2020-10-19 Emotet IOCs


CYBERCHEF RECIPE TO GET URLS FROM THE BASE64-ENCODED POWERSHELL SCRIPT
----------------------------------------------------------------------
From_Base64('A-Za-z0-9+/=',true)
Decode_text('UTF-16LE (1200)')
Split('*','\\n')
Find_/_Replace({'option':'Simple string','string':'\''},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'+'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'`'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'.sP'},' ',true,false,true,false)
Extract_URLs(false)


THREAT ATTRIBUTION:  EMOTET

NOTES
Most Word documents I received were using the new "update_blue" template.
The new template no longer has "tiny text" below the graphic.
The base64-encoded Powershell script no longer starts with JAB like it has for many months.
Instead, I saw a few different base64-encoded string beginnings (e.g., "IAA" and "UWB").
Almost all Word documents yielded payload octets.
This new base64 pattern was present even in one of the payload septets that I saw.
I saw what seemed like a LOT of C2s today - in actuality, there's a lot of duplication.
The starting C2 addresses were often different but the C2 list was just in a different order.
Lastly, I saw about a dozen redirects (out of ~40 payload urls) to a supposed Canadian pharmaceutical site.

SENDERS OBSERVED
christine.agbemabia@thebeigepensiontrust.com
eellese@absind.com.ar
egarrido@grupoibero.com.mx
etude.couzigou-suhas@notamail.fr
financeiro@doctorcia.com.br
gerencia@cavalieri.cl
hossain.kh@dhabicontracting.com
hr.bkc@pravinelectricals.in
j.moreno@corporacionurimar.com
jennifer.callahan@hulafrog.com
jolanta.guza@baltkonsults.lv
k-yamato@catinc.co.jp
katia.salmon.94022@paris.notaires.fr
lilyhuang@jingyu.com.co
milton.r.blount@newmountolivet.org
Norma.G@FireProtectionService.com
office@forumsoftware.rs
t-sakyo@hnkk.co.jp
tsmith@greenealabama.org
tu.phung@tqv.vn
wiwat@proen.co.th
wurbonas@chaffeecounty.org

MALDOC DISTRIBUTION URLS
http://020dz.net/wp-includes/Documentation/uexc3qka1peegs/
http://1069thefan.com/wp-content/eTrac/pFoLYBVn7VqI/
http://360www.ca/wp-includes/FILE/
http://akmemontech.us/akmemontech.us/INC/A8kpuHDRTujMRIQ1btG/
http://allnws.com/web_map/INC/
http://asfi-conseil-immobilier.com/wp/wp-content/uploads/paclm/qn0hx0-005063/
http://asikbelajar.com/wp-includes/M1fYAnLkr8Zmo4X4/
http://aslovers.com/wp-content/sites/94260475/ejiri4q17h-04255/
http://baby.mewxu.net/wp-admin/statement/adb81lcab9lpp/
http://bawang.allnws.com/wp-includes/Pages/GFe3nTlOyRMGmr/
http://bemagazine.club/wp-includes/Document/bSHm10d5BUU7zNSkg/
http://blog.pop9ja.com.ng/uploads/FILE/
http://blosh.nz/wp-content/446/0bujw86u7jiu2i/
http://brionnedavis.com/wp-includes/attachments/QtZAhdoVRIo/
http://cardclean.asia/wp-snapshots/eTrac/
http://childselect.com/cgi-bin/invoice/whu5611/m222757754557op71i0zxwijp8m/
http://cnaantours.co.il/wp-content/eTrac/0xvah2as-00065/
http://comercializadorareydeespadas.com.ve/cgi-bin/Overview/hyKuAPzT1WW9hSED7uo/
http://coralia.mx/sistema/attachments/2ozjfk3d0cdfu8/
http://cozyvietnamtravel.com/test/Documentation/XZO0mTAjjTQI98VxvmbD/
http://cresephospitaldeolhos.com.br/cgi-bin/eTrac/kod6HWRTR3i7Y/
http://cresephospitaldeolhos.org.br/cgi-bin/EB5OIAA2UL1/
http://darajelita.com/wp-content/docs/7bLYhpyw0zKNX3/
http://darraghlynch.ie/wp-includes/paclm/nQkED4QAI9Bl4h4JiKg/
http://datijingsai.aitutor.cn/framework/eTrac/DXx8Un5UoPQwHcPReE2o/
http://dev.sieuthimaylocnuoc.vn/wp-admin/includes/attachments/
http://dijkwitgoed.nl/wp-admin/INC/ePk/
http://egwaves.com/cgi-bin/6484/
http://electro.mewxu.net/wp-admin/9678486661511/ClaPZsi6VwhZd/
http://eugenetam.com/Books/INC/BCMnqGoNkhS/
http://fcsl.com.br/wp-content/form/004417/ecjl/
http://fibreflexhq3.com/wp-content/4406/u3wersgkdze/xd0j069yuq42cv1sz7qi865/
http://fibreflexhq5.com/wp-content/NopUfVOzLJ1FXND/
http://fortiny.com/cgi-bin/lm/k4rvPzB4YIDx/
http://geehost.co.za/skoal.geehost.co.za/report/
http://gegar.allnws.com/wp-includes/Pages/nJx3uAZyebYUb/
http://giadungsmart.info/wp-content/balance/5322584241995/rE/
http://glasenaporthopedie.nl/wp-includes/8615921265553292/MCUYy9GlXOpRp/
http://goldmen.in/old-backup/public/877098/CMhcm/
http://grupoaguiasdavida.com/wp-content/T7WZOvFk5u5xONcX8L9/
http://helionspharmaceutical.com/wp-admin/invoice/
http://hermo2u.com/wp-content/swift/iFKBsiiP/
http://hermo4u.com/wp-content/paclm/X9se6u2venoZg2LTNA1/
http://hermonexwanita.com/wp-content/FILE/27522477/nopolvsy1n2h-04845/
http://hiburan.allnws.com/wp-includes/swift/yrlsrts/
http://iflag.com.br/themes/statement/
http://ifmhealth.directory/cgi-bin/LLC/GfARPmCGiAKVE/
http://incubatech.mx/cic0416db6b38/docs/nT995GIkupOK5MJv/
http://jomhermonex.com/wp-content/Overview/6mvc2xq/
http://juliedassylva.com/cgi-bin/payment/uua99dr0htq/
http://jy39bbet.com/wp-admin/swift/45823353/YU/
http://kisah.allnws.com/wp-includes/sites/YtQfYbGzDT/
http://kleberribeiro.com.br/wp-admin/payment/ehznl38duciepvo/q5/
http://krais.co.il/wp-admin/paclm/DpNqyVyISE/
http://learnupapp.online/digisun_learn/Document/28296844154045/esd65qs-0744/
http://lehbirenalcare.com/sys-cache/3gyrty3pglo5y/
http://library.uib.ac.id/wp-contentxx/parts_service/
http://mail.oyj.pl/INC/
http://march4womenhealth.com/wp-content/docs/nnqZrZWEMo1BwjpHb/
http://minesamples.com/wp-admin/LLC/gjeu/
http://miroaccount11.tk/sugar/5Q2D7V/79300829094967797/h455uey683-077580/
http://moonclub.asia/wp-admin/attachments/PnCPwDgG7FfZZHCqn/
http://morefacil.poa.br/wp-admin/public/TgptoPeF9nJktVgmK/
http://mrveggy.com/erros/paclm/
http://musankingdigi.com/wp-admin/statement/
http://musicaparamisas.com/wp-includes/LLC/
http://my.pop9ja.com.ng/wp-includes/lm/054371661/f0jgiljsr-0024528/
http://mymentalcoach.in/indexing/ueqrc9vlc4cdzyoc6sy9esr2nmi2/
http://mysitetrip.com/PHPMailer/788691485335836/xwjs-006714/
http://n2baby.com.vn/wp-content/sites/kkfxxxja/k406fatc2fk6k6ho/
http://nhzlife.net/nhzapp/Overview/
http://nidhicreations.co.in/wp-includes/browse/SWUyKcK0DwZ/
http://nikanpolimer.ir/wp-admin/browse/c2g0yii/
http://nomadadesign.com.mx/F0xAutoConfig/attachments/hc2a03pzv9x3rn/
http://ocz.mx/programa/paclm/Hdvn97XWglFND3/
http://omegaleadgeneration.com/wp-includes/Document/iecpTJ4AkTNYDyjGo0Pr/
http://pantherlifestyle.com/wp-includes/K7bA1Lav9W0ugKoIBE/
http://pricing.betaproject.business/js/invoice/15bbmt80xcx/
http://rahsiamuda.com/wp-content/sites/wak0OAA05a5ahS/
http://rawatcantik.com/wp-content/X3OaE5lEThj6gbcbAmzp/
http://riandutra.com/img/esp/gi3m4f-0296/
http://rjindexbd.xyz/wp-includes/3KWDJ6IU93T/5xv/
http://rxmedic.co/wp-includes/eTrac/68qi2hjvwm5qr/
http://rydchile.cl/wp-content/INC/21129185092/w8e9nvtk-34/
http://sgvipbet8.com/wp-admin/esp/r4hwrad/
http://sirdag.org/wp-admin/docs/hyw15jOGlMwg60CH/
http://skoal.co.za/docs/9cdfgdkiqjj/gcdg5z/
http://smcfurnitures.com/wp-includes/invoice/h8rtpih/
http://smok.land/wp-admin/paclm/ZorwbhJWVHGrO/
http://sofastexpress.com/wp-admin/FILE/i11jb4ptXoGkmoY6/
http://sophisheikhy.ir/advertisel/INC/vAleOzfCA7tgJO8/
http://spdrozki.eu/wp-content/3132271076/bEdIGXVQm3GG/
http://srt-lb.com/wp-admin/INC/gI6jWlQ1EV8doF/
http://sunafricainsurance.co.za/wp/bdqfn3r1/
http://sunafricainsurance.co.za/wp/wp-admin/Reporting/8t32ex1-007103/
http://surewin.com.my/wp-admin/Document/ZHruU2atdhXg/
http://sushiclass.pt/wp-includes/INC/
http://tgdd.mewxu.net/wp-admin/DOC/3gop99dfo28r2yicg3gltmwprl/
http://thementalaspect.com/wp-admin/Scan/3Nqc1Tm3g3L/
http://therealcoachjones.com/wp-content/browse/6rzfp75PxV5crfaDZ/
http://thesciencethinker.com/wp-includes/Document/r6wsnUeQk1xRjPUW/
http://thethoughtsinyourhead.com/wp-admin/document/yp6n9vx/
http://tiocabelinho.com.br/wabco-trailer/docs/utnvwjc/
http://tollsbacken.se/cgi-bin/01390/hgk82fswvneh/
http://tollsbacken.se/cgi-bin/lm/
http://ummaurorahq.com/wp-content/lm/iHYrNEreDL4pIawP/
http://uniteddatabase.net/wp-admin/qvi4cbre9/
http://v-0-v.cn/wp-admin/FILE/xiarU1N6dk5dUZt0/
http://v1.karofivietnam.vn/wp-admin/DOC/kkz2l3z36l/bfwpymaa1sxh28z2vqq5a5gmomm/
http://vesa-games.ch/wp-admin/OCT/5541o5axrv/
http://vote.yixuecup.com/images/attachments/attachments/uK/
http://vr4business.ch/wp-admin/INC/ttLNAy1ETg7deshwBz8m/
http://web.homegate.my/BulkApp-doc/DOC/UKrwalk797ChvRX/
http://weddings.loukyasalon.in/cgi-bin/LLC/5H2boaIiYuBv5mWn8iop/
http://weemba.yixueyun.cn/SubjectImgs/report/
http://wp.kosteel.co.kr/wordpress/LLC/bbbp1zZYyTY/
http://www.greaudstudio.com/docs/INC/w45fmoM11hZ3Pr/
http://www.howtoinstallx.com/dashboardl/eTrac/2327804735644045/Wat/
http://xandeprefeito.com.br/wp-includes/OCT/xo3cmohkc62mz32/
http://xs188550.xsrv.jp/3815137131/bg9blybzqg-00688/
http://yixuebei.aitutor.cn/framework/sites/9639841272513841/OFdIZhm/
http://zmtkai.cn/wp-includes/OCT/BB53Hi5d35b/
https://adrielhessel.com.br/wp-content/FILE/2Fljxtl5gAMxvw5R/
https://al-qemmah.com/wp-content/92J0G11C96HJH/HxfYxxiRla/
https://arrownic.com/wp-content/eTrac/zpn6yh3xdsw/yeeq79r1jpu83wv9zwgfcbl/
https://asfi-conseil-immobilier.com/wp/wp-content/uploads/paclm/qn0hx0-005063/
https://asl-trilingual.com/blog/statement/
https://asoagrotolgalilea.com/wp-includes/OCT/
https://atwakft.com/wp-admin/attachments/VldKyoIqjnzHm/
https://autouniauto-it.com/wp-content/Document/bMuuE36rLUT/
https://bborton.com/wp-includes/DOC/UzCcDHe54raolyVZNX2I/
https://beneco.com.au/wp-content/public/897222/DGvpSbu/
https://bhandaraexpress.com/wp-includes/Documentation/4wTT4IH9BL7ITVfl8x/
https://bioblu.org/localisationl/browse/NSaMbObnw/
https://bloglg.com/indexing/LLC/V8rNH9SdKLAmF/
https://bluewave.com/soademo/statement/bheJTzvwX/
https://bokunotshirt.com/xhprof/FILE/w90xx70tknyywr/kk4ukewg2ao41948s/
https://buznatural.com/journal/Reporting/Z3yM4Crq2eiQiJZ/
https://byeold.ir/wp/Document/Mf417zr7HZInZAYf/
https://ciallis.net/asistan/OCT/68ia09g4ev/
https://clinicasmasterlife.com.br/wp-content/paclm/kbvtmtv05OhpxHCo2u3/
https://conecxiongroup.com/cgi-bin/public/7802329466109392/rKyKDHw/
https://crmbusiness.xyz/wp-includes/TE40IFTWDV2/3rg0344XD4wCMOJmMnV/
https://daringbydesign.net/wp-admin/Document/76765097320/fyu7b-0005615/
https://demonwraps.com/wp-admin/LLC/LdWHt2mcavGiQ/
https://dev.maylocnuockangaroo.vn/wp-admin/INC/826961338048/1pas74p-0025/
https://dienshop.store/wp-includes/public/
https://docine.com.hr/wp-admin/FILE/6dHSzApXy3XxWqACDp/
https://ecocraftplanet.com/wp-content/Pages/sJnytnz6YdVpfM5PYZp8/
https://emmanuelmonastery.org/wp-admin/sites/9gtih4w44hc/v71kux24ftkg/
https://epeixao.com/vendor/INC/gefj8rs8u/w89d9hrshp/
https://essentricgraphic.com/marketplace/Document/hnujEV9ToO4iWEz95u/
https://etavern.ro/iclr-2020/Documentation/9z/
https://etil-alkol-izmir.tech/wp-admin/balance/
https://exoticbirdsonline.com/wp/public/9260607318029990/ipozf9tya7-0004770/
https://fides.uy/cgi-bin/Pages/XSQtfifp5XKWQ0/
https://finewines.com.sg/fis/50726416125/enxlrWS2vmt/
https://flaneur.pk/breaking-news/public/GlNeTIhKEuf/
https://foreverutoogp.co.za/cgi-bin/invoice/8843880452/d1ehdx2tly-0000990/
https://fumiclean.cl/wp/OCT/11346911381484612/79zff2jw-0006/
https://fzweiming.com/wp-content/public/uExlIqZ/
https://gauravgaafil.online/wp-includes/DOC/h976hibb/khyffnf3gt0ar5m9j3mr9wain5xwqx/
https://geehost.co.za/skoal.geehost.co.za/report/
https://genetic-data.xyz/wp-includes/Overview/viKSmlaamUnrrT6/
https://giadungninhbinh.com/wp-includes/payment/RTzFZ/
https://goodshoes.org/wp-includes/statement/872248379338/irz1v2pv-006780/
https://granate.inet.cl/wp/attachments/fgvA6FfCE85nom/
https://groovewithben.com/wp-admin/Scan/JWoXaLou0ycS/
https://groupbps.com/wp-content/uploads/attachments/es3et1u1gkn/
https://hikichi.vn/wp-content/xxgir8d0bow-574/
https://hotshoes.biz/wp-includes/9775/uryysbukdkhrkth/8qjziaccp6aif7nz9hlapo/
https://hpcf.cyi.ac.cy/wp-includes/report/
https://huixingqiti.com/wp-admin/balance/
https://insideedgetechnologies.com/img/Overview/vw4mclp3x4/hdgdaqy1p65jq45r5pbl1x/
https://instagridkit.com/wp-content/Scan/OK9JGcnujS2DcIdjUFZ/
https://institutonovavida.com.br/wp-content/report/
https://jejal.in/wp/sites/p9AjpSiDwCqB3ZbqnWki/
https://jorko.tk/report/2l8y1fq4df-05693/Scan/Ly5q7cickSpB/
https://journeyonline.pk/cgi-bin/Overview/hhzfkgsk9r8/
https://kewone.com/wp-admin/esp/3h3zb-000774/
https://kurumsalseo.name.tr/img/godcsxzu0et4a/nkj2mk7ta1dztg/
https://lesaintlaurentvape.com/wp-admin/paclm/dwukur/
https://lilypads.com/wp-content/docs/dCHHYRQUAKZxMu3BgG5U/
https://lina1960.com/alfacgiapi/63IPZ7XC2OZ075/aB/
https://liubaozi.cn/wp-admin/public/jnsYmmlK/
https://mac88.vn/wp-content/FILE/h3d30yov-83380/
https://malayetech.ml/wp/Overview/df5uxd1p3it1wtj/
https://manysolutions.pk/cgi-bin/eTrac/P83muran6AKKu3tlEe/
https://markbrindes.com.br/wp-includes/sites/q1stncj3pa-000433/
https://mdmlc.com/cgi-bin/DOC/oJoyCaBeGa90VyyTT/
https://mituskicrafts.com/wp-includes/docs/onqDI5GZh2L8A21G/
https://moraniz.co.il/wp-content/report/gl2tamny/
https://mrveggy.com/erros/paclm/
https://mudaru.vn/wordpress/Pages/XvPi62DUwPOF8/
https://mundodelcalzado.store/wp-includes/436021RBFK/DmQrJnPN5xULb3fv/
https://nautine.xyz/wp-content/uploads/2020/09/7P03778/rvfnz1/
https://nepalsocialcenter.com/data/swift/7ozakpz/iish7bru44kzakg573ln/
https://nhzlife.net/nhzapp/Overview/
https://nikolaevtranslations.com/cgi-bin/OCT/nj14mvk63/dn4jbehyvp1hmct/
https://nocindia.org/comming_soon_template/FILE/yjnwn7/
https://orjinal.cialis.website/asistan/Documentation/hmdFVZnEK4xiCFw/
https://phanphoikangaroo.com.vn/cgi-bin/attachments/atvUbJKPyVmpmgKcD/
https://pleromagroup.com/homes/form/65gi-003912/
https://pluginbot.ai/wp-content/FILE/pouDSYkZ6wC5Pb/
https://poplifeshoes.com/wp-includes/docs/lffCarSfqzR2z6ePx55/
https://portesobertes.proven.cat/wp-content/Overview/Ql24rtGdmlwBBY7I/
https://pratuksha.org/wp-content/Pages/lMIGwcANVVhYW7o33jPO/
https://radio.hablum.es/cli/statement/793948638/i6jv76ok-000207205/
https://ravesonline.in/wp-admin/lm/
https://rosado.xyz/wp/public/Y7lbp0eZenhbn8BwSc2/
https://sardargroupofcompanies.com/wp-includes/parts_service/sf7znj01qii/
https://shoesforsale.net/wp-includes/INC/
https://shoesite.biz/wp-includes/544822144789/CgVJDyMg8dFoS2/
https://shoeslifts.com/tempEP/a8Uq29itv44v6lT/
https://shoesvariety.com/wp-includes/582737223427/yG/
https://sibob.de/wp-content/parts_service/c3sv4k6n-00776629/
https://smartstorage.com.br/wp-includes/450/56441/eV/
https://soumitatechify.com/wp-includes/invoice/u7jcm8k28pw-0008956/
https://srismartechsolutions.in/wp-content/Document/CdrrOsluh9x/
https://stageward.com/oldfiles/Pages/IzGVPfd2XjA9XLhSk/
https://streamshosting.co.za/cgi-bin/0a7kh9p07naxh/
https://tamiabetheawilliams.com/admin-area/swift/no9bx3v7n1v4qhd/zc8lyy2t/
https://tekshoi.com/wp-content/public/iwC4qMgi4snYQmO4NJ6z/
https://thefashionfirst.com/wp-content/FILE/qLHJ8aZd1Rt/
https://tintucquangninh.net/wp-admin/INC/gFjwDWsuM/
https://trysocio.com/wp-content/sites/ep2t2smp/
https://uniteddatabase.net/wp-admin/qvi4cbre9/
https://urbanix.com.bd/demo/ig4q9t/
https://vesa-games.ch/wp-admin/OCT/5541o5axrv/
https://vidaserenapremier.com.br/vidas/16x3xevdb-981/
https://wholesaleshoes.biz/wp-includes/31915465487360904/hwQ/
https://whopper.co.jp/test/esp/mn2fd6l0zo5-008877/
https://wp1.devbox.in/wp-admin/statement/yjksrstl/
https://xfactorguide.com/wp-admin/browse/
https://xn--borsaliman-6ub.com/wp-content/lm/66VCk4ZN9jCR/
https://yaseminadamkaya04mail.com/wp-content/Document/4322641253001/DRxFAezfD/
https://yusful.nl/marketplace/Scan/vxWavA1wQBY1oQfyC/

020dz.net
1069thefan.com
360www.ca
adrielhessel.com.br
aitutor.cn
akmemontech.us
al-qemmah.com
allnws.com
arrownic.com
asfi-conseil-immobilier.com
asikbelajar.com
asl-trilingual.com
aslovers.com
asoagrotolgalilea.com
atwakft.com
autouniauto-it.com
bborton.com
bemagazine.club
beneco.com.au
betaproject.business
bhandaraexpress.com
bioblu.org
bloglg.com
blosh.nz
bluewave.com
bokunotshirt.com
brionnedavis.com
buznatural.com
byeold.ir
cardclean.asia
childselect.com
cialis.website
ciallis.net
clinicasmasterlife.com.br
cnaantours.co.il
comercializadorareydeespadas.com.ve
conecxiongroup.com
coralia.mx
cozyvietnamtravel.com
cresephospitaldeolhos.com.br
cresephospitaldeolhos.org.br
crmbusiness.xyz
cyi.ac.cy
darajelita.com
daringbydesign.net
darraghlynch.ie
demonwraps.com
devbox.in
dienshop.store
dijkwitgoed.nl
docine.com.hr
ecocraftplanet.com
egwaves.com
emmanuelmonastery.org
epeixao.com
essentricgraphic.com
etavern.ro
etil-alkol-izmir.tech
eugenetam.com
exoticbirdsonline.com
fcsl.com.br
fibreflexhq3.com
fibreflexhq5.com
fides.uy
finewines.com.sg
flaneur.pk
foreverutoogp.co.za
fortiny.com
fumiclean.cl
fzweiming.com
gauravgaafil.online
geehost.co.za
genetic-data.xyz
giadungninhbinh.com
giadungsmart.info
glasenaporthopedie.nl
goldmen.in
goodshoes.org
granate.inet.cl
greaudstudio.com
groovewithben.com
groupbps.com
grupoaguiasdavida.com
hablum.es
helionspharmaceutical.com
hermo2u.com
hermo4u.com
hermonexwanita.com
hiburan.allnws.com
hikichi.vn
homegate.my
hotshoes.biz
howtoinstallx.com
huixingqiti.com
iflag.com.br
ifmhealth.directory
incubatech.mx
insideedgetechnologies.com
instagridkit.com
institutonovavida.com.br
jejal.in
jomhermonex.com
jorko.tk
journeyonline.pk
juliedassylva.com
jy39bbet.com
karofivietnam.vn
kewone.com
kleberribeiro.com.br
kosteel.co.kr
krais.co.il
kurumsalseo.name.tr
learnupapp.online
lehbirenalcare.com
lesaintlaurentvape.com
lilypads.com
lina1960.com
liubaozi.cn
loukyasalon.in
mac88.vn
mail.oyj.pl
malayetech.ml
manysolutions.pk
march4womenhealth.com
markbrindes.com.br
maylocnuockangaroo.vn
mdmlc.com
mewxu.net
minesamples.com
miroaccount11.tk
mituskicrafts.com
moonclub.asia
moraniz.co.il
morefacil.poa.br
mrveggy.com
mudaru.vn
mundodelcalzado.store
musankingdigi.com
musicaparamisas.com
mymentalcoach.in
mysitetrip.com
n2baby.com.vn
nautine.xyz
nepalsocialcenter.com
nhzlife.net
nidhicreations.co.in
nikanpolimer.ir
nikolaevtranslations.com
nocindia.org
nomadadesign.com.mx
ocz.mx
omegaleadgeneration.com
pantherlifestyle.com
phanphoikangaroo.com.vn
pleromagroup.com
pluginbot.ai
pop9ja.com.ng
poplifeshoes.com
pratuksha.org
proven.cat
rahsiamuda.com
ravesonline.in
rawatcantik.com
riandutra.com
rjindexbd.xyz
rosado.xyz
rxmedic.co
rydchile.cl
sardargroupofcompanies.com
sgvipbet8.com
shoesforsale.net
shoesite.biz
shoeslifts.com
shoesvariety.com
sibob.de
sieuthimaylocnuoc.vn
sirdag.org
skoal.co.za
smartstorage.com.br
smcfurnitures.com
smok.land
sofastexpress.com
sophisheikhy.ir
soumitatechify.com
spdrozki.eu
srismartechsolutions.in
srt-lb.com
stageward.com
streamshosting.co.za
sunafricainsurance.co.za
surewin.com.my
sushiclass.pt
tamiabetheawilliams.com
tekshoi.com
thefashionfirst.com
thementalaspect.com
therealcoachjones.com
thesciencethinker.com
thethoughtsinyourhead.com
tintucquangninh.net
tiocabelinho.com.br
tollsbacken.se
trysocio.com
uib.ac.id
ummaurorahq.com
uniteddatabase.net
urbanix.com.bd
v-0-v.cn
vesa-games.ch
vidaserenapremier.com.br
vr4business.ch
wholesaleshoes.biz
whopper.co.jp
xandeprefeito.com.br
xfactorguide.com
xn--borsaliman-6ub.com
xsrv.jp
yaseminadamkaya04mail.com
yixuebei.aitutor.cn
yixuecup.com
yixueyun.cn
yusful.nl
zmtkai.cn

DOCUMENT FILE HASHES
02a95f93d147000bedd0a919069c2b73
3428af11fc49a1b086829b1eb8cb9927
37a642330ee314a46c5ad4f47fddb96e
6c2153b78aab6876833bbbc5e79e24cf
7be56bfd3aa1834133561463a75386ab
b40d4cca6d353a5e89b1b8eb8f331205
eb267b493c254e9ec130da62aa992732
fcd6979747000c6b0d6bf96c5ed88f3e

PAYLOAD FILE HASHES
089e180552ce5433ec44dc9be897b06a
2ebc80526ed03c64e23753512ee969d2
314ba20c0aa6317cfc343b549eeb0acc
423881aa8631065e043f8aa8335b2e0b
5f5ef349b549cd0a4c5fb69dfc139fd1
684ba2ea81a8e9ab031260cbf0dd5db8
6bd98ab2b96c52b87abb595fc6e44c2c
77aec038f39424c68df211cd70971301
98e342a065ea3c350fbf264476357a18
9c5cb43c54edf1710ed76ede06fff07c
a52728ef9def0753f1e1ce4cc0aa2173
ab37a135bd1438986dad9f8daa3b75e7
abc2575615e7b199a19778cd0c35a460
ad4182961a8495e5fc3cfc2a483eae73
bea080158eb27ba0ac3873048753492f
c8f72a88b26d35b7d9736ba4f3ed9abc
f51501b38c74aed2a24a2a735e2f0bec
f5b96e4d242d5c54c7ae9c5ced89af20

EMOTET PAYLOAD URLs
http://13digi.net/wp-admin/j/
http://4kwallpaperdownload.com/wp-admin/ET/
http://a2zarchitect.com/wp-admin/LAs0P/
http://ad-avenue.net/-/MH6/
http://allcannabismeds.com/unraid-map/R2vPDZ/
http://ardos.com.br/simulador/bPNx/
http://berjaya88.net/wp-admin/X2TBc2l/
http://blog.artemisaritim.com/accuracy-of/z/
http://blog.gadzoom.net/wp-includes/g0/
http://bluedemonlodge.com/wp-content/yBvR7Tw/
http://bodyinnovation.co.za/wp-content/2ssHvi/
http://brionnedavis.com/wp-includes/7xfbzeMB/
http://cplt20live.com/wp-includes/Text/payment/DmYI/
http://daogou.icu/wp-admin/kyJ4pA/
http://dp-womenbasket.com/wp-admin/Li/
http://drtheurelplasticsurgery.com/generalo/rhrhflv92/
http://entout.co.uk/wp-includes/wdh/
http://fatinzbeaute.com/wp-includes/7/
http://fotomax.fr/cgi-bin/dm/
http://goldentimepattaya.com/123-smart/TB/
http://gtech.thngo58.com/zwift-level/xnH/
http://guarany.net/zefiro/K/
http://holonchile.cl/purelove/Y4/
http://ispin88.com/wp-admin/BLj149/
http://jegsnet.com/wp-content/J/
http://jobstv.live/wordpress/Ma7Mvuq/
http://karateazabukwf.com/css/Yp4F0nOjFK/
http://laindianrestaurants.com/wp-includes/B3pPZIas/
http://leboutique-store.com/wp/dOs/
http://mantaspesadas.com/wp-includes/agV/
http://musc.health/wp-content/NiTa8/
http://nomadco.es/wp-admin/MvwVHCG/
http://podzalog39.ru/podzalogOLD/n/
http://pskh888.com/wp-admin/w/
http://rajania.com/cummins-engine/nPd/
http://resuco.net/backup/kxf/
http://richellemarie.com/wp-admin/xlTWW/
http://richelleshadoan.com/wp-admin/Ucrkcvp/
http://royal888bet.com/wp-admin/LHJ/
http://slimpiu.com/wp-admin/Ojy9qt/
http://smallbatchliving.com/wp-admin/uccE/
http://stylefix.co/guillotine-cross/CTRNOQ/
http://sunpi.net/wp-includes/n/
http://svi.bo/wp-content/NIEP3/
http://techsama.com/wp-admin/w0/
http://terriafit.com/wp-content/6j/
http://thedigitalsquad.net/sitemap/Wy6wU0/
http://tonolledo.com/docs/R6/
http://travelsportrepeat.com/wp-content/0/
http://ttbet.co/wp-admin/77Q30/
http://tudorinvest.com/wp-admin/rGtnUb5f/
http://tuhishair.com/blog/g3H/
http://wemusthaveit.com/freeze-columns/KQiSFq7/
http://wintekelevators.com/avast-premium/S6/
http://wisdomapologetics.com/neje-master/KM/
http://worlddatapro.com/flama-condensed/2fPei5/
http://www.bespokebysumitgrover.com/wp-includes/mwYw/
http://www.yanlipin.net/wp-admin/Q/
https://aabeds.com/jtdla2131/Y/
https://aanshtravels.com/_notes/JLM/
https://ahiminstore.com/cgi-bin/YI/
https://arkan-memar.com/wp-content/gG/
https://baltische-rundschau.eu/wp-content/uploads/2pj7/
https://brahmanimetal.com/horizon-transport/d/
https://cesindonesia.com/wp-includes/lof0exi/
https://cosyshe.com/wp-includes/A41/
https://easihacks.com/wp-includes/d/
https://etkindedektiflik.com/wp-admin/DnV1/
https://fatinzbeaute.com/wp-includes/7/
https://geeksmouservices.xyz/wp-admin/Ax7/
https://geoportal.rivasciudad.es/wp-includes/MD/
https://goodpriceshoes.com/wp-includes/0Ko/
https://grenflor.com/wp-admin/dCmbqV/
https://hbrpatel.com/wp-content/amT/
https://help.hizuko.com/groovy-count/iY/
https://indiastartup360.com/wp-admin/Cm/
https://jegsnet.com/wp-content/J/
https://ludwigmodel.net/wp-admin/i/
https://marketcentsinc.com/_backup/cMf/
https://melrosebeautycenter.com/windows-10/MM/
https://nasrmobin.com/wp-includes/BtnnEUaqr/
https://news.scott.services/wp-content/qg/
https://onepalate.biz/wp/YuUcpzM/
https://oplungiphone.net/wp-admin/Nx/
https://othoy.com/crm/teN/
https://ozonerenovaters.co.za/wp-admin/VaxUg/
https://physicianmedical-legalconsulting.com/cgi-bin/pk0mOL9/
https://raumfuerneues.eu/error/AuTiH/
https://safeintelpro.com/yoruba-culture/36/
https://sezard.com/wordpress/TviJvE/
https://shoesdesign.net/wp-includes/5TV3AS/
https://shroook.com/do-it/BQ/
https://stech.com.np/wp-admin/U/
https://streamnature.com/rzr-turbo/E6AqYofQ/
https://tcamexpo.com/wp-content/c/
https://webdachieu.com/wp-admin/J/
https://www.sunpi.net/wp-includes/n/
https://zakariabek.com/wp/ocwL/
https://zamindarsons.com/wp-content/v7Tk/


13digi.net
4kwallpaperdownload.com
a2zarchitect.com
aabeds.com
aanshtravels.com
ad-avenue.net
ahiminstore.com
allcannabismeds.com
ardos.com.br
arkan-memar.com
artemisaritim.com
baltische-rundschau.eu
berjaya88.net
bespokebysumitgrover.com
bluedemonlodge.com
bodyinnovation.co.za
brahmanimetal.com
brionnedavis.com
cesindonesia.com
cosyshe.com
cplt20live.com
daogou.icu
dp-womenbasket.com
drtheurelplasticsurgery.com
easihacks.com
entout.co.uk
etkindedektiflik.com
fatinzbeaute.com
fotomax.fr
gadzoom.net
geeksmouservices.xyz
goldentimepattaya.com
goodpriceshoes.com
grenflor.com
guarany.net
hbrpatel.com
hizuko.com
holonchile.cl
indiastartup360.com
ispin88.com
jegsnet.com
jobstv.live
karateazabukwf.com
laindianrestaurants.com
leboutique-store.com
ludwigmodel.net
mantaspesadas.com
marketcentsinc.com
melrosebeautycenter.com
musc.health
nasrmobin.com
nomadco.es
onepalate.biz
oplungiphone.net
othoy.com
ozonerenovaters.co.za
physicianmedical-legalconsulting.com
podzalog39.ru
pskh888.com
rajania.com
raumfuerneues.eu
resuco.net
richellemarie.com
richelleshadoan.com
rivasciudad.es
royal888bet.com
safeintelpro.com
scott.services
sezard.com
shoesdesign.net
shroook.com
slimpiu.com
smallbatchliving.com
stech.com.np
streamnature.com
stylefix.co
sunpi.net
svi.bo
tcamexpo.com
techsama.com
terriafit.com
thedigitalsquad.net
thngo58.com
tonolledo.com
travelsportrepeat.com
ttbet.co
tudorinvest.com
tuhishair.com
webdachieu.com
wemusthaveit.com
wintekelevators.com
wisdomapologetics.com
worlddatapro.com
yanlipin.net
zakariabek.com
zamindarsons.com

EMOTET C2s
http://1.226.84.243:8080
http://103.229.73.17:8080
http://103.236.179.162
http://103.80.51.61:8080
http://103.86.49.11:8080
http://103.93.220.182
http://104.131.11.150:443
http://104.131.123.136:443
http://104.131.144.215:8080
http://104.131.41.185:8080
http://104.131.44.150:8080
http://105.209.235.113:8080
http://108.46.29.236
http://109.13.179.195
http://109.190.249.106
http://109.190.35.249
http://109.206.139.119
http://109.74.5.95:8080
http://110.142.236.207
http://110.145.77.103
http://110.37.224.243
http://111.67.12.221:8080
http://113.161.148.81
http://113.193.239.51:443
http://113.203.238.130
http://113.61.66.94
http://115.79.195.246
http://115.79.59.157
http://116.202.10.123:8080
http://116.91.240.96
http://118.243.83.70
http://118.33.121.37
http://118.83.154.64:443
http://119.92.77.17
http://12.162.84.2:8080
http://12.163.208.58
http://120.150.218.241:443
http://120.150.60.189
http://120.51.34.254
http://121.117.147.153:443
http://121.124.124.40:7080
http://121.7.31.214
http://123.142.37.166
http://123.176.25.234
http://123.216.134.52
http://124.41.215.226
http://125.200.20.233
http://126.126.139.26:443
http://128.92.203.42
http://130.0.132.242
http://134.209.36.254:8080
http://137.59.187.107:8080
http://137.74.106.111:7080
http://138.97.60.140:8080
http://138.97.60.141:7080
http://139.162.108.71:8080
http://139.162.60.124:8080
http://139.59.12.63:8080
http://139.59.60.244:8080
http://139.59.61.215:443
http://139.99.158.11:443
http://140.186.212.146
http://142.112.10.95:20
http://143.95.101.72:8080
http://149.202.72.142:7080
http://152.169.22.67
http://153.164.70.236
http://153.229.219.1:443
http://157.245.99.39:8080
http://157.7.164.178:8081
http://162.144.145.58:8080
http://162.241.140.129:8080
http://162.241.242.173:8080
http://164.160.45.41:8080
http://167.114.153.111:8080
http://168.235.67.138:7080
http://170.81.48.2
http://172.104.169.32:8080
http://172.104.97.173:8080
http://172.105.78.244:8080
http://172.193.79.237
http://172.86.186.21:8080
http://172.91.208.86
http://172.96.190.154:8080
http://173.212.197.71:8080
http://173.63.117.194
http://174.106.122.139
http://174.118.202.24:443
http://174.45.13.118
http://175.103.38.146
http://175.143.12.123:8080
http://176.111.60.55:8080
http://177.129.17.170:443
http://177.130.51.198
http://177.144.130.105:443
http://177.144.130.105:8080
http://177.23.7.151
http://177.73.0.98:443
http://177.74.228.34
http://178.211.45.66:8080
http://178.250.54.208:8080
http://178.33.167.120:8080
http://179.5.118.12
http://180.148.4.130:8080
http://180.21.3.52
http://180.23.53.200
http://181.123.6.86
http://181.126.74.180
http://181.129.96.162:8080
http://181.30.61.163:443
http://181.61.182.143
http://183.176.82.231
http://184.180.181.202
http://185.142.236.163:443
http://185.183.16.47
http://185.208.226.142:8080
http://185.80.172.199
http://185.94.252.104:443
http://185.94.252.12
http://185.94.252.27:443
http://186.103.141.250:443
http://186.189.249.2
http://186.222.250.115:8080
http://186.70.127.199:8090
http://186.74.215.34
http://188.135.15.49
http://188.157.101.114
http://188.166.220.180:7080
http://188.219.31.12
http://188.226.165.170:8080
http://188.251.213.180
http://188.40.170.197
http://189.2.177.210:443
http://189.223.16.99
http://190.108.228.27:443
http://190.115.18.139:8080
http://190.117.101.56
http://190.151.5.131:443
http://190.164.135.81
http://190.188.245.242
http://190.190.219.184
http://190.192.39.136
http://190.194.12.132
http://190.24.243.186
http://190.240.194.77:443
http://190.55.186.229
http://190.85.46.52:7080
http://190.96.15.50
http://191.182.6.118
http://191.191.23.135
http://192.163.221.191:8080
http://192.175.111.214:8080
http://192.210.217.94:8080
http://192.232.229.54:7080
http://192.241.143.52:8080
http://192.241.220.183:8080
http://192.81.38.31
http://194.187.133.160:443
http://194.4.58.192:7080
http://195.201.56.70:8080
http://198.20.228.9:8080
http://2.45.176.233
http://2.58.16.86:8080
http://200.127.14.97
http://201.213.177.139
http://201.71.228.86
http://202.134.4.210:7080
http://202.29.237.113:8080
http://203.153.216.178:7080
http://203.153.216.189:7080
http://203.56.191.129:8080
http://208.180.207.205
http://209.141.54.221:7080
http://209.236.123.42:8080
http://209.54.13.14
http://212.198.71.39
http://212.71.237.140:8080
http://212.71.250.88:8080
http://213.165.178.214
http://213.197.182.158:8080
http://213.52.74.198
http://216.139.123.119
http://216.47.196.104
http://217.13.106.14:8080
http://218.147.193.146
http://219.92.13.25
http://220.245.198.194
http://221.147.142.214
http://223.17.215.76
http://24.137.76.62
http://24.179.13.119
http://24.230.141.169
http://24.231.51.190
http://24.232.228.233
http://27.83.209.210:443
http://36.91.44.183
http://37.139.21.175:8080
http://37.179.145.105
http://37.183.81.217
http://37.187.100.220:7080
http://37.187.161.206:8080
http://37.187.72.193:8080
http://37.205.9.252:7080
http://37.46.129.215:8080
http://41.185.29.128:8080
http://41.76.213.144:8080
http://42.200.96.63
http://43.255.175.197
http://45.239.204.100
http://45.33.77.42:8080
http://45.46.37.97
http://46.101.58.37:8080
http://46.105.114.137:8080
http://46.105.131.68:8080
http://46.105.131.79:8080
http://46.32.229.152:8080
http://46.43.2.95:8080
http://47.144.21.12:443
http://47.154.85.229
http://47.36.140.164
http://49.3.224.99:8080
http://49.50.209.131
http://5.189.178.202:8080
http://5.196.108.189:8080
http://5.196.35.138:7080
http://5.196.74.210:8080
http://5.39.91.110:7080
http://5.79.70.250:8080
http://5.89.33.136
http://50.116.78.109:8080
http://50.121.220.50
http://50.28.51.143:8080
http://50.35.17.13
http://50.91.114.38
http://51.15.7.145
http://51.15.7.189
http://51.255.165.160:8080
http://51.38.124.206
http://51.38.50.144:8080
http://51.75.33.127
http://54.38.143.245:8080
http://58.27.215.3:8080
http://59.148.253.194:8080
http://60.125.114.64:443
http://60.93.23.51
http://61.19.246.238:443
http://61.33.119.226:443
http://62.30.7.67:443
http://62.75.141.82
http://62.84.75.50
http://64.201.88.132
http://66.76.12.94:8080
http://68.183.170.114:8080
http://68.183.190.199:8080
http://68.252.26.78
http://69.206.132.149
http://70.169.17.134
http://70.32.115.157:8080
http://70.32.84.74:8080
http://71.15.245.148:8080
http://71.72.196.159
http://72.143.73.234:443
http://72.249.144.95:8080
http://73.100.19.104
http://73.55.128.120
http://74.135.120.91
http://74.208.173.91:8080
http://74.208.45.104:8080
http://74.214.230.200
http://74.58.215.226
http://75.127.14.170:8080
http://75.139.38.211
http://75.143.247.51
http://76.171.227.238
http://76.175.162.101
http://77.238.212.227
http://77.74.78.80:443
http://77.78.196.173:443
http://78.186.65.230
http://78.188.106.53:443
http://78.24.219.147:8080
http://79.118.74.90
http://79.133.6.236:8080
http://79.137.83.50:443
http://79.98.24.39:8080
http://8.4.9.137:8080
http://80.241.255.202:8080
http://81.215.230.173:443
http://82.76.111.249:443
http://82.78.179.117:443
http://83.110.223.58:443
http://83.169.21.32:7080
http://85.214.26.7:8080
http://85.25.106.204:8080
http://85.75.49.113
http://86.123.55.0
http://87.106.136.232:8080
http://87.106.139.101:8080
http://87.106.46.107:8080
http://88.247.58.26
http://89.121.205.18
http://89.216.122.92
http://91.121.87.90:8080
http://91.146.156.228
http://91.211.88.52:7080
http://91.213.106.100:8080
http://91.75.75.46
http://91.83.93.103:443
http://93.147.212.206
http://94.176.234.118:443
http://94.200.114.161
http://94.212.52.40
http://94.23.237.171:443
http://95.213.236.64:8080
http://95.76.142.243
http://96.245.227.43
http://97.82.79.83
http://98.103.204.12:443
http://98.13.75.196
http://98.174.164.72