevacation.sheltonpropertiesllc.com/wp-content/J/
http://imkol.hk/photo_search/3kc/
http://impeledu.com/content/ALI/
http://infosisconsultancy.com/wp-includes/d60/
http://jpkiselavoda.mk/advertising/Pl1SS/
http://ko-racingshop.com/account-eu/Y6W/
http://localaffordableroofer.com/ralphs-receipt-f2uhf/qTT5DC/
http://mts2019-002-site9.gtempurl.com/wp-content/f/
http://opheliasbrewery.com/wp-includes/ciAjcgj/
http://palanskaotg.org.ua/journal/3/
http://pellesbar.co.il/wp-content/microsoft/
http://penambahberatbadan.info/r/pXPKwJ/
http://pox23.io/wp-content/I/
http://priyabeatus.com/iltfjz/M8/
http://qualcommmedia.com/wp-includes-old/m4/
http://servicios.semperti.com/wp-admin/2IyZE7k/
http://suhu.site/wp-admin/pm/
http://thebestfikrah.com/wp-content/B1rS/
http://themesgiant.net/wp-content/microsoft/
http://thoitrangtrungnienkim.vn/wife-AND/Help/
http://tillmoon.lt/wp-includes/j/
http://tongdaihanoi.com/847346324234234/rpnvXm/
http://www.alshuwail.com/cgi-bin/5/
http://wxdgut.cn/auto-refresh-waj4n/0x/
http://zenithcampus.com/l/yQ/
http://zsartandcraft.com/wp-content/fUa/
https://accionistas.balneariodealange.com/rumus-jitu-wkg6v/SIGNUP/
https://aeropilates.cl/wp-content/Service/
https://bienhoacitysq.com/wp-content/xYp/
https://calltorepair.com/assets/09erZFF/
https://d-cem.com/wp-admin/6/
https://dive-hoian.com/_file-manager/sO/
https://dreamwithdell.com/wp-includes/pX/
https://duocnhanhoa.com/wp-admin/J5JbVEY/
https://ecomdemo2.ogsdev.net/wp-content/zWWB/
https://football-eg.com/web_map/n/
https://free-onlinproducts.com/wp-includes/L/
https://fresh-flowers-galore.com/wp-content/SSChBp8P/
https://game.vlexor.com/links14/WUSs/
https://genzmag.com/ratings/VQ8n/
https://giatot365.com/wp-content/uploads/2020/Sx/
https://heaventoearth.com/360views/xu/
https://hotelshivansh.com/UserFiles/8/
https://italymining.eu/wp-includes/en-US/
https://johnhaydenwrites.com/track_url/P/
https://legion.com.pk/__MACOSX/pT3h/
https://nahlasolimandesigns.com/nahla3/d/
https://ownitconsignment.com/files/b/
https://pinkista.net/wp-includes/B/
https://qualcommmedia.com/wp-includes-old/m4/
https://resuco.net/wp-content/uploads/2020/12/S0K/
https://rycomputer.com/content/X/
https://siamimplement.co.th/images/System32/
https://thaithienson.net/wp-admin/EksZXO/
https://theunseentales.xyz/wp-includes/G/
https://thienloc.org/data-sgp-kgfig/AaK/
https://travianbot.net/wp-admin/58Crtv/
https://vietnhabienhoa.com/wordpress/QUTy/
https://www.vintageartgalleria.com/cgi-bin/h/
https://xuanthinhshop.com/acura-mdx-snck0/2LU7w/
https://yellomosquito.com/wp-includes/w/

aeropilates.cl
alshuwail.com
andeanreach.com
anjumanclick.com
ardenneweb.com
balneariodealange.com
bienhoacitysq.com
calltorepair.com
cearacultural.com.br
cherkashchanu.com
comunicacaovertical.com.br
countsquare.com
d-cem.com
dive-hoian.com
dreamwithdell.com
duocnhanhoa.com
ecomdemo2.ogsdev.net
football-eg.com
free-onlinproducts.com
fresh-flowers-galore.com
genzmag.com
giatot365.com
gtempurl.com
hbprivileged.com
heaventoearth.com
hotelshivansh.com
imkol.hk
impeledu.com
infosisconsultancy.com
italymining.eu
johnhaydenwrites.com
jpkiselavoda.mk
ko-racingshop.com
legion.com.pk
litofis.com
localaffordableroofer.com
nahlasolimandesigns.com
opheliasbrewery.com
ownitconsignment.com
palanskaotg.org.ua
pellesbar.co.il
penambahberatbadan.info
pinkista.net
pox23.io
priyabeatus.com
qualcommmedia.com
resuco.net
rycomputer.com
semperti.com
sheltonpropertiesllc.com
siamimplement.co.th
suhu.site
thaithienson.net
thebestfikrah.com
themesgiant.net
theunseentales.xyz
thienloc.org
thoitrangtrungnienkim.vn
tillmoon.lt
tongdaihanoi.com
travianbot.net
vietnhabienhoa.com
vintageartgalleria.com
vlexor.com
wxdgut.cn
xuanthinhshop.com
yellomosquito.com
zenithcampus.com
zsartandcraft.com

EMOTET C2s
http://97.120.3.198
http://70.180.33.202
http://50.116.111.59:8080
http://173.249.20.233:443
http://188.165.214.98:8080
http://172.104.97.173:8080
http://41.185.28.84:8080
http://120.150.218.241:443
http://217.20.166.178:7080
http://67.10.155.92
http://188.219.31.12
http://120.150.60.189
http://108.21.72.56:443
http://186.74.215.34
http://144.217.7.207:7080
http://152.170.205.73
http://49.205.182.134
http://187.161.206.24
http://95.213.236.64:8080
http://74.40.205.197:443
http://185.201.9.197:8080
http://142.112.10.95:20
http://100.37.240.62
http://178.152.87.96
http://138.68.87.218:443
http://220.245.198.194
http://62.171.142.179:8080
http://5.2.212.254
http://115.94.207.99:443
http://118.83.154.64:443
http://209.141.54.221:7080
http://75.143.247.51
http://58.1.242.115
http://87.106.139.101:8080
http://104.131.11.150:443
http://78.24.219.147:8080
http://155.186.9.160
http://2.58.16.89:8080
http://37.139.21.175:8080
http://70.92.118.112
http://51.89.36.180:443
http://172.86.188.251:8080
http://109.116.245.80
http://72.186.136.247:443
http://46.105.131.79:8080
http://74.75.104.224
http://95.9.5.93
http://72.229.97.235
http://174.118.202.24:443
http://202.134.4.211:8080
http://37.187.72.193:8080
http://89.216.122.92
http://201.252.34.3
http://123.176.25.234
http://157.245.99.39:8080
http://24.178.90.49
http://167.114.153.111:8080
http://121.124.124.40:7080
http://139.162.60.124:8080
http://190.162.215.233
http://181.165.68.127
http://110.145.77.103
http://185.94.252.104:443
http://85.105.111.166
http://202.141.243.254:443
http://78.188.225.105
http://64.207.182.168:8080
http://208.74.26.234
http://190.29.166.0
http://110.145.101.66:443
http://50.245.107.73:443
http://172.125.40.123
http://161.0.153.60
http://201.241.127.190
http://62.30.7.67:443
http://119.59.116.21:8080
http://79.137.83.50:443
http://47.144.21.37
http://134.209.144.106:443
http://74.208.45.104:8080
http://203.153.216.189:7080
http://62.75.141.82
http://137.59.187.107:8080
http://202.134.4.216:8080
http://172.105.13.66:443
http://168.235.67.138:7080
http://190.240.194.77:443
http://94.23.237.171:443
http://50.91.114.38
http://139.99.158.11:443
http://110.145.11.73
http://72.188.173.74
http://5.39.91.110:7080
http://181.171.209.241:443
http://61.19.246.238:443
http://74.128.121.17
http://194.4.58.192:7080
http://109.74.5.95:8080
http://200.116.145.225:443
http://136.244.110.184:8080
http://67.170.250.203:443
http://24.69.65.8:8080
http://139.59.60.244:8080
http://176.111.60.55:8080
http://24.179.13.119